What’s the logic behind companies hiring for BISO (Business Information Security Officer) roles instead of a CISO role. Is it because they don’t want to dilute power in the C-Suite, don’t prioritize security at the right level or is there some other reason?
I've actually seen the opposite. I've seen companies hire a BISO role for the express purpose of NOT defining a CISO role. For some large companies there are BISO's who report to CISO's and I do agree it makes sense to have someone security minded represent a particular business unit, but for the companies that don't have an existing CISO, I'm not sure of the logic for creating a BISO role instead of a CISO role. It seems to me a way of avoiding creating a C-Level role and/or possibly bringing someone in at a lower level to satisfy the function. Coming back to my post, this seems like security may not be prioritized at the right level and/or the company doesn't want to give up power in the C-Suite.
I absolutely agree with @Bob, good practitioner always transcends their title, not only for this case.
The role from our business partners perspective should be focused on how we can meet their needs rather than why we can’t help them achieve their goals.
In either way there is a change! if a CISO already exists with the the old domains of expertise a BISO may be needed to strengthen the overall security road map, desperately needed. If a CISO doesn’t exist but there is a CIO (small company) I would recommend to acquire the operational expertise reporting to the CIO.
I some cases there is a maturity factor to take into account, being aware of the speed of change in the digital/tech transformation and to safe guard ANY information security. The company should be aware and be responsive to this security need and hopefully there should not be an issue of power as the focus should be the health of the company. That’s my humble opinion and logic.
From what we've seen the motivation for hiring one or more BISO roles is based on subject matter expertise and from a specific jurisdiction (geo) or business domain.
It's largely to complement the CISO role with needed expertise (law, regulatory) and focussed on "content and context" and the need to secure data which may or may not be owned by the company.
We often forget "who owns the data?" is still a question for many organizations.
The BISO may address the what, why and when questions and the CISO develops the How. In tandem both reduce risk and potential liabilities upstream and downstream.
However, without assigning data ownership, confusion occurs and accountability is blurred. This is an area where where organizations can improve their data governance and follow a well defined data life cycle process.
Content you might like
MBA / Master's Degree73%
CISSP / Comparable Certification26%
How does that differ from a CISO?
From what I've seen the BISO is more dirty hands and still has the technical knowledge to get in there, where CISOs are more along the executive team route and deal more as an ambassador to the business.