Chief Information Security Officer (CISO)
A chief information security officer (CISO) manages and implements an organization-wide information security program. The CISO carries out the chief information officer's security responsibilities and acts as the main liaison to authorizing officials, system owners, common control providers, and system security officers. ISACA describes the CISO as an executive-level position responsible for the strategy, operations, and budget for protecting an enterprise's information assets.
Related job titles
- Senior agency information security officer (SAISO)
- Senior information security officer
What They Do
11 tasks- Manage and implement an organization-wide information security program.
- Periodically assess the risk and magnitude of harm that could result from unauthorized access, use, disclosure, disruption, modification, or destruction of information and systems.
- Develop and maintain risk-based, cost-effective information security policies, procedures, and control techniques that apply throughout the life cycle of each system.
- Make sure all personnel, including contractors, receive security awareness training, and train and oversee staff with significant security responsibilities.
- Periodically test and evaluate the effectiveness of security policies, procedures, and practices.
- Establish and maintain a process for planning, carrying out, evaluating, and documenting remedial action for deficiencies in security policies, procedures, and practices.
- Develop and implement procedures for detecting, reporting, and responding to security incidents.
- Make sure plans and procedures for continuity of operations are prepared and maintained for information systems.
- Coordinate the development, review, and acceptance of system security plans with system owners, system security officers, and the authorizing official.
- Coordinate the identification, implementation, and assessment of common security controls.
- Support the chief information officer in annual reporting to the head of the organization on the effectiveness of the information security program.
Knowledge and Skills
- Information security governance
- Security activities within the system development life cycle
- Security awareness and training programs
- Capital planning and investment control for security
- Information security performance measures
- IT contingency planning and continuity of operations
- Risk management
- Incident response
- Configuration management
How to Become a Chief Information Security Officer (CISO)
NIST describes the person in this role as having the professional qualifications, including training and experience, required to administer security program functions, with security duties as a primary responsibility. Under FISMA, as summarized by NIST, the chief information officer designates the senior agency information security officer.
In U.S. federal agencies, the senior agency information security officer role is an inherent government function assigned to government personnel only. NIST notes that organizations subordinate to federal agencies may use the title chief information security officer for positions with similar responsibilities.
ISACA's career page for the CISO role lists cybersecurity, information systems, emerging technologies, auditing, and risk management among the top technical skills employers request, based on market employment data. ISC2 lists chief information security officer among the positions for which its CISSP certification is ideal, and the CISSP requires five years of work experience.
Certifications
3 certificationsThese are certifications that the sources on this page name for the role, as described in the FAQ.
Frequently Asked Questions
What does a chief information security officer do?→
A CISO manages and implements an organization-wide information security program. The work includes periodic risk assessments, risk-based security policies and procedures, security awareness training for all personnel, testing how well security practices work, remedial action for deficiencies, and procedures for detecting, reporting, and responding to security incidents.
Is a CISO the same as a senior agency information security officer?→
NIST uses the title senior agency information security officer (SAISO) for the official who carries out the chief information officer's security responsibilities under FISMA. NIST states that organizations may also refer to this official as the senior information security officer or chief information security officer, and that in some organizations the role is known as the CISO.
Who does a CISO work with?→
In NIST guidance, the CISO carries out the chief information officer's security responsibilities and acts as the chief information officer's primary liaison to authorizing officials, system owners, common control providers, and system security officers. The CISO also coordinates with the senior agency official for privacy so that the privacy and information security programs work together, and may act as the authorizing official designated representative or as a security control assessor.
What qualifications does a CISO need?→
NIST describes the role as held by a person with the professional qualifications, including training and experience, required to administer security program functions. That person heads an office with the mission and resources to assist the organization in achieving secure information and systems. ISACA describes the CISO as an executive-level position.
What certifications does a CISO need?→
Certification issuers point to their own credentials for the role. ISACA's career page for the CISO role lists its CISM and CRISC certifications, and ISC2 lists chief information security officer among the positions for which the CISSP is ideal.
What is the difference between a CISO and an information system security officer?→
NIST SP 800-100 lists CISOs and security managers as separate members of the information security management team. The CISO heads an office responsible for the organization's information security program. An information system security officer, by contrast, is assigned by the CISO, an authorizing official, a management official, or the system owner to maintain the operational security posture of a single information system or program.
Sources
- NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations
- NIST SP 800-12 Rev. 1: An Introduction to Information Security
- NIST SP 800-100: Information Security Handbook, A Guide for Managers
- NIST CSRC Glossary: Chief information security officer
- ISACA Career Journey: Chief Information Security Officer
- ISC2: CISSP certification
Role descriptions follow the sources listed above: U.S. government workforce data first, then standards bodies and, where named in the text, certification issuers. This site is not affiliated with CISA, the Department of Labor, or the Department of Defense. Last verified Oct 28, 2026.