Many strong security practitioners never become CISOs because the job is judged on business, governance and leadership skills that technical careers rarely teach. The chief information security officer is accountable for an organisation's cyber risk to the executive team and the board, and in many jurisdictions now carries regulatory and personal exposure. This guide explains what the role does, the skills that separate CISO candidates from senior engineers, the common routes into the role, which certifications help and how to plan the progression. It is written for security managers, architects, GRC leads and engineers who want the role in the next five to ten years, and for leaders building a succession plan. For what to do once appointed, see the CISO Guide: First 90 Days.
Key takeaways
- The CISO role is a risk and leadership job, not the top technical job. Success is measured by decisions the board can take, not by tools deployed.
- Regulation has raised the stakes. US SEC rules require listed companies to describe management's role and expertise in managing material cyber risk, and the EU NIS2 Directive places cyber risk obligations on management bodies.
- There is no single route. CISOs arrive from security operations, architecture, GRC, audit, IT leadership and consulting; each route leaves predictable gaps to close deliberately.
- Certifications signal, they do not qualify. CISSP and CISM are the most common management-level credentials, with CGEIT and CRISC for governance and risk depth, but each requires years of verified experience first.
- Integrity is part of the job description. The criminal conviction of Uber's former chief security officer over the concealment of a 2016 breach shows that how a CISO handles an incident can matter more than the incident itself.
What the role does
NIST SP 800-53 Rev. 5 control PM-2 (Information Security Program Leadership Role) requires an organisation to appoint a senior official with the mission and resources to coordinate, develop, implement and maintain an organisation-wide information security programme. In most organisations that official is the CISO. NIST CSF 2.0 frames the same accountability in its Govern function: GV.RR-01 makes organisational leadership responsible and accountable for cybersecurity risk, and GV.RR-02 requires roles, responsibilities and authorities to be established, communicated and enforced.
| Responsibility | What it looks like in practice | Framework anchor |
|---|---|---|
| Strategy and risk appetite | A multi-year security strategy tied to business objectives; risk appetite proposed to and agreed by the board | CSF 2.0 GV.RM-01; SP 800-53 PM-9 |
| Policy and governance | Owning the policy framework, exceptions process and security governance forums | CSF 2.0 GV.PO-01 |
| Board and regulator reporting | Regular board reporting, input to annual report disclosures, regulator relationships | CSF 2.0 GV.OV-01 |
| Programme delivery | Budget, roadmap, team structure, suppliers and managed services | SP 800-53 PM-2 |
| Incident leadership | Executive decision-making in major incidents, working with legal on disclosure | CSF 2.0 Respond function |
| Workforce | Hiring, developing and retaining the security team | SP 800-53 PM-13; CSF 2.0 GV.RR-04 |
The regulatory context matters for anyone aiming at the role. The SEC's 2023 disclosure rules require US-listed registrants to describe, under Regulation S-K Item 106, management's role and expertise in assessing and managing material risks from cybersecurity threats and how the board oversees those risks, and to file a Form 8-K under Item 1.05 generally within four business days of determining that an incident is material. The rules do not name the CISO, but in practice the CISO's experience is often what is described. See the SEC Cybersecurity Disclosure Rules Guide, the NIS2 Directive Guide and the UK Cyber Governance Code of Practice Guide for the obligations in each jurisdiction.
Core skills and tools
Senior engineers already have technical depth. The gap to CISO is mostly in the other columns.
| Skill area | What good looks like | How to build it before the role |
|---|---|---|
| Risk management | Expresses threats as business impact and likelihood; runs a risk register people actually use | Own a risk assessment end to end; study ISO 31000 and ISO/IEC 27005 |
| Risk quantification | Puts ranges, not colours, on the top risks so they can be compared with other business risks | Quantify one scenario with finance; see the Cyber Risk Quantification Guide |
| Board communication | A one-page board paper that asks for a decision | Draft the board update for your current CISO; see the Board Cyber Risk Reporting Guide |
| Financial management | Builds a budget from the roadmap and defends it against alternatives | Own a cost centre or a major procurement; see the Security Budget and Investment Planning Guide |
| Regulation and assurance | Knows which laws, standards and contracts apply and how auditors test them | Lead an ISO/IEC 27001 surveillance audit or a regulator response |
| Crisis leadership | Calm, documented decisions with legal and communications in the room | Run executive tabletop exercises; see the Tabletop Exercise Guide |
| People leadership | Builds a team that works without the CISO in the room | Manage managers, not only individual contributors |
| Technical breadth | Enough across cloud, identity, AppSec and SOC to challenge specialists and spot weak answers | Rotate through areas you have not owned |
Identity and AI as board topics: boards increasingly ask about privileged access, non-human identities such as service accounts and API keys, and AI agents acting with delegated access. A CISO candidate who can explain these risks in business terms stands out. See the Board Briefing: NHI Risk.
Routes into the role
Each common route brings strengths and leaves gaps. Knowing yours tells you what to work on.
| Starting point | Strengths it brings | Typical gaps to close |
|---|---|---|
| Security operations and incident response | Threat realism, crisis experience | Budgeting, governance, board language |
| Security architecture and engineering | Technical judgement, design across the estate | Risk quantification, regulation, people leadership at scale |
| GRC and risk | Frameworks, policy, regulator relationships | Technical credibility with engineers, incident leadership |
| IT audit | Control testing, assurance, board audit committee exposure | Building and running a programme rather than assessing one |
| IT leadership (CIO office, infrastructure) | Budget, operations, executive relationships | Threat landscape depth, independence from IT delivery |
| Consulting and vCISO work | Breadth across many organisations, board exposure | Long-term ownership of a programme and its outcomes |
Organisation size changes the route. In a small or mid-sized organisation the first security hire may become CISO within a few years, often while staying hands-on. In large enterprises and regulated sectors the path usually runs through a deputy CISO or head of a security function, and boards look for prior experience of regulators and major incidents. A virtual or fractional CISO role is a legitimate way to gain board exposure; see the vCISO Guide. Related role guides include the Security Architect Career Guide and the GRC Analyst Career Guide.
Certifications that help
Facts below are from the certifying bodies' own pages as checked on 26 October 2026. Fees and requirements change, so confirm before you apply.
| Certification | Body | Why it helps a CISO candidate | Key facts |
|---|---|---|---|
| CISSP | ISC2 | Broad, widely requested management-level credential | ISC2 lists 5 years of required work experience; see the CISSP Certification Guide |
| CISM | ISACA | Built around running a security programme | Domains: Information Security Governance, Information Security Risk Management, Information Security Program, Incident Management; exam fee US$575 (members) or US$760 (non-members); see the CISM Certification Guide |
| CGEIT | ISACA | Enterprise IT governance and board-level framing | See the CGEIT Certification Guide |
| CRISC | ISACA | IT risk identification, assessment and response | See the CRISC Certification Guide |
| CCSP | ISC2 | Cloud depth for organisations that are mostly cloud | See the CCSP Certification Guide |
| IAPP AIGP | IAPP | AI governance as AI adoption reaches the board agenda | See the IAPP AIGP (AI Governance Professional) Guide |
Choose CISSP when you need breadth and recognition with hiring managers; choose CISM when you already have the technical credibility and need to evidence programme management. Many CISOs hold both. A business qualification (for example an MBA or a board director course) helps more with the financial and governance gaps than a further technical certificate, but no credential substitutes for having owned a budget, a risk register and a major incident.
Progression
A realistic plan treats the move as a multi-year programme with evidence at each stage.
- Map your gaps (month 1). Score yourself against the skills table above, ask your current CISO or a mentor to do the same, and agree the three largest gaps.
- Take on cross-functional ownership (year 1). Lead something that crosses security, IT, legal and finance: a regulatory programme, an ISO/IEC 27001 certification, a major supplier assessment.
- Get board and executive exposure (years 1 to 2). Write or co-present board updates, sit in risk committees, run an executive tabletop exercise.
- Manage managers and a budget (years 2 to 3). A head of function or deputy CISO role is the usual proving ground.
- Close credential gaps in parallel. Add CISSP or CISM once you meet the experience requirement, then a governance or business qualification if your route left that gap.
- Test the market. A smaller organisation's CISO role, an interim role or vCISO work can be the first step; review after 12 months whether to stay, scale up or return to a deputy role in a larger organisation.
How to tell the plan is working: track the number of board or executive committee papers you authored, budget value you own, regulators or auditors you have handled directly, major incidents where you held a decision-making role, and direct reports who are themselves managers.
Lessons from incidents
The Uber 2016 breach is the case every aspiring CISO should study. According to the US Department of Justice, the attackers' demand reached Uber's then chief security officer, Joe Sullivan, on 14 November 2016. Uber paid the attackers US$100,000 through the third party that ran its bug bounty programme, under non-disclosure agreements that prosecutors said falsely stated no data had been taken, and the breach was not disclosed until 21 November 2017. On 5 October 2022 a federal jury convicted Sullivan of obstructing FTC proceedings and misprision of a felony. The lesson is not technical: major incident decisions must be made with legal counsel, documented and escalated to the executive and board, never managed quietly inside the security function. See the CISO Personal Liability Guide.
Practitioner checklist
- Read the CISO job descriptions of three organisations you would want to join and list the common requirements.
- Score yourself against the core skills table and agree a gap plan with a mentor.
- Own one cross-functional programme involving legal, finance and IT within the next year.
- Author or co-present at least one board or risk committee paper.
- Build and defend a budget, even a small one, before you apply.
- Run or take part in an executive tabletop exercise with legal and communications present.
- Add CISSP or CISM once you meet the experience requirement, checked on the certifying body's site.
- Learn the disclosure rules that apply to your organisation (SEC, NIS2, sector regulators) and who decides materiality.
- Agree in writing, before you accept a CISO role, your mandate, reporting line, incident authority and indemnity cover.
Standards and references
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls (PM-2, PM-9, PM-13)
- NIST: Cybersecurity Framework 2.0
- US SEC: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure fact sheet
- EUR-Lex: Directive (EU) 2022/2555 (NIS 2 Directive)
- ISC2: CISSP
- ISACA: CISM
Related NHI Mgmt Group resources: CISO Guide: First 90 Days · Cybersecurity Careers Guide · Cybersecurity Certifications Guide · vCISO Guide · Board Cyber Risk Reporting Guide