Agree or disagree: Business unit leaders typically oppose the SOC’s recommendations.

Strongly disagree2%

Agree61%

Neutral17%

Disagree15%

Strongly agree3%

347 PARTICIPANTS
3.4k viewscircle icon1 Upvotecircle icon2 Comments
Sort by:
CISO in Software2 years ago

It happens a lot, and frankly, it should. The SOC is an operational unit focused on tactical solutions to problems seen in aggregate. Most business unit leaders (running units other than security) will make decisions based on the impact to their unit, or their unit's production (as they should). Security leadership is responsible for understanding the SOC's findings and how they fit into the overall risk picture of supporting business goals, then translating that meaningfully to a business context and generating support for the changes that align. 

When tactical recommendations are made to strategic leaders (especially those that don't understand the jargon) they're often dismissed as irrelevant, right or wrong. 

Director of IT in Education3 years ago

In the past (5 to 10 years) I get a lot of pushback from the business when it comes to implement recommended security controls. However, when business leaders understand the risks and consequences of a security breach they tend to work with IT/security folks to implement recommendations and adjust business practices/processes.

Content you might like

Agiloft7%

Conga23%

DocuSign CLM (SpringCM)38%

Apttus6%

Ironclad4%

Coupa (Exari)4%

Other (discuss below)16%

View Results

Build27%

Buy53%

Too early to tell16%

What’s cybersecurity mesh architecture (CSMA)?2%

View Results
Agree or disagree: Business unit leaders typically oppose the SOC’s recommendations. | Gartner Peer Community