The chief information security officer used to be judged on whether anything bad happened. That standard never made much sense, and in 2025 it no longer describes the job. The CISOs who are trusted by their boards today are the ones who can explain which risks the business is carrying, what it would cost to reduce them, and how quickly the organization would recover if the worst happened.

That is a leadership role, not a technical one with a bigger title. This article looks at the CISO as a business executive: the skills that separate an effective security leader from a capable security manager, how the regulatory and legal climate has raised the stakes, and what boards and CEOs should expect from the person in the seat. For the operational side, see our companion pieces on core best practices for CISOs and the top 10 CISO best practices checklist.

Why the job changed: accountability moved up the org chart

Three shifts pushed the CISO out of the server room and into the boardroom.

First, regulators started asking directors, not just IT, about cyber risk. The SEC’s cybersecurity disclosure rules, in force since December 2023, require public companies to disclose material incidents on Form 8-K within four business days of determining they are material, and to describe in their annual reports how the board oversees cybersecurity risk and what expertise management brings to it. In Europe, the NIS2 Directive places explicit responsibility for cybersecurity risk management on management bodies. NIST’s Cybersecurity Framework 2.0, released in February 2024, added a new “Govern” function to make the same point: security is a governance question first.

Second, CISOs themselves became personally exposed. In March 2025 the Ninth Circuit upheld the conviction of Uber’s former chief security officer, Joe Sullivan, for concealing a 2016 data breach from federal investigators. The SEC’s 2023 lawsuit against SolarWinds and its CISO, Tim Brown, was largely dismissed by a federal judge in July 2024, but the case put every security leader on notice that what they tell investors, and what they write in internal assessments, can be scrutinized in court.

Third, the business now runs on technology the CISO does not control: SaaS platforms, cloud providers, AI tools and a long tail of vendors. Security cannot be enforced by owning the network perimeter anymore. It has to be negotiated with the business units that buy and use those tools, which requires influence rather than authority.

The seven capabilities that separate great CISOs

Technical depth is still the entry ticket. What distinguishes the leaders who last is a broader set of capabilities:

• Strategic vision and business alignment. The security roadmap is built from the company’s growth plans and regulatory obligations, not from a vendor’s product categories. If the business is entering a new market, acquiring a company or launching an AI product, the CISO knows early and plans for it.
• Leadership and emotional intelligence. Security depends on people in finance, HR and engineering making good decisions when no one from security is in the room. That takes trust, which is built by listening, explaining and not treating every exception request as a threat.
• Technical acumen and continuous learning. Great CISOs stay close enough to AI, cloud and emerging cryptographic risks, such as the long transition to post-quantum algorithms, to make informed calls and to recognize when a vendor is overselling.
• Resilience and incident response. They plan on the assumption that something will get through, and measure success by how fast the business recovers, not by an unbroken record.
• Crisis and change management. During an incident, the CISO is often the calmest credible voice in the room. Outside incidents, they manage the organizational change that new controls require.
• Communication and stakeholder engagement. They translate technical risk into a business narrative a board can act on, and they tailor it: a CFO wants exposure in dollars, a general counsel wants disclosure obligations, a head of sales wants to know what customers are asking for.
• Business acumen and metrics. They connect security spending to outcomes the business already cares about: reduced downtime, faster customer security reviews, lower insurance premiums, and fewer audit findings.

Talking to the board: from activity to decisions

The most common failure in board reporting is presenting activity instead of risk. Directors do not need to know how many phishing emails were blocked last quarter. They need to know which scenarios could materially hurt the business, how likely those are, what is being done, and what decision is being asked of them.

A useful board update fits on a page or two and answers four questions:

1. What are our top risks, in business terms? For example: “A ransomware attack on our ERP would halt order fulfillment; our current recovery time is about five days.”
2. How has our exposure changed since last time? Show the trend in a few stable measures, such as recovery time for critical systems or the share of privileged accounts using phishing-resistant MFA.
3. What are we doing about it, and is it on track? Name the handful of initiatives that matter and their status.
4. What do we need from you? A budget decision, a risk acceptance, a policy approval. If the answer is “nothing,” say so.

Storytelling matters here. A short walkthrough of how a real attack on a peer company would have played out in your environment lands far better than a heat map. Honest framing matters even more: boards forgive risks that were clearly explained and consciously accepted, and rarely forgive surprises.

Resilience as the business case

Prevention alone is not a strategy a CEO can plan around, because no one can promise it. Resilience is. When a CISO frames the program as “how quickly can we keep serving customers after an attack,” the conversation shifts from fear to operations, and security spending starts to look like continuity planning, which executives already understand.

In practice, that means the CISO sits with operations and finance to agree on how long each critical process can be down, then designs backups, segmentation and response playbooks to meet those targets. It also means rehearsing. A tabletop exercise with the executive team, run once or twice a year, does more to build the CISO’s credibility than any slide deck, because leaders experience the decisions they will face before they face them for real.

What the organization owes its CISO

A CISO cannot act as a business leader if the organization treats the role as a help-desk escalation point. Given the personal legal exposure described above, companies that want strong security leaders should provide:

• A reporting line with real access to the CEO and board, and a direct route to the audit or risk committee.
• Clear written authority over security policy and incident escalation, including who decides materiality and disclosure.
• Directors and officers insurance and indemnification that explicitly cover the CISO.
• A documented risk-acceptance process, so business owners formally own the risks they choose to carry.

Smaller organizations that cannot justify a full-time executive often get the same benefits from a virtual or fractional CISO, provided that person has the same access and authority. Our cybersecurity compliance and regulatory services are often delivered in exactly that model.

Update (September 2026): In November 2025 the SEC voluntarily dismissed its remaining claims against SolarWinds and Tim Brown, ending the case. The dismissal eased fears of routine enforcement against individual CISOs, but the disclosure rules remain in force and the Sullivan conviction stands, so the governance practices above are as relevant as ever.

Frequently asked questions

Who should the CISO report to?

There is no single right answer, but the CISO should not report into a function whose work they are expected to challenge without a separate route to the board. Many organizations have the CISO report to the CEO, CIO or chief risk officer, with a standing slot at the audit or risk committee.

Does a CISO still need deep technical skills?

Yes, enough to judge architecture decisions and challenge vendors. But the skills that most often limit a CISO’s effectiveness are communication, negotiation and financial literacy, not technical knowledge.

How will the CISO role evolve over the next five years?

Expect more emphasis on governing AI use, managing third-party and SaaS risk, and personal accountability for disclosures. The CISO is likely to look increasingly like a chief risk officer for digital operations.

Building security leadership that the business trusts

Delana Technologies helps organizations build security leadership that the board can rely on, from fractional CISO support and board reporting to incident readiness exercises and governance for AI adoption. To talk about your security leadership needs, call 239.414.5126 or contact us.

---

Sources: SEC final rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (2023); NIST Cybersecurity Framework 2.0 (February 2024); EU NIS2 Directive (2022/2555); United States v. Sullivan, Ninth Circuit opinion (March 13, 2025); reporting by Alston & Bird and Perkins Coie on the SEC’s dismissal of SEC v. SolarWinds (November 2025).