Chapter 1 of 12 · First meeting with a new CISO
Q1: What Could Stop This Company From Operating?
- What are the few cyber risks that could really hurt us?
- How do I know the CISO understands our business?
Start here. The answer tells you whether your CISO thinks about the business or only about the technology.
What you should hear
- Three to five risks, described in business terms: we could not take orders, we could not pay staff, we could leak the data our customers trust us with.
- Which systems and suppliers those depend on.
- Roughly how long the company could cope without each one.
Red flags in the answer
- A long list of technical threats with no link to what the business does.
- "Everything is critical." If everything is, nothing is.
- Industry headlines instead of risks specific to this company.
The question you might not ask out loud
Isn't it the CISO's job to worry about this, not mine?
The CISO manages the risk. The board oversees it and decides how much the company is willing to carry. You cannot do the second without understanding the first.
Follow-up
"Who in the business owns each of those risks, and have they agreed how much of it we are willing to accept?" A good answer names business leaders, not just the security team.
Why this matters: every later question builds on this one. Budget, supplier risk, recovery and reporting only make sense against a short list of the things the company cannot afford to lose. If the board and the CISO agree on that list, most other conversations get shorter and clearer.
Listen for how the CISO arrived at the list. A good answer mentions conversations with business leaders, not only security tools. If the CISO has not talked to the people who run sales, operations or finance, the list is probably a guess.
Rule of thumb:If the CISO's top risks would be the same at any company, they are not yet the top risks for yours.