CISO 2.0 Program

CISO 2.0 Course Modules

Module 1: The CISO and the Security Organisation

1.1 Security Organisation Design
– Security Organisation design approaches
– Major issues: When you get it wrong…
– Security Operating Model: The DNA of your organisation
– Security Capabilities in the Operating Model
– Security Governance Models
– Discussion: Governance models flaws
– CISO: Inside or outside of IT?
– Aligning the security team with overall business objectives
– Business alignment exercise: Aligning security with business strategies and value-based operating models

1.2. CISO Role, Interfaces and Stakeholders
– CISO Roles: Leader, Strategist, Change Manager, Expert
– Discussion: CISO role, position and mandate
– Major challenges resulting from a lack of executive support and stakeholder alignment
– CISO interfaces and interactions
– Stakeholder analysis based on stakeholder’s influence, involvement in cyber security, approach to cyber and relationships with other stakeholders
– Creating a stakeholder analysis model and goals table. Set the stage for your stakeholder influencing strategy

1.3. CISO Maturity in Leadership
– CISO Leadership in context of the organisation’s risk appetite and maturity
– CIRO Model & NIST
– CIRO Model Components:
1. Different organisation types based on their Risk Appetite and Maturity
2. The Cyber Security Function per maturity level
3. Cultural impact: Challenging, defining and shaping organisational culture
4. Nature of internal relationships, styles of interaction and the CISO’s level of influence
5. CISO Leadership competencies & growth opportunities
– Personal CISO Leadership Assessment

Exercises:

• Aligning security with business strategies and value-driven operating models
• Security Governance Models: How to identify and fix major pitfalls
• CISO Interfaces: Setting the stage for your stakeholder influencing strategy
• CISO Maturity in Leadership: Identify your leadership style and opportunities to grow

Module 2: CISO Leadership

2.1. CISO Leadership Theories
– Trait Theories​
– Behavioural theories​
– Contingency theories​
– Power and influence theories
– Ethical leadership
– Transformational leadership
– Agile leadership

2.2. Personal competencies and leadership, KYS
– Know Yourself
– Leadership assessment
– Authenticity, trust and integrity
– Courage
– Storytelling

2.3. CISO interfaces
– Important CISO interfaces
– Driving change building successful teams
– Driving change through building successful relationships with CISO interfaces
– Stakeholder models and influencing strategies

Exercises:

• Know yourself
• Find your own voice
• Leadership assessment and personal development plan
• Stakeholder models and influencing strategies

Module 3: Govern, Align and Organise Security

3.1. Business-aligned security
– Introduction to business value and business strategy
– Business value strategies
– Business-aligned IT and security
– Alignment with IT maturity and existing IT governance

3.2. Effective risk management
– Understand countervailing powers in an organisation
– Deep dive into effective risk management processes and risk mitigation

3.3. Security in an agile organisation
– Introduction to the agile way of working
– Agile manifesto
– Lead by example: Agile security teams
– Security impact of the agile way of working

Exercises:

• Business strategy, IT and security strategy and key governance processes
• Countervailing powers (group discussion)
• Risk mitigation and risk acceptance
• Security impact of the agile way of working

Module 4: Information Security and Risk Management Strategy

4.1. Cybersecurity as organisational change
Use organisational change management tactics to implement an information security and risk management strategy

4.2. Tactics for creating urgency
Know the why
Never waste a good crisis
SWOT 2.0 applied to organisation-stakeholder relationship

4.3. Tactics for identifying and tackling roadblocks
Identifying roadblocks
Tackling roadblocks
– Sources of influence
– CISO addressing friction?
– Personal circles of influence

4.4. Tactics for short-term goals and achievable steps
Articulate your management plan
– Using cyber security maturity models
– Classic Fit-Gap Analysis of a standard
– Communication and KPIs: What is your dashboard?
Breaking the whole down into achievable steps
– Leveraging agile and LEAN methods for cyber security projects and processes
– Leverage your professionals
– Management by objectives / goal setting theory
Balancing incidents and structural change for organisational impact

4.5. Tactics for keeping up the momentum
Organisational learning cq learning maturity
Using the 3 Lines of Defense
Integrate different work styles for a unified view of cybersecurity via a control framework

Module 5: Managing Security in Operations

5.1. Security Operations vs. Security in Operations (part 1)
– SIEM, SOC, SOAR
– SECOPS & IT
– InfoSec in Business Ops
– InfoSec in IoT
– InfosSec in industrial environments (ISO62443)

5.2. Security Operations vs. Security in Operations (part 2)
– Challenges of InfoSec (Multi-locations, cloud, etc.)
– 3 lines of Defense versus Dynamic Risk Governance
– Breakout rooms: Translate the models to your own organisation

Module 6: Security Finance

6.1. Finance for non-finance professionals (introduction)
– Public versus private organisations
– Run cost versus change costs
– Capex vs. Opex
– EBIT vs. EBITDA
– Financial Statement vs. P&L
– Financial Management & KPIs

6.2. Creating a financial plan
– Key Elements
– Common pitfalls
– Aligning stakeholder expectations
– Break-out rooms: Create a high-level financial plan to set up a SOC

Module 7: Reporting to the Board

7.1. What is on the Board’s mind?
Presenting Information Security:
– Sources of the report
– Ways of bringing information to the board
– When to report and to whom
– How to align reports with board expectations
– Who are your allies within the board?!

Module 8: Prepare for your assignment and certification exam

CISO 2.0 Certification Exam (Information Security Management Expert)

The CISO 2.0 (Information Security Management Expert) certification exam is conducted by the SECO-Institute, Europe’s leading security and continuity certification body. By passing the certification exam and earning a SECO-Information Security Management Expert (S-ISME) certificate, you demonstrate that you possess the top competencies of a successful information security leader.

Exam information

Assignment-based exam:
At the beginning of the program, you will receive a template for your final assignment (a strategy or business case to implement a change or innovation in your own organisation’s security). The goal of this assignment is to assess your ability to use the skills learnt in the CISO 2.0 Program to grow as a CISO and bring value to your organisation’s security governance or culture. During the course, you will complete smaller assignments before certain lectures and discuss the outcomes in class. These smaller assignments all contribute to your final assignment and can be integrated into your final assignment template as you complete them. We strongly advise you to define your ‘’problem to solve’’ for the final assignment as early as possible. This way, you can maximise the benefit of each smaller assignments. Equally important, completing the smaller assignments on time will reduce your workload at the end of the course.

Exam Process:
1. Define your ‘problem to solve’ for your final assignment early in the program
2. Participate actively in the training and complete all assignments before the given contact day
3. Integrate the theory and practices learnt into your final assignment
4. Submit your assignment to the evaluation board
5. Take the remote online proctored exam with questions related to your assignment
6. Claim your SECO Information Security Management Expert (S-ISME) Certification Title and Digital Badge
7. Add your work experience and get the highest certification: Claim your S-CISO Title and Digital Badge

What are the benefits of an S-ISME or S-CISO certificate?

An S-ISME certificate demonstrates that you possess the knowledge and skills necessary to develop security strategies, guide a security team, and exert influence at the board level. This achievement will give you the confidence to assume a senior information security management role and provide leadership for your organisation. The S-CISO title validates your CISO expertise and work experience.