If CISOs were to do their jobs to the fullest then this map would make for a comprehensive strategy and a pretty complete checklist of duties and responsibilities – yet how does one present this list to an organization that may lack the needed resources, without the CISO hyperventilating? Often smaller organizations feel like their size works as a cloaking device with an “It’s not going to be us” mentality – Hackers/breaches/ ransomware don’t really discriminate. As a result, the smaller guys still need to be prepared, even if it potentially is a different playing field.

So, how do we go about doing our job right? Let’s figure out how the needs of a smaller organization may be affected by size, resources, number of employees, and so forth. What are your top three you want to address given limitations on resources? Comment below and let’s collaborate!