Business information security officers (BISOs) work closely with the central information security team, but they have very different roles within an organization. BISOs act primarily as liaisons between the central information security program (which is owned by the CISO) and the business, helping the business understand and implement security policies and processes while also helping translate business priorities to the main
information security team. This piece provides a detailed overview of the BISO role and explains how it works to improve both business and security outcomes.
What is a BISO?
The BISO is an emerging role that acts as a liaison between an organization’s business units and its cybersecurity function. BISOs must become familiar with the businesses they support and understand the overall business’s strategic roadmap.
They then align those with the cybersecurity function’s priorities and initiatives, advancing the information security posture across the organization and, essentially, filling the gap between business operations and cybersecurity program management.
The BISO’s responsibilities extend across a variety of tasks and include supporting core security functions with the following:
- Risk management: This includes risk identification, risk acceptance, solution development and risk mitigation implementation support.
- Education: This includes educating business and functional leaders on operationalization of policies, standards and baselines.
- Collaboration: This includes collaborating on key security tasks, such as incident management, threat modeling, vulnerability management, third party assessments, etc.
Successful BISOs typically possess:
- Executive presence, and the ability to foster relationship management, negotiate and influence.
- Effective communications skills, including both written and verbal communication skills, and the ability to translate security principles into business terms.
- Foundational technical expertise, including both business acumen and strategic thinking, as well as the ability to identify issues and provide innovative problem solving.
Examples of BISO Projects
Examples of projects that effective BISOs often participate in:
- Improving asset management and reducing technical debt.
- Monitoring security incident trends to identify opportunities for incident reduction and defend against emerging issues.
- Leveraging threat intelligence to develop initiatives and targeted security awareness programming for functional and operational teams.
- Injecting security into DevOps/engineering processes to drive security by design.
- Supporting business leaders with completing security requirements for onboarding of new vendors or developing new technologies, including third-party assessment, privacy reviews, security assessments, vulnerability remediation, etc.
- Collaborating with privacy, compliance and audit on various support requests and engagements.
Additionally, the BISO is the first point of contact for escalation of issues, whether from the business to cybersecurity, or the opposite. Once issues are received, the BISO should gather pertinent information and triage appropriately. The level of involvement
of the BISO will vary depending on the issue escalated, however, they should facilitate exchanges with key personnel and track progress through completion.
GET STARTED: BISO Compensation & Career Survey
BISO Role in the Security Function
Information security programs are owned by the organization’s CISO. BISOs are responsible for ensuring the vision of the CISO is executed across the organization through their individual portfolios. Through relationship management, influence, and
negotiation, the BISO role is more of a facilitator who supports both the core security function and helps business units improve the cybersecurity program’s maturity by encouraging collaboration, ensuring relevance and driving results.
READ: Guidelines for the BISO Role
BISOs: Connecting Security & the Business
If effectively empowered and aligned, BISOs serve as “mini CISOs” to the organizations within their portfolio. The BISO is one of the few roles that supports the priorities of both the business and the information security function, ensuring
relevance, driving collaboration and enhancing program maturity.
Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our blog posts, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by individuals or firms in connection with such information, opinions, or advice.
---
Nicole Dove is an award-winning information security leader with almost 20 years' experience driving results across cybersecurity, audit, global operations and relationship management functions. As Head of Security for Riot Games, she leads a team of BISOs focused on developing and deploying cybersecurity strategies that align with business priorities.