The organisation had security activity underway, but its leaders could not see clearly how exposed it was or which decisions would improve that position. An experienced CISO helped turn separate reports and technical work into a security programme the board could govern and fund.
The challenge
Individual security activities existed across the organisation. What was missing was a dependable view of risk that could inform strategy, investment and project approvals. Leaders needed evidence they could question, a clear route for decisions and a way to see whether agreed work was changing the organisation's position.
What changed
The CISO took responsibility for cyber security, information security and data protection, reporting through an executive sponsor on behalf of the chief executive. The first step was to build working relationships with the executive team and establish regular reporting to the board. That gave difficult facts a route to people who could act on them.
The work then moved into the organisation's day to day decisions. Its first cyber security strategy set a direction. Tiered risk registers gave operational teams and executives the level of detail each needed. A governance group brought business and technical leaders together, while revised incident reporting made escalation clearer. Security became a formal factor in board and project approvals.
Technical testing, security telemetry and structured data collection replaced broad judgements with evidence. The team updated policies against applicable Government requirements, introduced recognised control frameworks and rebuilt supplier assurance. Secure by Design was brought into project delivery as well as board governance. Dedicated funding was secured for improvement work.
The engagement also included leadership of the wider cyber security, information security and data protection team. Staff received development plans, funded training and mentoring, so the change was supported by the people expected to carry it forward.
The result
Leaders moved from separate security activities to a clearer account of cyber risk and the work needed to reduce it. The programme reported improvements in control maturity, policy compliance, awareness, vulnerability management and monitoring visibility. Cyber became part of business planning and investment decisions, with named forums and evidence behind those conversations. The internal team had development plans, funded training and mentoring to support that work.
An independent assessment against the Cyber Assessment Framework confirmed the direction of improvement and recommended that the programme continue. It was an endorsement of progress, with further work still to do.
Need a clearer view of cyber risk at board level? Talk to Wuluf about CISO leadership for your organisation.