Corporate security teams want specialty cyber roles as regulatory pressure grows

Dive Brief:

Driven by pressures to meet regulatory compliance, a growing number of companies are expanding their teams with specialized security leaders, according to a November report by IANS and Artico Search.
Among the "Fortune-sized" companies with annual revenue of $6 billion or more, most security teams include more than 50 members. They also have dedicated teams that specialize in security operations, risk and compliance and product security. More than 2 in 5 of the CISOs in this group have a deputy CISO that is considered a successor.
When asked about their wish list for new hires, a growing number of CISOs are seeking to hire key delegated specialists, including deputy CISOs, chiefs of staff and business CISOs, to help interact with other parts of the company and manage regulatory compliance demands.

Dive Insight:

The role of the CISO has gained importance and visibility within companies as the threat of malicious attacks have grown in sophistication and exposed large organizations to business disruption, regulatory scrutiny, litigation and direct financial impacts.

“CISOs are becoming kind of the go-to person to manage many areas of digital risk, or to at least lead those conversations in the business.” Nick Kakolowski, senior research director at IANS, told Cybersecurity Dive. “And, so their responsibilities across various functions are increasing.”

CISOs are now responsible for reporting cyber risk to the C-suite and, increasingly, have regular interactions with the board of directors. They are required to disclose major incidents and ransom payments to federal and some state regulators.

An October report from Trellix showed 4 in 5 global CISOs wanted the role to be split in half, with a business CISO dedicated to dealing with the growing demands for incident reporting.

Federal officials are working to streamline the growing demands for compliance, and plan to make an effort to reduce the number of redundant requests from federal agencies so that a single incident can be shared with various agencies.