,
5 tweets,
1 min read
Read on Twitter
If you’re a CEO, CFO, or CIO, you’re directly responsible for the caliber of cybersecurity at your company. You should be aware of risk your organization faces and facilitate budget, directives, and staffing for your security team based on it. You enable their success or failure.
“CISO fix it” will never succeed if he or she has to operate in a vacuum without executive buy-in or sensible budget.
Penalizing employees for security incidents caused by lack of proper documentation, disaster recovery, security measures, usability, user education, or policies will not improve security.
Penalizing your IT managers, directors, or CISO for best-effort failure when you have neglected to read their reports or work constructively on their requests does not improve security.
You can and should delegate to competent leaders and subject matter experts, but the buck stops with you.
