The CISO Evolution

CHAPTER 12Negotiation

Negotiation is not an act of battle; it's a process of discovery.

– Chris Voss

Opportunity

In my experience, all leaders expect to leave an imprint on the organizations they serve. Every attempt to change the status quo is a negotiation. The concepts we have described throughout the book equip you to understand, empathize, and communicate with your colleagues in their terms. This chapter covers the art of letting others have your way. Like Harry S. Truman, 33rd President of the United States, once said, “It is amazing what you can accomplish if you do not care who gets the credit.”

The average tenure of a CISO has been estimated at 18 to 26 months by various sources in recent years.¹ Indeed, some of the reason that CISO tenures are so short is that the role is one of influence, not control. Cynthia James estimates that CISOs only have control of 60% of what might get them fired.² I posit, therefore, you must be a trim tab. You must hold difficult conversations with uncertainty abound, and you must obtain results through others. Usually, all this happens without formal authority. You must build your circle of influence through moral authority so that people want to follow your leadership. You must be prepared to scale your impact by empowering others in your team to hold the same conversations successfully. Often requests from cybersecurity departments appear at odds with the primary goals of the business. After all, there are only so many hours in ...