Personal attributes

taking account of multiple complex factors to arrive at logical, repeatable conclusions
verbal and written communication, especially in producing formal documents which are comprehensive and without ambiguities
presenting logical, objective reasons for all decisions made
encouraging and supporting colleagues, including those in other departments, to achieve shared objectives
working effectively within organisational policies, procedures, and security and legal constraints
being sensitive and constructive when challenging other people’s ideas or decisions
evaluating the probable social, commercial, cultural, ethical and environmental consequences of an action

Specialist skills

using statistical, mathematical or financial techniques to assess the likelihood (taking account of vulnerabilities and threats) and impact of cyber-attack techniques and deliberate or unintentional damaging actions by people within the organisation
applying risk management methodologies, such as those in ISO 27001, and sector-specific requirements, such as PCI-DSS
interpreting legal and regulatory requirements and integrating them with an organisation’s operational requirements
assessing the compliance of procedures and practice with agreed standards

CIISec Skills Groups* (additional Skills Groups may also be relevant to particular jobs)

A1 – Governance

Principles:

directs, oversees, designs, implements or operates within the set of multi-disciplinary structures, policies, procedures, processes and controls implemented to manage Cyber and Information Security at an enterprise level, supporting an organisation’s immediate and future regulatory, legal, risk, environmental and operational requirements and ensuring compliance with those requirements

A2 – Policy and Standards

Principles:

directs, develops or maintains organisational Cyber and Information Security policies, standards and processes using recognised standards (e.g. the ISO/ IEC 27000 family, the Security Policy Framework) where appropriate
applies recognised Cyber and Information Security standards and policies within an organisation, programme, project or operation

A6 – Legal and Regulatory Environment and Compliance

Principles:

understands the legal and regulatory environment within which the business operates. Ensures that Information Security Governance arrangements are appropriate

ensures that the organisation complies with legal and regulatory requirements

B2 – Risk Assessment

Principles:

identifies and assesses information assets
uses this information and relevant threat assessments, business impacts, business benefits and costs to conduct risk assessments and identify and assess potential vulnerabilities

B3 – Information Risk Management

Principles:

develops Cyber and Information Security risk management strategies and controls, considering business needs and risk assessments, and balancing technical, physical, procedural and personnel controls

*Non-Commercial - No Derivatives (BY-NC-ND) license. 2021 Copyright © The Chartered Institute of Information Security. All rights reserved. Chartered Institute of Information Security®, CIISec. Chartered Institute of Information Security®, CIISec®, AfCIIS®, ACIIS®, MCIIS®, FCIIS® and the CIISec graphic logo are trademarks owned by The Chartered Institute of Information Security and may be used only with express permission of CIISec.

Experience

Any role that develops the abilities to assess complex sets of factors, methodically generate logical conclusions and document these very clearly, could provide a good foundation, with some additional specialist training, for a role in this specialism.

Examples of such careers and roles include:

roles in the emergency services, especially fire and police services, which require substantial risk management
operational and staff roles in the Armed Forces
business risk management
business operations
IT system management
business continuity
financial or internal audit
specialist commercial insurance assessment

Cyber Security Governance & Risk Management

More about a career in Cyber Security Governance & Risk Management

An introduction to this specialismWorking life

An introduction to this specialism

What will your responsibilities include? What are your tasks likely to include?Responsibilities

What will your responsibilities include? What are your tasks likely to include?

What core, related and wider knowledge is important for working in this specialism?Knowledge

What core, related and wider knowledge is important for working in this specialism?

What personal attributes might you need? What specialist skills are important?Skills

What personal attributes might you need? What specialist skills are important?

What other cyber security or IT role might you progress to from this specialism?Moving on

What other cyber security or IT role might you progress to from this specialism?

Which certifications and qualifications are relevant to roles in this specialism?Qualifications

Which certifications and qualifications are relevant to roles in this specialism?

Hear from someone already working in this specialismReal life examples

Hear from someone already working in this specialism

Contextualisation of the Specialism

Contextualisation of the Specialism