17 Questions Business Leaders Should Ask Their CISO

When I or my team members meet with CISOs, sometimes we need a simple set of questions to assess how they’re doing in security. I worked with a bunch of our experts here to get to a core group, and thought I’d share.

Ones that get the CISO really to think: am I secure? We organized these along the dimensions of People, Data, Applications and Infrastructure. Why? Cause if you think about People, the Data they Access, the Applications they use and the Gear they’re on (Infrastructure) then you have a decently holistic view of their security posture.

Key Questions To Ask Your Chief Security Officer

So here are some key questions I’ve been asking our customers to assess where they stand, they’ve gone over very well!


1.To what extent have you rolled out an identity program?

2. How do you know what authorized users are doing?

3.What is your plan to automate identity and  role-based management?

Cross Domain

1.What is your plan to assess your security risks?


2.How do you detect threats and report compliance across domains?


3.Do you have a log retention and audit capability?


4.Which processes do you use to handle incident response and disaster recovery?


5.How do you involve key internal and external stakeholders in security matters?



1.In what ways have you classified and encrypted sensitive data?

2.How do you know if sensitive data leaves your network?

3.How do you monitor (privileged) access to data?


1.How secure is your application development process?

2.How do you regularly test your website for vulnerabilities?

3.What is your approach to test legacy applications for potential exposures?


1.How do you promptly patch connected devices?

2.In what ways do you monitor in- and out-bound network traffic?

3.How are you building security into new initiatives (such as cloud, mobile and the like)?

What do you think? Are there any key questions missing?

Share this Article:
Marc van Zadelhoff

General Manager, IBM Security

Marc van Zadelhoff is the General Manager for IBM Security, the fastest-growing enterprise security company in the world. Before taking over as head of the IBM Security business, a business he helped IBM architect several years ago, Marc was Vice President, Strategy, Marketing and Product Management for the division. In his leadership role, Marc continues to help clients around the world develop a security strategy and employ the best technologies to meet their specific security needs. He is responsible for leading the IBM Security team in the development and delivery of software and services offerings that protect enterprises with intelligent, integrated security solutions and expertise.