What is a CISO?
A CISO (Chief Information Security Officer) is the most senior executive for information security in an organisation: the person who sets the security strategy, directs the cybersecurity policy and advises the board on digital risk. The CISO turns threats and legal requirements into a programme of controls, budget and reporting. In industrial companies the role increasingly stretches from office systems (IT) to production and process control (OT).
The CISO safeguards the confidentiality, integrity and availability of information, and in OT also the continuity and safety of the physical process.
🎯 What does a CISO do?
The core duties of a CISO are:
- Strategy and policy - drafts the cybersecurity strategy and the information security policy and has them adopted by executive management
- ISMS - develops and maintains the ISMS (Information Security Management System), usually in line with ISO 27001
- Risk management - has risk assessments carried out (for example based on ISO 27001, NIS2 and IEC 62443) and keeps the risk register up to date
- Reporting - reports on threats, incidents and compliance to executive management or the board
- Incident response - coordinates incident response for serious incidents, together with the SOC and the CSIRT
- Awareness - runs awareness programmes, training and phishing simulations
- Collaboration - works with IT, OT, legal, HR, procurement, auditors and external supervisors
📊 What responsibilities does a CISO have per domain?
| Domain | Example tasks | Typical outcome |
|---|---|---|
| Policy & strategy | Drafting security policy, planning budget, setting the roadmap | Multi-year plan and adopted policy |
| Risk management | Threat modelling, risk analyses, designing mitigating measures | Risk register with owners and acceptance decisions |
| Compliance | Demonstrable conformance with ISO 27001, BIO, NIS2; data integrity under GMP | Audit reports, certificate, accountability to the supervisor |
| Incident response | Coordinating notifiable cyber incidents | Incident response plan and rehearsed crisis roles |
| Awareness | Security training, phishing simulations, behavioural change | Training coverage and click rates per department |
| Governance | Periodic reports to executive management, the supervisory board and auditors | Dashboard of risks, KPIs and progress |
| Supply chain security | Security requirements for suppliers and integrators | Contract clauses and supplier assessments |
🧠 Where does the CISO sit in the organisation?
The reporting line largely determines how much influence a CISO has. CISO surveys have shown for years that roughly a third report to the CIO and a similar or larger share directly to the CEO, with a clear trend towards direct access to the board.
- Under the CIO - close to IT, but with a risk of conflict of interest: the CISO then has to criticise the department of their own boss
- Under the CEO or executive board - more independence and visibility; common in regulated sectors such as finance, healthcare and energy
- Under risk or the CFO - suits organisations that treat security primarily as a business risk
Whatever the reporting line, the CISO works closely with IT, OT and security teams, including the SOC, SIEM and ISMS management. Below the CISO there is often an Information Security Officer for the tactical work and, on the plant floor, an OSO for day-to-day execution. The data protection officer (DPO) under the GDPR (AVG in Dutch) is a separate, independent role.
⚖️ Is a CISO legally required?
No Dutch or European law prescribes the job title CISO. Responsibilities must, however, be demonstrably assigned:
| Framework | What it requires | Consequence for the CISO |
|---|---|---|
| NIS2 / Cybersecurity Act | Management body approves measures, oversees them and takes mandatory training; Dutch act in force since 15 August 2026 | The board stays accountable; the CISO prepares decisions and reports |
| Incident reporting | Report significant incidents within 24 hours, 72 hours and one month | The CISO organises the reporting process and the “significant or not” decision |
| ISO 27001 | Clause 5.3: assign roles, responsibilities and authorities | Usually filled by a CISO or ISO as owner of the ISMS |
| ISO 27002 | Control 5.2: information security roles and responsibilities | Division of tasks and segregation of duties are documented |
| BIO | BIO2 (2025) mandatory for in-scope Dutch government bodies under the Cybersecurity Act | Government bodies assign the role to a CISO or equivalent officer |
| IEC 62443-2-1 | Security programme of the asset owner, 2024 edition | No job titles, but clear roles for IT and OT alike |
| NIST CSF 2.0 | New Govern function since February 2024 | Cybersecurity explicitly treated as an enterprise risk with defined roles |
The key change compared with the past: under the Dutch Cybersecurity Act final accountability lies explicitly with the management body. Supervisors can also direct measures at individual directors. The CISO is therefore less the “owner” of security and more the adviser who enables the board to live up to that accountability.
🛠️ Which tools and standards does a CISO use?
- Standards and frameworks - ISO 27001, ISO 27002, IEC 62443, NIST CSF
- Detection and response - SIEM, SOAR, EDR and the SOC
- Insight into assets and vulnerabilities - CMDB and vulnerability management
- GRC platforms - supporting governance, risk and compliance
- Continuity - business continuity, disaster recovery and the risk register
- Policies - for access control, backups and incident management
🏭 What does a CISO do in an OT environment?
In industrial networks the CISO also oversees:
- SCADA and PLC security - including engineering workstations and remote access
- Segmentation and network architecture - for example network segmentation following the Purdue Model and the zones and conduits model from IEC 62443
- Risks to production and safety - a cyber incident here can cause downtime, environmental damage or injury
- Change management - together with engineering and operations, so that patches and firewall changes do not disrupt the process
The biggest difference from IT is priority. In IT, confidentiality often comes first; in OT, availability and safety take precedence. A CISO who copies IT rules one-to-one to the plant, such as automatic patching or aggressive scanning, can cause an outage. Many industrial companies therefore appoint an OT security manager who reports to the CISO, or set up a joint steering group with the plant manager.
🧭 How do you set up the CISO role in practice?
A workable approach for a mid-sized industrial company:
- Define the mandate - record in a job description that the CISO covers both IT and OT, who the CISO reports to and what escalation authority the role has
- Involve the board - have the board take the mandatory training under the Cybersecurity Act and put security on the agenda at least every quarter
- Baseline - map assets, risks and maturity, for example with a maturity model
- Divide roles - CISO for strategy, ISO for policy and control, OSO and OT security engineers for execution on the plant floor
- Roadmap and budget - a two-to-three-year plan tied to the largest risks
- Rehearse - test the incident response plan at least once a year with a tabletop exercise involving IT, OT and executive management
- Measure and report - a fixed set of KPIs, such as patch backlog, MFA coverage, number of critical vulnerabilities and time to detect
Smaller organisations without a full-time budget often hire a virtual CISO (vCISO) for a few days a month. That works, provided someone internally keeps track of day-to-day follow-up.
✅ What competencies does an effective CISO need?
- Analytical ability and overview - from technical detail to business risk
- Knowledge of regulation as well as technology - from firewalls to OT risks and the Cybersecurity Act
- Communication - from boardroom to shop floor, without jargon
- Experience with frameworks - such as ISO 27001, IEC 62443 and the NIST CSF
- Risk thinking - turning risks into business decisions with a price tag and an owner
❓ Frequently asked questions
What is the difference between a CISO and a CIO?
A CIO is responsible for information provision and the IT organisation as a whole. A CISO focuses specifically on securing it and sometimes has to challenge the choices of the CIO. That is why a CISO preferably does not report solely to the CIO.
What is the difference between a CISO and an ISO?
A CISO works at the strategic level: vision, budget and advice to the board. An Information Security Officer (ISO) works at the tactical level and translates policy into risk assessments, controls and checks. In smaller organisations one person combines both roles.
Is a CISO required under NIS2 or the Dutch Cybersecurity Act?
No, NIS2 and the Dutch Cybersecurity Act do not prescribe a CISO position. They make the management body accountable for cybersecurity and require appropriate measures, training for directors and an incident reporting process. In practice most organisations appoint a CISO to carry out those obligations.
Is a CISO personally liable for a cyber incident?
In the Netherlands, legal accountability under the Cybersecurity Act lies with the management body, not with the CISO. In the United States, CISOs have been personally targeted: in October 2023 the SEC charged the CISO of SolarWinds personally over allegedly misleading statements about its security. A court dismissed most of the charges in 2024 and the SEC dropped the remaining case in November 2025, but the case made the personal risk of the role visible. Clear agreements on mandate and reporting protect both the CISO and the board.
What is a virtual CISO (vCISO)?
A virtual CISO is an external specialist who fills the CISO role part-time, often a few days a month. This is common among SMEs that fall under the Cybersecurity Act but cannot afford a full-time CISO. The vCISO drafts policy and the roadmap, while execution stays with in-house staff or suppliers.
Does OT security fall under the CISO?
Increasingly it does, because the Cybersecurity Act and NIS2 make no distinction between IT and OT. Many industrial companies give final responsibility to the CISO and execution to an OT security manager or OSO on site. What matters most is that engineering and operations have a say in measures that affect the process.
📌 In summary
The CISO is the strategic pivot of information security: translating threats and legislation into policy, controls and reporting, and enabling the board to meet its accountability under NIS2 and the Dutch Cybersecurity Act. In industrial companies the role also covers OT, where availability and safety come first and collaboration with engineering is essential.