Monday Feb 13, 2023

#116 - A European view of CISO responsibilities (with Michael Krausz)

In the US we often focus on SOC-2, NIST Special Pubs, and the Cybersecurity Framework. In Europe (and most of the rest of the world), ISO 27001 is the primary standard. ISO concerns itself with policy, practice, and proof, whereas NIST often shows the method to follow. Michael points out that a CISO is responsible for governance, (internal) consulting, and audit. In early stages of growing a security function, a CISO needs to be technically-focused, but as a security department matures, the CISO must be organizationally-focused. Also, to effectively grow your team, first determine what actions need to take place, how much effort it requires, and how often it needs to take place. Then, build an action sheet and collect data for three months. Finally, take that to your executives and document your requirements for more staff.

Michael Krausz LinkedIn Profile:

Michael Krausz Website:

Full Transcript: 


  • 00:00 Introduction
  • 04:01 Is there a Gap Analysis in ISO 27001?
  • 08:05 Is there a Requirement for ISO Standards?
  • 10:57 What is ISO 27001?
  • 13:11 Is there a Parallel Development between the US and EU?
  • 16:57 Do you want to be a trooper?
  • 21:17 What's the Oldest Operating System?
  • 23:09 Is there a Legacy Operating Systems that you can't get away with?
  • 24:11 The Most Important Class for a CISO
  • 26:33 The Secrets of a Successful CISO
  • 29:30 CISO - I need 6 people period
  • 33:40 What's the Primary Skill Needed in a CISO?
  • 37:41 How to Maximize the Number of FTEs

Comments (0)

To leave or reply to comments, please download free Podbean or

No Comments

Copyright 2024 All rights reserved.

Podcast Powered By Podbean

Version: 20240320