CISO vs. CRO: What’s the Difference?

Another C has found its way into the lexicon of the C-suite: the chief risk officer (CRO).

Some may be scratching their heads and wondering why CROs are necessary. After all, isn’t risk already part of the domain responsibility of the chief executive officer (CEO), general counsel, chief security officer (CSO), chief information officer (CIO), chief information security officer (CISO) and chief operating officer (COO)?

The answer is yes; every member of the C-suite is responsible for their domain and for ensuring the remainder of the enterprise or company benefits from their decisions and counsel for collective risk management. Bringing the CRO — or the digital risk officer, as the role is sometimes referred to in the technology world — to the forefront allows risk management to be consolidated and uniform throughout the enterprise.

The Rise of the CRO

Gartner projects that one-third of large enterprises will have a digital risk officer by 2017 and that the role will broadly emerge in 2015. The role will require skills in business knowledge, communication, risk management, privacy and technology. This sounds eerily similar to what has been advocated for the CISO who wishes to secure his or her seat at the corporate strategy table. Make no mistake: The CISO who exhibits dexterity in identifying and mitigating cyber risks will continue to be a key piece of the CISO-CRO dance.

The CRO who has visibility across the enterprise or company — specifically into the domains of the general counsel, CEO, CIO, COO, etc. — ensures that risks are addressed in the broadest possible manner, with the business outcomes at the forefront. This allows the CISO’s team to address the local execution against the constant onslaught of the technological probes and attacks hitting the company’s infrastructure perimeter and evolving from within.

The role also allows for the natural evolution of a business-driven solution of information technology (IT) policies and procedures. Business ownership enforcement ensures the IT security department is not the “No Police” but rather a key part of the solution. This way, policy creation is a risk management solution, and no IT policy will stunt the company’s business processes. Should a risk be identified as both open and with no immediate migration solution, the CRO with a broader perspective can advise as to the course of action to be taken.

CISO at the Corporate Strategy Table

The CISO’s place at the corporate strategy table is not a risk. The CISO will be at the right hand, if not attached to the hip, of the CRO.

The CISO’s cyber incident response team (CIRT) will be a critical component as well. The CIRT will be able to move beyond the infamous “whack-a-mole” technique and engage in both incident response and education.

With education and overall boosted awareness, the individual user and his or her principals — those in the various roles within the C-suite) — will recognize the evolution from “No, don’t do that,” to, “This is how we should do that, and for these reasons.”

Download the IBM Report: Cybersecurity perspectives from the boardroom and C-suite

Share this Article:
Christopher Burgess

CEO at Prevendra

Christopher Burgess is the CEO of Prevendra, a security, privacy and intelligence company. He is also an author, speaker and advocate for effective security strategies, be they for your company, home or family. Christopher co-authored "Secrets Stolen, Fortunes Lost: Preventing Intellectual Property Theft and Economic Espionage in the 21st Century" (Syngress, March 2008) and authored the e-book, "Senior Online Safety" (Prevendra, March 2014) and is the voice behind the website, "Senior Online Safety." Prior to the founding of Prevendra, Christopher held a variety of private and public sector positions, which included, chief operating office and chief security officer of a big data analytic company, Atigeo; Senior Security Advisor to the CSO of Cisco, a Fortune 100, and 30+ years within the Central Intelligence Agency. The CIA awarded him the Distinguished Career Intelligence Medal upon his retirement. Christopher resides in Woodinville, WA with his family, two dogs and two horses.