Business Ethics and the CISO - Troy Stairwalt - CSP 111

As risk practitioners, CISOs make risk vs reward decisions on a daily and sometimes hour-by-hour basis. As professionals, we must understand our organization's risk tolerance and appetite as well as our own. Regulations are lagging indicators. SOX was established as a direct response to unethical behavior.

Unfortunately, regulations in cybersecurity and data privacy are also "lagging indicators" that organizations "left to their own device" have failed to allocate sufficient reasonable cost-effective resources to mitigate the significant risk in prudent ways …

business ciso cisos csp cybersecurity daily data data privacy device ethics organization organizations own privacy professionals regulations response risk risk tolerance sox tolerance understand