When I or my team members meet with CISOs, sometimes we need a simple set of questions to assess how they’re doing in security. I worked with a bunch of our experts here to get to a core group, and thought I’d share.

Ones that get the CISO really to think: am I secure? We organized these along the dimensions of People, Data, Applications and Infrastructure. Why? Cause if you think about People, the Data they Access, the Applications they use and the Gear they’re on (Infrastructure) then you have a decently holistic view of their security posture.

Key Questions To Ask Your Chief Security Officer

So here are some key questions I’ve been asking our customers to assess where they stand, they’ve gone over very well!


1.To what extent have you rolled out an identity program?

2. How do you know what authorized users are doing?

3.What is your plan to automate identity and  role-based management?

Cross Domain

1.What is your plan to assess your security risks?


2.How do you detect threats and report compliance across domains?


3.Do you have a log retention and audit capability?


4.Which processes do you use to handle incident response and disaster recovery?


5.How do you involve key internal and external stakeholders in security matters?



1.In what ways have you classified and encrypted sensitive data?

2.How do you know if sensitive data leaves your network?

3.How do you monitor (privileged) access to data?


1.How secure is your application development process?

2.How do you regularly test your website for vulnerabilities?

3.What is your approach to test legacy applications for potential exposures?


1.How do you promptly patch connected devices?

2.In what ways do you monitor in- and out-bound network traffic?

3.How are you building security into new initiatives (such as cloud, mobile and the like)?

Scroll to view full table

What do you think? Are there any key questions missing?

More from CISO

How to Solve the People Problem in Cybersecurity

You may think this article is going to discuss how users are one of the biggest challenges to cybersecurity. After all, employees are known to click on unverified links, download malicious files and neglect to change their passwords. And then there are those who use their personal devices for business purposes and put the network at risk. Yes, all those people can cause issues for cybersecurity. But the people who are usually blamed for cybersecurity issues wouldn’t have such an…

The Cyber Battle: Why We Need More Women to Win it

It is a well-known fact that the cybersecurity industry lacks people and is in need of more skilled cyber professionals every day. In 2022, the industry was short of more than 3 million people. This is in the context of workforce growth by almost half a million in 2021 year over year per recent research. Stemming from the lack of professionals, diversity — or as the UN says, “leaving nobody behind” — becomes difficult to realize. In 2021, women made…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

Detecting the Undetected: The Risk to Your Info

IBM’s Advanced Threat Detection and Response Team (ATDR) has seen an increase in the malware family known as information stealers in the wild over the past year. Info stealers are malware with the capability of scanning for and exfiltrating data and credentials from your device. When executed, they begin scanning for and copying various directories that usually contain some sort of sensitive information or credentials including web and login data from Chrome, Firefox, and Microsoft Edge. In other instances, they…