Upcoming Event:
IBM Security at Interconnect 2015: 4 Day Conference in Las Vegas
February 22
Event Starts In:
21 DAYS, 1 HR, 15 MINS

17 Questions Business Leaders Should Ask Their CISO

When I or my team members meet with CISOs, sometimes we need a simple set of questions to assess how they’re doing in security. I worked with a bunch of our experts here to get to a core group, and thought I’d share.

Ones that get the CISO really to think: am I secure? We organized these along the dimensions of People, Data, Applications and Infrastructure. Why? Cause if you think about People, the Data they Access, the Applications they use and the Gear they’re on (Infrastructure) then you have a decently holistic view of their security posture.

Key Questions To Ask Your Chief Security Officer

So here are some key questions I’ve been asking our customers to assess where they stand, they’ve gone over very well!


1.To what extent have you rolled out an identity program?2. How do you know what authorized users are doing?

3.What is your plan to automate identity and  role-based management?

Cross Domain


1.What is your plan to assess your security risks?



2.How do you detect threats and report compliance across domains?



3.Do you have a log retention and audit capability?



4.Which processes do you use to handle incident response and disaster recovery?



5.How do you involve key internal and external stakeholders in security matters?



1.In what ways have you classified and encrypted sensitive data?2.How do you know if sensitive data leaves your network?

3.How do you monitor (privileged) access to data?


1.How secure is your application development process?2.How do you regularly test your website for vulnerabilities?

3.What is your approach to test legacy applications for potential exposures?


1.How do you promptly patch connected devices?2.In what ways do you monitor in- and out-bound network traffic?

3.How are you building security into new initiatives (such as cloud, mobile and the like)?

What do you think? Are there any key questions missing?

Topics: , , , , , , ,

Related Content

Ed Gelbstein
Ed Gelbstein

A fairly comprehensive list that risks the executives not understanding the answers. I would add a section on End User Awareness - assuming the CISO is the best qualified organisational entity to do so and Policies - how do you ensure these are complied with. Contrarian view: the CISO cannot be expected to classify the data (Data Question 1) as this should be done by the (business) data owner, regardless of the scope of accountabilities of the CISO. As for Data Questiion 2, the data does not need to leave the network electronically. Employees with appropriate authorisations do download and leaked sensitive data - many examples, Wikileaks being the most notorious.