State of the CSO 2008: Powering Up

» add a comment

June 27, 2008 — Our exclusive 2008 State of the CSO survey shows growth on almost every front in the battle to engrain security and risk management into every business. We heard from senior leaders on everything from organizational charts and strategic priorities to daily duties. Let's dive into the key findings:

1. More Power to You

Where security reports on the organizational chart is a good barometer of the profession's standing. For the first time, the number of respondents who report directly to the CEO of president of their organization is equal to the number reporting to the technical function. That's the first sign of expanding influence.

To whom do you directly report?

	2008	2003
CIO or CTO	22%	30%
CEO/President	21%	12%
COO/Equivalent	11%	6%
CFO/Equivalent	5%	5%
General Counsel/Legal	4%	2%
Other	37%	34%

***

Certifications remain important, but the big story here is the encouraging increased number of security leaders who hold an MBA. In 2003, 14 percent of respondents could hang an MBA on their office wall. Today, that number has risen to more than a quarter of respondents.

Which of the following degrees and/or certifications do you hold? h3>

(Multiple responses possible.)

MBA 26%

CISSP 23%

Military or law enforcement 3%

CPP 11%

JD 3%

PhD 3%

(Multiple responses possible.)

MBA	26%
CISSP	23%
Military or law enforcement	3%
CPP	11%
JD	3%
PhD	3%

***

Tenure is on the rise, offering further evidence that the security leadership position is becoming more stable and mature. And perhaps, just perhaps, that the "fall guy syndrome," in which CSOs served as handy scapegoats, regardless of who accepted a particular business risk, is receding.

How long have you been in your current position?


(Numbers do not total 100% due to rounding.)
Less than one year	8%
Between one year and two years	13%
Between two and three years	20%
Between three and five years	21%
Between five and 10 years	23%
More than 10 years	16%

***

While I.T. remains a common background for survey respondents (in all likelihood indicating that the title CSO is still held by information-security-only leaders in a lot of companies), a wide variety of other experiences shape the security function.

What is your background?


Multiple responses possible.
Information systems	58%
Business operations (sales, admin, etc.)	24%
Military	18%
Physical security	18%
Audit	16%
Law enforcement	16%
Legal	4%
Other	13%

2. Changing World, Changing Job

Org charts aside, here's direct and resounding indication that the corporate world has awakened to risk management.

In the past 12 months, has your organization's leadership placed more, less or the same value on risk management?


More value	62%
No change	32%
Less value	6%

And here's one likely reason for risk management's greater value: more laws. While it has been a quiet year (relatively) for new federal laws, companies still face an expanding list of state disclosure laws, new PCI application security requirements, and rolling deadlines such as the FACT Act's Red Flag Rules.