The Cybersecurity Manager's Guide

Chapter 5. Step 2: Ensure Alignment

The preceding chapter focused on the importance of establishing and maintaining good working relationships—step 1. This chapter discusses the need to listen and learn from those relationships in order to design the InfoSec program the company wants. You can’t build a program misaligned with the values of the many people who will be your partners in securing the company’s information assets. So, as you initiate and build those relationships, start to get a feel for the company’s culture and attitudes toward InfoSec. Establishing this alignment is step 2.

What I Mean by Alignment

Put simply, alignment means being the security person your company wants you to be. Not the security person you think you should be or the security person you were at your last company. Alignment means operating in step with the company’s values and beliefs toward InfoSec and being comfortable doing so.

To get aligned, you’ll have to get a read on the company’s culture as well as its appetite for risk and information loss. This is where those relationships come in handy. If you get this information from your colleagues, you’ll have what you need to adjust your approach to InfoSec. This takes time and requires you to exercise some emotional quotient, or emotional intelligence, and finesse in dealing with others. Failure to align is often at the root of why CISOs get fired.

I’ve also seen many CISOs who know very little about InfoSec, but who are able to align with the ...