June 26, 2013 By Marc van Zadelhoff 2 min read

When I or my team members meet with CISOs, sometimes we need a simple set of questions to assess how they’re doing in security. I worked with a bunch of our experts here to get to a core group, and thought I’d share.

Ones that get the CISO really to think: am I secure? We organized these along the dimensions of People, Data, Applications and Infrastructure. Why? Cause if you think about People, the Data they Access, the Applications they use and the Gear they’re on (Infrastructure) then you have a decently holistic view of their security posture.

Key Questions To Ask Your Chief Security Officer

So here are some key questions I’ve been asking our customers to assess where they stand, they’ve gone over very well!


1.To what extent have you rolled out an identity program?

2. How do you know what authorized users are doing?

3.What is your plan to automate identity and  role-based management?

Cross Domain

1.What is your plan to assess your security risks?


2.How do you detect threats and report compliance across domains?


3.Do you have a log retention and audit capability?


4.Which processes do you use to handle incident response and disaster recovery?


5.How do you involve key internal and external stakeholders in security matters?



1.In what ways have you classified and encrypted sensitive data?

2.How do you know if sensitive data leaves your network?

3.How do you monitor (privileged) access to data?


1.How secure is your application development process?

2.How do you regularly test your website for vulnerabilities?

3.What is your approach to test legacy applications for potential exposures?


1.How do you promptly patch connected devices?

2.In what ways do you monitor in- and out-bound network traffic?

3.How are you building security into new initiatives (such as cloud, mobile and the like)?

Scroll to view full table

What do you think? Are there any key questions missing?

More from CISO

Empowering cybersecurity leadership: Strategies for effective Board engagement

4 min read - With the increased regulation surrounding cyberattacks, more and more executives are seeing these attacks for what they are - serious threats to business operations, profitability and business survivability. But what about the Board of Directors? Are they getting all the information they need? Are they aware of your organization’s cybersecurity initiatives? Do they understand why those initiatives matter? Maybe not. According to Harvard Business Review, only 47% of board members regularly engage with their CISO. There appears to be a…

The evolution of 20 years of cybersecurity awareness

3 min read - Since 2004, the White House and Congress have designated October National Cybersecurity Awareness Month. This year marks the 20th anniversary of this effort to raise awareness about the importance of cybersecurity and online safety. How have cybersecurity and malware evolved over the last two decades? What types of threat management tools surfaced and when? The Cybersecurity Awareness Month themes over the years give us a clue. 2004 - 2009: Inaugural year and beyond This early period emphasized general cybersecurity hygiene,…

C-suite weighs in on generative AI and security

3 min read - Generative AI (GenAI) is poised to deliver significant benefits to enterprises and their ability to readily respond to and effectively defend against cyber threats. But AI that is not itself secured may introduce a whole new set of threats to businesses. Today IBM’s Institute for Business Value published “The CEO's guide to generative AI: Cybersecurity," part of a larger series providing guidance for senior leaders planning to adopt generative AI models and tools. The materials highlight key considerations for CEOs…

Bringing threat intelligence and adversary insights to the forefront: X-Force Research Hub

3 min read - Today defenders are dealing with both a threat landscape that’s constantly changing and attacks that have stood the test of time. Innovation and best practices co-exist in the criminal world, and one mustn’t distract us from the other. IBM X-Force is continuously observing new attack vectors and novel malware in the wild, as adversaries seek to evade detection innovations. But we also know that tried and true tactics — from phishing and exploiting known vulnerabilities to using compromised credentials and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today