Not a week goes by without some data breach, leak, hack, attack or other significant cybersecurity failures that spills all over blogs and even national media.
Five years ago, only avant-garde companies invested in cybersecurity; today, it has become a must. Companies realize the importance of a solid cybersecurity plan built on the People, Process and Technology pillars. One topic rarely discussed by corporate executives or security leaders is the incredible (and growing) stress the current environment inflicts on CISOs.
The stress is real
Stress is a normal way of life for most executives, but CISOs feel an acute level. Nominet's report, in collaboration with Vanson Bourne, The CISO Stress Report - Life Inside the Perimeter: One yes on", was the first quantification of this systemic issue.
In 2019, Nominet and Vanson Bourne conducted 800 online interviews in the USA and U.K (400 C-Suite and 400 CISOs). The included CISOs worked for both public and private corporates with at least 3,000 employees. They were quizzed about work-related stress and its effect on their professional & personal lives.
88 percent of CISOs consider themselves under moderate or high levels of stress
Some Interesting conclusions
7 out of 10 CISOs agree their work-life balance is too heavily weighted towards work (71%)
Almost all CISOs are working beyond their contracted hours, on average by 10 hours per week (95%)
This equates to extra time worth $30,319 per annum
87% of CISOs say that working additional hours was expected by their organization, while 78% of board members admitted this to be the case
83% of CISOs spend at least half of their evenings and weekends thinking about work
Only 2% say they are able to switch off once they’ve left the office
Over a third have failed to take all entitled annual leave
45% have missed family milestones or activities
More about the stress
The average tenure of a CISO is 26 months, and many believe stress is the primary motivator of change.
CISOs reported missing important family events such as birthdays, vacations, weddings and even funerals. Even with all the stress and extra working hours, most CISOs aren't taking their full annual leave (or sick days, time off for medical & dental appointments, etc.)
Stuart Reed, vice president at Nominet, suggested that the stress and wear & team on CISOs result from a combination of internal and external factors. The external factors are the headlines your read about, while the internal stresses are the pressure from executives expecting CISOs to "properly" handle these incidents and to provide updates & answers continually.
What are the most stress inducing elements?
44% being responsible for securing the organization and preventing breaches
40% the need to stay ahead of threat intelligence
39% the long hours worked
65% of those surveyed had suffered a breach in the past 12 months
37% of CISOs consider themselves ultimately % responsible for a breach while 31% of board members agree
A fifth of CISOs believe they would be fired as a result, regardless of whether or not they themselves were responsible
What are the effects of the stress?
Nearly half of CISOs said the levels of stress they are under has impacted their mental health (48%)
35% also reported that their stress had impacted their physical health
4 out of 10 CISOs said that their stress levels had affected relationships with their partners or children
31% said the stress affected their ability to fully perform at their job
How are CISOs coping with the stress?
A quarter of CISOs are turning to medication or alcohol to manage their stress - an increase from 17% a year ago
A fifth have taken a leave of absence due to stress (21%)
21% believed there to be no support structures in place within their organization to help deal with stress, while 94% of board members suggest there are
9 out of 10 CISOs would take a pay cut to improve their work-life balance; on average 7.76%, equating to $9,642
The silver lining
The report suggests that boards of directors are aware of the stress affecting their CISOs (74% of respondents believe that moderate or severe stress impacts their CISO).
As the board of directors and CIOs acknowledge this significant issue, they show more willingness to hire support staff to alleviate some of the stress elements. Ensuring the CISO is surrounded by skilled senior professionals can help alleviate many of the most aggravating elements. These supporting professionals must be experienced security technicians and have strong business acumen, strong interpersonal skills and the ability to work in teams or alone.
Another important stress reliever is ensuring the CISO can honestly share the state of their cyber universe with the executive leadership team to ensure decision-makers universally understand risks and provide executive support to the CISO (guidance and funding). The CISO must know he/she is not alone.
Cybersecurity is growing in importance and, for many organizations, has become the price of entry. Executives have started to understand this important fundamental truth and are now more willing to share the cybersecurity burden.
Conclusion
I built my first security business (a Canada wide security practice) that was later sold to Bell Canada in the early 2000’s and have been actively involved in cybersecurity since. Over the last 20+ years, I have seen the importance of security grow and this has required the creation of the CISO role.
Unfortunately I see too many CISOs that have been promoted to their level of incompetence (read about Peter’s principle here). The job is difficult enough for the professional with the right skills but is deadly for the wrong professional promoted as a reward (not because of merit).
Companies should perform an honest review of their CISOs competence and abilities. Thrusting the wrong person into this role is a disservice to the candidate.
Additionally it is important to realize that most security certifications tackle the technical skills. These are important but form less than 40% of the CISO’s true day to day responsibilities. The key skills (negotiation, strategic vision, budgeting, people management, etc) are completely ignored in most of the certifications companies deem “required” when posting a CISO job. HR leaders must quickly understand the new realities of the CISO role and craft job descriptions akin to that of a business executive leader than a manager for firewalls. This realization is important because a properly skilled CISO will handle the stress much better and therefore will deliver a much higher return on investment for the company.
HR leaders must learn to hire the right candidate for the CISO position