Executive Management / CISO
Overview
Executive Management sets direction and secures the conditions for application.
Without sponsorship at the highest level, security loses priority and resources. The CISO translates strategy into executable programmes.
Key Responsibilities
- Sponsor and secure the conditions for applying SbD-ToE
- Define the budget and support the choice of tooling and training
- Assume final responsibility for security governance
- Take strategic decisions on residual risk
Organisational Context
This role is central to NIS2 and DORA, which explicitly assign the management body responsibility for overseeing and executing cybersecurity and digital operational resilience measures.
Regulatory Framework
NIS2 and DORA assign explicit responsibility to the management body for digital security and operational resilience.
Activities by Chapter
Ch. 01 - Application Classification
Publish formal organisational policies (Risk Classification, Risk Acceptance, Periodic Review, Traceability/Audit) to ensure uniform criteria.
User Stories:
- Formal organisational policies - Uniform, auditable operation
Ch. 02 - Security Requirements
Approve minimum requirement templates and publish the policy for applying them, with training for technical teams.
User Stories:
- US-07: Publication of the policy for applying requirements - Clear procedures and SLAs (with GRC / Compliance)
Ch. 04 - Secure Architecture
Establish a formal architecture approval process for L3, with a technical committee or governance review.
User Stories:
- US-14: Formal architecture review for L3 - Mitigate structural risks before go-live (with Software Architects)
Ch. 05-09 - Tooling and Infrastructure
Support investment in tooling (SCA, SAST, DAST, SBOM, policy engines) and automated processes.
Ch. 07 - Secure CI/CD
View the CI/CD metrics dashboard (coverage, exceptions, gate blocks, remediation time) for informed decision-making.
User Stories:
- US-12: CI/CD metrics dashboard - Strategic corrective action
Ch. 10 - Security Testing
Establish security acceptance criteria per release and a residual-risk acceptance process.
User Stories:
- US-07: Acceptance criteria per release - Informed go/no-go decisions
Ch. 11 - Deployment and Operations
Decide on high risks in production and ensure traceability from commit → build → release → deploy.
User Stories:
- US-07: End-to-end traceability - Audit risk decisions
Ch. 13 - Training and Onboarding
Run incident simulations (war room) regularly, define upskilling KPIs, ensure minimum training for third parties, and define a mandatory training track per contractor profile.
User Stories:
- US-04: Incident simulations (war room) - Validate response processes (with GRC / Compliance)
- US-11: Upskilling KPIs - Evaluate real impact (with GRC / Compliance)
- US-12: Minimum training for third parties - Comply with NIS2/DORA (with GRC / Compliance)
- US-13: Training track for contractors - SLA before technical access (with Training Manager)
Ch. 14 - Governance and Contracting
Define and monitor governance KPIs, appoint a Security Champion per critical application, consolidate and report KPIs, and formalise a governance model with delegated authority levels.
User Stories:
- US-01: Governance KPIs - Evaluate SbD-ToE effectiveness
- US-05: Security Champion appointment - Clear accountability
- US-08: KPI consolidation and reporting - Evaluate organisational maturity
- US-09: Formal governance model - Appropriate authority (with AppSec Engineer)
Chapter References
For full context and framing:
- Ch. 01 - Application Classification
- Ch. 02 - Security Requirements
- Ch. 04 - Secure Architecture
- Ch. 05 - Dependencies and SBOM
- Ch. 07 - Secure CI/CD
- Ch. 09 - Containers and Images
- Ch. 10 - Security Testing
- Ch. 11 - Secure Deployment
- Ch. 12 - Monitoring and Operations
- Ch. 13 - Training and Onboarding
- Ch. 14 - Governance and Contracting