Briefing
Smaller organizations can buy senior leadership part time. The question is which kind.
A fractional CISO is accountable for risk: assessments, the risk register, policies, incident response planning, vendor security reviews, customer questionnaires and audit readiness. A fractional CTO is accountable for technology direction: architecture, platforms, software decisions, scaling and automation.
Governance is now part of the frameworks. NIST CSF 2.0 added a Govern function. CISA's CPG 2.0 begins with establishing cybersecurity roles and responsibilities, and notes that contractors can help.
What to do
- Choose a CISO first when security questions from customers, regulators or insurers go unanswered, or after an incident.
- Choose a CTO first when a major platform decision, migration or software build is coming, or technology costs lack a plan.
- Choose both, on a shared roadmap, when growing in a regulated sector.
- Contract for a named individual, defined deliverables and response times.
- Retain ownership of all documents produced.
How to verify
- Within the first quarter, expect a risk register (CISO) or a technology roadmap (CTO).
- Review a sample leadership report before signing.
- Confirm the advisor is independent of any environment they would assess.
Sources
- NIST, NIST Releases Version 2.0 of Cybersecurity Framework, Feb 26, 2024
- CISA, Cybersecurity Performance Goals 2.0
Want help putting this in place? Contact Computer Plus.