The CISO in practice

Almost every organisation now has a CISO, but what that person is allowed, required and able to do varies widely. Since the Dutch Cybersecurity Act (Cyberbeveiligingswet) and the Belgian NIS2 Act, cybersecurity is also explicitly a responsibility of the board. The CISO in Practice shows how a CISO turns that responsibility into something that can actually be carried out.

The book first covers the role, the core tasks and the skills required. It then turns to governance: what the board may expect, the best position within the organisation, the mandate, building a team, tasks that do not belong with the CISO, and a salary indication for the Netherlands and Belgium. It also addresses the relationships with the CIO, CFO, DPO, audit and the business, as well as common mistakes and how to become a partner rather than a roadblock.

Each chapter ends with a workbook section containing reflection questions, checklists, exercises and templates. The toolkit includes a CISO charter, a board agreement, a KPI/KRI dashboard and four 90-day plans.

For board members, supervisors and (aspiring) CISOs who want to make security genuinely governable.