Top Ten Reasons You Know Your CISO Must Go

10. They do not have a written, vetted, business-focused and communicated strategic plan that is readily available for viewing.

8. They continue to deploy technology while solving few problems (if it is not sexy…. what?)

7. They continue to cry wolf-using FUD at every turn.

6. They submit budgets that do not fully define a return on security investment aligned to a strategy and program.

5. They run a closed shop where loyalty is valued higher than openness and integrity.

4. They do not listen to the heartbeat of the business instead gloss over issues as solved when in fact they are setting up corporate officers for embarrassment and failure (aka RSA).

3. They have not driven configuration management as a core IT value.

1. They still allow Security 101 issues to exist even though informed of the problems months and years before, for example allowing FTP to flourish throughout their environment.