CISO cheat sheet

Risk = likelihood × impact; residual risk = inherent risk minus the effect of implemented controls. Risk acceptance is a business-owner decision, not a security-team decision.

COSO ERM covers strategy and enterprise objective-setting; ISO 31000 gives generic risk-management principles and process; ISO/IEC 27005 is the information-security-specific risk process.

ISO/IEC 27001 requires a Statement of Applicability listing every Annex A control, whether it is applied, and the justification for inclusion or exclusion.

Three lines model: management owns and operates controls (first line), risk and compliance functions provide independent oversight (second line), internal audit gives independent assurance (third line).

Control types: preventive stops an event, detective identifies it after or during occurrence, corrective reduces impact after detection, and compensating substitutes when the primary control is infeasible.

Key risk indicators are leading and threshold-based; key performance indicators measure control operation. A KRI crossing its threshold triggers escalation, not automatic acceptance.

Regulatory mapping rule: GDPR governs personal data of EU data subjects regardless of company location; PCI DSS applies to any entity storing, processing, or transmitting cardholder data.

Tiered policy hierarchy: policy states mandatory intent, standard specifies measurable requirements, procedure gives step-by-step instructions, guideline is recommended practice.

Third-party risk: tier vendors by data sensitivity and system criticality; contract clauses must include breach notification timelines, audit rights, and subprocessor approval.

Strategy alignment test: every security initiative must trace to a business objective, a legal or regulatory obligation, or a quantified risk reduction.

Security budget benchmarks commonly fall in the 3–8% of IT spend range; a variance from the peer median requires a documented business justification, not an automatic correction.

Maturity models (CMMI-style) rate capability on a 1–5 scale: 1 initial, 2 managed, 3 defined, 4 quantitatively managed, 5 optimizing.

Board reporting rule: report risk posture and trend in business language (financial exposure, regulatory standing), not tool metrics such as patch counts.

Security steering committee composition: CISO as chair or co-chair, plus business unit leads, CIO, CFO, legal, and risk; decisions are minuted with named owners and due dates.

Build-vs-buy decision criteria: data classification, in-house capability gap, total cost of ownership over 3–5 years, and vendor lock-in risk.

Security culture measurement uses behavioral indicators (phishing simulation failure rate, helpdesk report rate, policy exception requests), not training completion alone.

A security charter defines the CISO's mandate, reporting line, authority to set policy, and budget ownership; ambiguity here is a leading cause of program failure.

Zero trust principles: verify explicitly, use least privilege, and assume breach; network location alone never grants trust.

Defense in depth layers controls so no single failure exposes the asset; the control set must include preventive, detective, and corrective elements at each boundary.

Trust boundary definition: any point where data or control crosses between differing privilege, ownership, or trust levels must have a defined control.

Data states: at rest (encryption with key management), in transit (TLS 1.2 minimum, 1.3 preferred), and in use (confidential computing or tokenization).

Segmentation rule: isolate regulated data, production from development, and OT from IT; east-west traffic controls matter as much as perimeter controls.

Threat modeling with STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) is performed at design time, before code is written.

Cryptography standard: AES-256 for symmetric encryption, RSA-3072 or ECC P-256/P-384 for asymmetric, SHA-256 or stronger for hashing; MD5 and SHA-1 are deprecated.

Secure SDLC gates: design review with threat model, static analysis on commit, dependency scanning in build, dynamic testing pre-release, and penetration test before major launch.

Patch management targets are risk-tiered: critical internet-facing vulnerabilities typically within 15 days, high within 30, medium within 90; exceptions require documented risk acceptance.

Identity rule: unique accounts per user, MFA on all privileged and remote access, and privileged access management vaulting for shared administrative credentials.

Log retention: 90 days readily available and 12 months archived is a common baseline; PCI DSS requires 12 months with the most recent 3 months immediately available.

Vulnerability severity uses CVSS base scores: 9.0–10.0 critical, 7.0–8.9 high, 4.0–6.9 medium, 0.1–3.9 low; exploitability and asset criticality must adjust prioritization.

Change management separation of duties: the person who develops a change cannot be the sole approver or the sole deployer of that change to production.

Backup rule 3-2-1: three copies, on two different media, with one copy offsite or offline; at least one copy must be immutable to resist ransomware.

Security operations metrics: mean time to detect and mean time to respond are the primary effectiveness measures; alert volume alone is not a quality indicator.

Configuration baselines (CIS Benchmarks or vendor hardening guides) are the reference for drift detection; deviations are findings, not preferences.

Incident lifecycle phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Severity classification drives escalation: a confirmed data breach involving regulated data is typically Severity 1 with executive and legal notification.

GDPR breach notification to the supervisory authority is required within 72 hours of awareness unless the breach is unlikely to result in risk to individuals.

Evidence handling: preserve volatile data first (memory, network state), maintain chain of custody, and use forensically sound images rather than live edits.

Containment options are isolate, disable, block, or segment; the choice balances stopping spread against preserving evidence and business continuity.

Incident response plan testing: tabletop exercises test decision-making and communication; functional exercises test technical playbooks and tooling.

Communication rule: legal counsel directs privileged breach analysis; external communications are coordinated through a single designated spokesperson.

Post-incident review is blameless and produces tracked corrective actions with owners and due dates; recurrence of the same root cause signals a governance failure.

BIA outputs: RTO (maximum tolerable downtime), RPO (maximum tolerable data loss), and MTD (point of unrecoverable business impact); RTO and RPO must be ≤ MTD.

Recovery strategy tiers: hot site (near-zero RTO, highest cost), warm site (hours to days), cold site (days to weeks), and cloud failover as a hot-site variant.

BCP vs DR: business continuity covers keeping the whole business operating during disruption; disaster recovery focuses on restoring technology and data.

Awareness vs training: awareness builds broad security attitude across all staff; training builds role-specific skill for defined job functions.

Phishing simulation metrics: click rate, credential-submission rate, and report rate; report rate is the most meaningful indicator of healthy culture.

Exercise cadence: tabletop annually at minimum, full DR test at least annually for critical systems, and after any major architecture change.

Plan maintenance trigger: any material change in systems, vendors, key personnel, or threat landscape requires plan review, not only the annual calendar cycle.

Crisis communication includes pre-drafted holding statements, a designated call tree, and alternate communication channels independent of the affected infrastructure.

Cloud shared responsibility: provider secures the infrastructure; the customer secures data, identity, configuration, and access regardless of service model.

Identity federation with SAML or OIDC centralizes authentication; the identity provider becomes a tier-zero asset requiring the strongest controls.

Network defense ordering: deny by default, allow by exception, log all denials, and review allow rules on a defined cycle.

Microsegmentation reduces blast radius and is a compensating control when flat networks cannot be redesigned within budget or timeline.