The CISO reporting structure is broken

How can a cybersecurity leader secure government assets against adversaries when they aren't afforded the authority to act in their agency's best interest?

This question is increasingly important in today's environment. In a recent report by the Government Accountability Office, five out of 12 federal agencies said they faced "an increase in certain types of cyberattacks" when working remotely. Supporting a remote workforce is here to stay. To protect against the increasingly hostile threat landscape, it's up to agency leaders to look for opportunities to gain operational security efficiencies and organizational improvement.

The CISO reporting structure varies slightly across agencies. Under the Federal Information Security Management Act (FISMA), information security functions, including cybersecurity, are the responsibility of the agency CIO. The CIO reports directly to the chief operating officer (COO) – or the equivalent – who reports to the agency head.

Information security responsibilities are then delegated to the Chief Information Security Officer (CISO), which means the CIO has ultimate responsibility for both IT and security functions. This becomes overwhelming and unsustainable.

Almost all cybersecurity priorities are driven by federal requirements and mandates. Executive orders, Office of Management and Budget mandates, and Cybersecurity and Infrastructure Security Agency directives are just some examples. The commitment to managing cyber risk is a primary concern, but is often consolidated with IT priorities. This creates a conflict – does IT or security come out on top?

Some agencies have developed a good, healthy balance between IT operations and security operations teams. "Healthy" in this case means those agencies are more efficient when standing up new services, embracing new modernization activities, or responding to advanced threats. But at most agencies, the relationship between IT and security is unhealthy which means accomplishing anything becomes a complex and challenging situation that cripples an agency from making progress.

When there is a cyber event or initiative, for example, the CIO will get input from the CISO and the IT organization's head. This is a problem. IT and security will always have different perspectives because they have different experience, background, and training. IT is not working off the same information so they will not fully understand cyber risk as a CISO would (cyber threat intel, vulnerability exposure, cyber risk, etc.). And, they certainly cannot be expected to have the same perspective on cyber vulnerabilities or risk management.

When dealing with a security issue, the CISO must be the leading voice. They must be considered a peer to the CIO and report directly to the agency head. This will limit conflict and improve the flow of information within agencies.

Identifying cyber challenges

Just 49% of security leaders reported that their security plans account for problems like ransomware, and only 25% stated they have guidance for a hacking incident. These weaknesses in the cybersecurity structure fall primarily on the shoulders of the CISO.

While the CISO is responsible for the agency's security program, they lack the authority and autonomy to implement a successful program and effectively manage risk. For example, CISOs must advise the C-suite on security protocols, such as zero trust infrastructure, which provides environment-agnostic protection and secures applications and services even if they communicate across network environments. Without this authority, strategic cybersecurity priorities become diminished or ineffective, resulting in more risk for the agency.

Attackers need only one path through agency cyber defenses to secure a foothold inside the perimeter. While the CISO is responsible for identifying vulnerabilities and configuration issues, a lack of authority or ability to effectively communicate risk to the business impacts the speed and effectiveness of a mitigating control or proposed resolution. Additionally, if the CISO recommends a system be taken offline to mitigate the potential risk, it could impact the business/mission so having a direct line to the business owner is critically important to ensure the risk is articulated and the COO can make an informed decision.

This puts the CIO in the middle. A CIO may not be willing to impact the business/mission by taking the system offline without COO involvement, leading to delays in mitigating unpatched vulnerabilities that could prove devastating down the road. Remember, it only takes one vulnerability, one misconfiguration, one foothold, or one pathway that, if unmitigated, can lead to a major breach. Speed and decisive action based on risk tolerance can be the determining factor on whether you become the next headline.

Looking ahead

Zero trust architecture helps agencies shrink their attack surface and reduce the likelihood that one foothold will turn into a major breach. While no security is perfect, and data breaches will never be eliminated, the path to better cybersecurity posture is becoming more clear. It's time for agencies to address the CISO reporting conflict once and for all.

Despite a recent flood of new cybersecurity legislation, funding, and improved security infrastructures like zero trust, the current reporting structure is one of the top cyber vulnerabilities in agencies today. Therefore, it's vital to ensure that agencies reap the benefits of effective collaboration and improved CISO authority to guarantee that the right security programs are prioritized to support critical agency objectives.

We have arrived at a place where cybersecurity risk means a risk to the agency and the potential impact to the mission. The CISO needs an unfiltered path to communicate and effectively manage and mitigate agency cyber risk. Agency heads have a legislative mandate to maintain and improve the security of their agency's information and information systems but we will continue to see slow progress until the CISO's authority is elevated.