Cybersecurity is now a board-level risk with operational, regulatory, and financial consequences. Yet many organisations still position the CISO as if the job were mainly technical.
That is a category error.
A modern CISO exists to deliver three outcomes:
Truth: an unfiltered view of exposure and residual risk
Decisions: clear risk trade-offs and explicit risk acceptance
Resilience: proven ability to detect, contain, and recover
The hardest challenges are not tools. They are authority, alignment, and accountability across functions: IT, OT, procurement, suppliers, HR, legal, comms, and product teams.
The non-negotiable
If you want real risk governance, the CISO must be independent, with executive standing and a direct channel to the CEO and the Board (or Board risk committee).
Not for status. For integrity of decision-making.
What the Board should demand
Stop asking for dashboards. Ask for decisions:
What are the top 3 scenarios that can stop the business?
Where are we over risk appetite, and who owns it?
How fast can we detect, contain, recover, and what evidence proves it?
Which investments reduce impact fastest, with clear trade-offs?
If the board conversation does not end with owners and deadlines, it is reporting, not governance.
Provocation to close: In the next crisis, will your Board hear the truth early enough to steer, or only when there is no room left to choose?