CISO with a small security team? Learn from your peers’ experience with this free e-book

CISOs with small security teams hold an intensive juggling act.
They’re responsible for sustaining the company’s security
resilience, ensuring compliance is adhered to and implementing
privacy controls.

In between these tasks, they need to follow up on board updates,
lead cross-team communications and collaboration, and fight fires
that may or may not be related to cybersecurity.

All the while, they’re doing this with a small security team,
trying to get the most out of existing resources, preventing team
burnout, and most likely taking an active, hands-on approach to
ensure that all the goals are met.

While each CISO has their game plan, what’s certain is that
CISOs with small security teams are all about efficiency.
Efficiency takes on various forms based on each CISO’s background,
capacity, industry, and even company culture.

In the e-Book “10 CISOs With Small Security Teams Share Their
Must Dos and Don’ts” (Download it here)^[1], CISOs of teams up to 5
across the industries share their challenges and what worked with
them in terms of efficiency.

While this e-Book provides ten tips, we found it interesting to
surface the following six:

1. Invest in communicating upstream. This tip
   folds within sub-tips with practical steps, such as what and how to
   build a security plan and communicate it. Bonus tip: they offer a
   security budget template for 2021!
2. Consider the accompanying cost when purchasing a
   product. This tip provides specific parameters – from
   deployment to maintenance – to test during a product evaluation.
   Bonus tip: give preference to those companies that offer a try/ buy
   model to see what implementation really is like.
3. Consolidate as many security platforms as you
   can. Bonus tip: really understand what “consolidated” or
   “unified” the platforms that are marketed as such. Are they a combo
   of various point solutions are built as one by design?
4. Don’t go for the priciest brand, but don’t compromise
   on security. With vendors marketing dollars, it’s easy to
   get lost in the noise. Bonus tip: use third party evaluation
   results such as MITRE Engenuity’s ATT&CK evaluations.
5. Automate as much as possible. Apply automation
   on everything – from playbooks to integrating with task management
   and ticketing platforms. Bonus tip: automate workflows for quick
   and effective remediation plans. But don’t confine these just to a
   single endpoint, rather include also network and user remediation
   actions.
6. Set customer success and service expectations.
   Know what you’re getting the day after you made the product
   purchase. Bonus tip: specific questions to ask the vendor to ensure
   you’re not left alone dealing with an incident or, worse yet, with
   a semi-functioning product.

Not a lot of resources are devoted to CISOs with small security
teams. We’re happy to have found this one that provides those
insights and references that can really help others facing the same
challenges. It’s an easy yet helpful read, which we highly
recommend.

Download the eBook^[2]
“10 CISOs With Small Security Teams Share Their Must Dos and
Don’ts” here.