A common issue that can arise with an information security program over time is a decline in senior management support for the program. While a quality business case can gain strong support for the program at its onset, the passage of time can result in the decline of support. Business environments and the economy change rapidly, and business leadership can start forgetting about the need for cybersecurity. New developments, such as new products, staff changes, and economic downturns, can cause senior management to start looking for areas of the business to cut. Unfortunately, cybersecurity is often one of the first candidates.
To prevent an information security program from crashing and burning, support from business leadership needs to be maintained. One of the most important methods for doing this is designating an executive sponsor for the program. An executive sponsor is an individual who takes ownership of a project at the strategic level and is responsible for ensuring the project stays aligned with business drivers and objectives. More importantly, they are responsible for communicating the project's successes to key stakeholders. In large enterprises, the executive sponsor is one of the top-level IT/cybersecurity managers, such as the Chief Information Officer (CIO) or Chief Information Security Officer (CISO). In small to medium-sized organizations, the executive sponsor could be a member of the board of directors or the manager of a business unit with a strong stake in information security success. Regardless of who is designated, the executive sponsor needs to have a good grasp of both cybersecurity needs and business objectives, as well as an understanding of how the two areas work together. By design, the executive sponsor has front-line communication with both senior management and IT staff. They serve as channels for communication between the two departments and translate expressed needs between them.
The executive sponsor will present cybersecurity key performance indicators (KPIs) and key risk indicators (KRIs) to senior management, demonstrating the success or failure of current cybersecurity measures. They will report returns on investment (ROI) for current cybersecurity projects and help with business cases for new ones. The executive sponsor must also document stakeholder comments, concerns, and reports and relay them to the cybersecurity staff. These may include changes in the cybersecurity budget and company risk appetite.
Businesses can be flexible in who they choose for this role. However, the chosen individual must have good communication and reporting skills. They must have a good grasp of cybersecurity fundamentals, as well as the risk appetite of the business and the budgetary constraints placed on senior management. To keep information flowing smoothly between IT and senior management, both departments should schedule regular meetings with the executive sponsor to communicate new developments that may affect the direction of the company's information security program.