Content
A Chief Information Security Officer (CISO) oversees a company’s information security. He or she develops the security strategy, coordinates its implementation, and makes security risks transparent to senior management. The goal is to adequately protect information and business processes and to maintain the ability to respond effectively in the event of security incidents.
The role combines technical expertise with risk management, leadership, and communication. Responsibilities and decision-making authority depend on the size of the company, the industry, the organizational structure, and regulatory requirements. ENISA’s European Competency Framework describes the CISO as a leadership role responsible for security strategy, security management, and communication with senior management. 1
Technical Status: October 30, 2026
What does a CISO do?
The CISO aligns information security with the company’s business objectives and risks. This process focuses on three fundamental security objectives:
- Confidentiality: Information is accessible only to authorized individuals and systems.
- Integrity: Information and systems are protected against unauthorized modification.
- Availability: Information, applications, and services are available as needed.
Information security encompasses digital data as well as paper documents, trade secrets, and the handling of information in business processes. Its scope may also include production facilities, connected products, and outsourced services.
Typical responsibilities of the CISO include:
- Development and refinement of the information security strategy.
- Management of an information security management system.
- Coordination of the assessment and management of security risks.
- Establishment of security policies and requirements.
- Planning for resources and security investments.
- Promoting an effective safety culture.
- Monitoring the implementation and effectiveness of measures.
- Reporting on risks, incidents, and necessary actions.
These tasks correspond to key elements of ENISA’s CISO role profile. 1
The CISO does not implement every measure personally. IT operations, development, business units, and security teams handle operational tasks according to their respective areas of responsibility. To this end, the company needs clearly defined responsibilities, decision-making authority, and escalation procedures.
What role does an information security management system play?
An Information Security Management System (ISMS) establishes the organizational framework for information security. It integrates policies, responsibilities, risk assessments, and protective measures with regular review and improvement.
One established framework is ISO/IEC 27001:2022. The standard describes requirements for the establishment, implementation, maintenance, and continuous improvement of an ISMS. Companies can use it without seeking certification. 2
The CISO often oversees the ongoing development of the ISMS and supports audits as well as the resolution of findings. In doing so, companies should clearly separate, from an organizational standpoint, the management of the security program from its independent audit. The CISO should not be designated as the sole independent auditor of his or her own area of responsibility.
What are the differences between a CISO, a CIO, and a data protection officer?
These functions work closely together but have different areas of focus. The following overview shows a typical distribution of responsibilities; the specific structure must be tailored to the company.
| Function | Typical focus |
|---|---|
| CISO | Information Security Strategy, Security Risks, and Management of the Security Program |
| CIO / IT Leadership | IT strategy, technology implementation, and the provision and operation of IT services |
| Data Protection Officer | Independent advice and oversight on data protection matters |
| Executive Management | Corporate Decisions, Resources, and Statutory Management Responsibilities |
| Business Units and Risk Officers | Risks and security requirements of their business processes, as well as assigned measures |
The roles of CIO and IT leadership are not the same in every organization. The CISO role can also be integrated in different ways. What matters most is having sufficient authority, access to senior management, and the ability to effectively escalate significant risks.
The duties of the data protection officer are set forth in particular in Articles 38 and 39 of the GDPR. The CISO does not replace this role. 3
What qualifications does a CISO need?
A CISO needs technical expertise, leadership skills, and an understanding of business. The following are particularly important:
- Information Security and Risk Management.
- Experience with security programs and organizational changes.
- Understanding of legal and contractual requirements.
- Budget planning, prioritization, and personnel management.
- Communication with technical teams, departments, and management.
- Ability to make decisions under time pressure.
A relevant degree or vocational training can provide a solid foundation. However, the specific job requirements should also take into account practical experience and proven leadership skills.
Certifications can provide additional proof of skills. Depending on the position, certifications such as CISSP, CISM, or CRISC may be relevant. CISM specifically addresses governance, risk management, the development and management of security programs, and incident management. 4
Additional technical qualifications can be helpful. However, they are no substitute for experience in managing a company-wide security program.
How does a CISO work together with the management?
The CISO analyzes security risks in a way that enables senior management to make informed decisions. He describes the potential impacts on operations, revenue, customers, contracts, and corporate goals.
For example, a meaningful report answers the following questions:
- Which business processes are particularly at risk?
- Which measures take priority?
- What resources are needed?
- What risks remain despite protective measures?
- What decisions must company management make?
Case Study: An outdated system supports a critical business process. The CISO works with IT and the business unit to assess the risk and presents options for action: additional protective measures, technical upgrades, or replacement. The appropriate decision-making body determines the budget, timeline, and how to address any remaining risks.
The appointment of a CISO does not relieve management of its legal obligations. For particularly important and important institutions, Section 38 of the BSIG requires management to implement and monitor the prescribed risk management measures and to conduct regular training sessions. 5
How does a CISO develop a security strategy?
An effective security strategy begins with the company’s business processes and risks. The selection of technologies is based on the defined objectives.
A structured approach consists of six steps:
- Understanding the Business Context: Identifying Critical Services, Information, Systems, and Dependencies.
- Assess the current situation: Examine existing protective measures, vulnerabilities, and organizational capabilities.
- Prioritizing risks: Assessing probabilities of occurrence and potential impacts.
- Define the target state: Define security objectives and required capabilities.
- Plan the implementation: Define actions, responsible parties, budget, and milestones.
- Evaluate effectiveness: Measure progress and adjust the strategy as circumstances change.
The NIST Cybersecurity Framework 2.0 provides guidance through the functions of Govern, Identify, Protect, Detect, Respond, and Recover. Comparing current and target profiles helps identify gaps and prioritize improvements. 6
Typical areas of focus include identity and access management, vulnerability management, monitoring, supplier security, secure development, and recoverability. The selection is based on risks and applicable requirements.
What are the relevant legal requirements?
The requirements depend, among other things, on the industry, company size, business activities, and the types of data processed. The CISO therefore works closely with the legal department, data protection, compliance, and business units.
| Regulatory Framework | Implications for the CISO’s Work |
|---|---|
| GDPR | Security of Personal Data and Cooperation in Handling Data Breaches |
| BSIG / German NIS 2 Implementation | For covered entities, this includes, among other things, risk management, registration, reporting, and management responsibility |
| DORA | Digital Operational Resilience for Financial Institutions in the Scope of Application |
| Additional Industry and Contract Requirements | Additional safety, documentation, or reporting requirements |
The German NIS 2 Implementation Act has been in effect since December 6, 2025. 7 Section 30 of the BSIG covers, among other things, incident response, business continuity, supply chain security, vulnerability management, and the assessment of the effectiveness of protective measures. 8
DORA has been in effect since January 17, 2025. For affected financial institutions, the regulation serves as a key framework for managing ICT risks. 9
It cannot be inferred from this that there is a blanket, cross-industry requirement to establish a position with the title of CISO. Companies must review the applicable organizational requirements and establish appropriate responsibilities.
What responsibilities does the CISO have regarding data protection?
The CISO supports the protection of personal data through technical and organizational security measures. These include, for example, access control, encryption, logging, and secure recovery.
Responsibility for data protection lies with the controller as defined by the GDPR. The data protection officer provides independent advice and oversight. Legal assessments, retention periods, and data subject rights must be organized in accordance with organizational responsibilities. The CISO is particularly involved in security matters and technical implementation. Among others, Articles 24, 32, 38, and 39 of the GDPR are relevant. 3
Any merger of the CISO and data protection officer roles must be reviewed for potential conflicts of interest. A situation in which the same person would have to independently monitor their own decisions is particularly problematic. 10
International regulations must also be taken into account where applicable. HIPAA, for example, applies to certain entities in the U.S. healthcare sector and their business partners. The regulations do not generally apply to every company that processes health data. 11
How does a CISO respond to a security incident?
The CISO coordinates the security function within the established incident and crisis management structure. Technical investigations, business decisions, legal assessments, and communication must be integrated.
A well-planned approach includes:
- Detection, Assessment, and Escalation.
- Mobilizing the relevant teams.
- Preservation and securing of relevant evidence.
- Investigation and elimination of the cause.
- Assessment of statutory and contractual reporting requirements.
- Controlled restoration and subsequent monitoring.
- Evaluation and improvement of protective measures.
Restoring data from backups alone is not enough. It is also necessary to verify whether attackers still have access and whether the cause of the compromise has been resolved.
NIST SP 800-61 Revision 3, dated April 2025, integrates incident response into the overall cyber risk management framework. Preparation and continuous improvement complement the immediate response. 12
Different triggers and deadlines apply to reports:
| Legal Framework | Key Reporting Requirements |
|---|---|
| GDPR, Art. 33 | The person responsible must report the incident immediately and, if possible, within 72 hours of becoming aware of it. Reporting to the supervisory authority is not required if there is likely to be no risk to the rights and freedoms of natural persons. |
| BSIG, Section 32 | In the event of significant security incidents at registered facilities, an initial report must generally be submitted promptly, no later than 24 hours after the incident; a follow-up report must be submitted promptly, no later than 72 hours after the initial report; and a final report must be submitted no later than one month after the follow-up report. |
For incidents that are still ongoing, the BSIG requires a progress report instead of the final report that would otherwise be due at this time. Other industry-specific obligations must be reviewed separately. 3 13
What are the biggest challenges for a CISO?
The challenges vary from company to company. Limited resources, legacy technical issues, unclear responsibilities, and dependence on service providers are often key factors.
Security measures can be burdensome and disrupt operations. The CISO must ensure transparency regarding benefits, costs, and risks. For covered entities, Section 30 of the BSIG also requires appropriate, proportionate, and effective measures. 8
An effective safety culture goes beyond training. Employees need clear rules, practical work procedures, and simple reporting channels. Managers should support safety requirements and foster a constructive approach to handling mistakes.
Appropriate metrics help with management. Examples include overdue critical actions, securing privileged access, and the results of recovery tests. Metrics should support specific decisions.
What trends are shaping the work of a CISO?
Cloud and Vendor Dependencies: Companies need to establish clear lines of responsibility between themselves and their service providers. Security requirements, access rights, documentation, and contingency planning should be addressed early on.
Ransomware attacks and data breaches: Tested backups facilitate recovery. In addition, companies must take into account the theft of sensitive information, the consequences of which cannot be mitigated by backups.
Zero Trust: Access is not implicitly trusted based solely on a user’s network location or device ownership. Authentication and authorization are based on the relevant security conditions. Zero Trust is an architectural approach, not a single product. 14
Artificial Intelligence: AI can support security efforts while also creating new risks through its use. CISOs should therefore oversee the secure implementation and use of AI applications. The NIST profile for generative AI supports the structured assessment of such risks. 15
Governance and Resilience: The CISO role combines technical safeguards with clear responsibilities and transparent risk decisions. In addition to prevention, detection, response, and recovery are also part of a comprehensive security program. 6
Sources and Further Information
- ENISA: European Cybersecurity Skills Framework – Role Profiles, particularly the CISO role profile.
- ISO: ISO/IEC 27001:2022 – Information security management systems.
- European Union: General Data Protection Regulation—Regulation (EU) 2016/679, in particular Articles 24, 32, 33, 38, and 39.
- ISACA: CISM Exam Content Outline.
- BSIG: Section 38 – Duties of Management.
- NIST: The Cybersecurity Framework 2.0, 2024.
- Federal Government: Implementation of the NIS 2 Directive in Germany.
- BSIG: Section 30 – Risk Management Measures.
- European Banking Authority: DORA – Application and Information Registry.
- Brandenburg State Data Protection Commissioner: Data Protection Officers—Legal Requirements Under the GDPR, with a Focus on Conflicts of Interest.
- U.S. Department of Health and Human Services: HIPAA – Covered Entities and Business Associates.
- NIST: SP 800-61 Revision 3 – Incident Response Recommendations and Considerations for Cybersecurity Risk Management, 2025.
- BSIG: Section 32 – Reporting Requirements.
- NIST: SP 800-207 – Zero Trust Architecture, 2020.
- NIST: AI 600-1 – Generative Artificial Intelligence Profile, 2024.
Zurück zur Übersicht des Glossars