As I travel the U.S. and the world, I am frequently asked what the proper reporting structure is for the Chief Information Security Officer (CISO). While it sounds cliché, the real answer is “it depends.”

Enterprise Security Risk Management, or ESRM, seems to be the new buzzword across the corporate security ecosystem.

In the previous two columns I asked a few questions and discussed the concepts of what is security’s role and how would you evaluate security’s role?

Throughout his career, Brian Tuskan has been driven by a love of technology, a hardworking reputation and a desire to help others. However, his eye has always been on the Microsoft CSO role. Now, he’s taking his place at the head of the pioneering global security organization.

Last month we asked the question, “What is security’s role in the enterprise?” It turns out the answer isn’t that simple. I’d like to follow that up with what seems to be an easy question.

When Steven Wagner joined Indiana-based Hendricks Regional Health, the department was run on 99-percent paper, with no electronic method of tracking security officers’ activity or sharing information across shifts except for a sporadically updated blog without a search function.

Looking to implement the NIST Cybersecurity Framework in your organization this year? Take stock of your organization's current cyber maturity level and the path forward with these five steps.