Writer
Hadass Liza Bitton is a writer at CISO Tribune covering security leadership: the people who take the top security seat, the ones who leave it, and what each move signals. Reach her at hadass@cisotribune.com.
Guide · November 11, 2026
An artificial intelligence (AI) security operations center lets AI agents triage and investigate alerts while analysts approve high-impact actions.
By Hadass Liza Bitton18 min read#guide#ai-soc#security-operations
Guide · November 10, 2026
Give the board a short list of risk-based indicators with targets and time windows, grouped by threat or framework function and scored as share on target.
By Hadass Liza Bitton17 min read#guide#board-reporting#security-metrics
Guide · November 8, 2026
NIST SP 800-207 removes trust based on network location; CISA's maturity model scores five pillars across four stages, from traditional to optimal.
By Hadass Liza Bitton15 min read#guide#zero-trust#nist
Guide · November 7, 2026
A business continuity plan keeps the business running during a disruption. A disaster recovery plan restores systems and data. Both matter in a cyberattack.
By Hadass Liza Bitton13 min read#guide#business-continuity#disaster-recovery
Guide · November 7, 2026
A data classification policy sorts data into three or four levels, names who assigns them and ties each level to controls. Levels, roles and a template.
By Hadass Liza Bitton18 min read#guide#data-classification#data-security
Guide · November 7, 2026
Shadow AI is unapproved staff use of AI tools. Find it by layering logs, browser checks and surveys, then pair rules with approved tools and even enforcement.
By Hadass Liza Bitton12 min read#shadow-ai#ai-governance#guide
Guide · November 5, 2026
ISO 27001 certification takes about 3 to 6 months from audit readiness. Cost turns on scope, sites and staff time; auditors test documents, then practice.
By Hadass Liza Bitton17 min read#guide#iso-27001#compliance
Guide · November 5, 2026
A patch management policy sets scope, owners, tiered deadlines, time-boxed exceptions and proof that each patch was installed and verified.
By Hadass Liza Bitton16 min read#guide#patch-management#vulnerability-management
Guide · November 4, 2026
CISO Tribune records every CISO appointment and departure as a sourced, dated entry, not a column: 466 moves to date, each with a primary source and a confirmed-or-reported label.
By Hadass Liza Bitton6 min read#guide#ciso-news#ciso-moves
Guide · November 4, 2026
SaaS security: the vendor secures the platform, you own configuration, identity, OAuth apps and data. Where breaches start and who owns each fix.
By Hadass Liza Bitton17 min read#guide#saas-security#identity
Guide · November 4, 2026
Run threat modeling as a program: start at design, update on defined triggers, store models with code, and track coverage, freshness and verification.
By Hadass Liza Bitton16 min read#guide#threat-modeling#application-security
Guide · November 3, 2026
A cloud security strategy splits duties with your provider, sets preventive guardrails, checks posture continuously and names an owner for every control.
By Hadass Liza Bitton18 min read#guide#cloud-security#shared-responsibility
Guide · November 3, 2026
Operational technology (OT) security protects systems that run physical processes and puts safety and availability ahead of data confidentiality.
By Hadass Liza Bitton17 min read#guide#ot-security#critical-infrastructure
Guide · November 2, 2026
Attack surface management maps every entry point attackers could use. Exposure management tests which ones are exploitable and assigns an owner to each fix.
By Hadass Liza Bitton16 min read#guide#attack-surface-management#exposure-management
Guide · November 2, 2026
Common security awareness training barely changes phishing behavior. Here is what the evidence shows and what to measure, build and report instead.
By Hadass Liza Bitton12 min read#guide#security-awareness#phishing
Guide · October 31, 2026
CIS Controls v8.1 has 18 controls and 153 safeguards in three Implementation Groups. Start with the 56 IG1 safeguards, beginning with asset inventory.
By Hadass Liza Bitton14 min read#guide#cis-controls#security-frameworks
Guide · October 31, 2026
Build a cyber threat intelligence program leaders use: write requirements tied to decisions, deliver to named readers, and measure decisions changed.
By Hadass Liza Bitton16 min read#guide#threat-intelligence#security-operations
Guide · October 31, 2026
Secure by Design, from the Cybersecurity and Infrastructure Security Agency, asks software makers to own security outcomes, not just run DevSecOps pipelines.
By Hadass Liza Bitton15 min read#guide#devsecops#secure-by-design
Guide · October 31, 2026
A third-party risk management program finds, assesses and reduces vendor risk. How NIST SP 800-161, SEC disclosure rules and vendor tiers fit together.
By Hadass Liza Bitton18 min read#guide#third-party-risk#supply-chain-security
Guide · October 30, 2026
The Federal Risk and Authorization Management Program (FedRAMP) checks cloud security for U.S. agencies. Here is the Rev 5 path and what FedRAMP 20x changes.
By Hadass Liza Bitton17 min read#guide#fedramp#cloud-security
Guide · October 30, 2026
Secure access service edge (SASE) is SD-WAN plus SSE under one policy. SSE is the security half, and ZTNA is one SSE part for private app access.
By Hadass Liza Bitton18 min read#guide#zero-trust#network-security
Guide · October 29, 2026
Item 1C examples from real 10-K filings, grouped by the four things Item 106 requires: risk processes, incident effects, board oversight, expertise.
By Hadass Liza Bitton17 min read#guide#item-1c#sec-disclosure
Guide · October 29, 2026
NIST SP 800-53 is a catalog of security and privacy controls in 20 families. Rev. 5 is current, and low, moderate and high baselines sit in SP 800-53B.
By Hadass Liza Bitton15 min read#guide#nist-800-53#security-frameworks
Guide · October 27, 2026
Four active podcasts interview sitting CISOs: CISO Series Podcast, Defense in Depth, The New CISO and Risky Business Features. Hosts, cadence, sponsors.
By Hadass Liza Bitton16 min read#guide#podcasts#security-leadership
Guide · October 27, 2026
A cloud-native application protection platform (CNAPP) checks code, cloud configuration and running workloads in one product with a shared view of risk.
By Hadass Liza Bitton18 min read#guide#cloud-security#cnapp
Guide · October 27, 2026
A chief information security officer (CISO) search can take 15 to 26 weeks or 4 to 6 months, providers say. Interim cover runs 3 to 9 or 6 to 12 months.
By Hadass Liza Bitton18 min read#guide#interim-ciso#ciso-hiring
Guide · October 27, 2026
A virtual chief information security officer is a part-time contracted security lead, quoted at $1,600 to $25,000 a month, wrong for live incidents.
By Hadass Liza Bitton16 min read#guide#virtual-ciso#security-leadership
Guide · October 26, 2026
GRC means governance, risk and compliance run as one program: shared policies, controls and reporting, with clear owners for every risk and control.
By Hadass Liza Bitton18 min read#guide#grc#risk-management
Guide · October 26, 2026
A chief information security officer (CISO) owns information security. A chief security officer (CSO) usually adds physical security and investigations.
By Hadass Liza Bitton14 min read#guide#security-titles#ciso-vs-cso
Guide · October 25, 2026
ISC2 Congress, Black Hat Europe and Gartner's identity summit close out 2026; RSAC 2027 runs April 5 to 8 in San Francisco; the FS-ISAC Spring Summit 2027 is March 14 to 17 in Orlando; ISC2 has not yet set 2027 Congress dates.
By Hadass Liza Bitton16 min read#guide#cybersecurity-conferences#ciso-events
Guide · October 25, 2026
IEC 62443 is a series of standards for securing industrial control systems, built on zones, conduits, security levels and duties for owners and suppliers.
By Hadass Liza Bitton15 min read#guide#ot-security#iec-62443
Guide · October 24, 2026
A business information security officer (BISO) adapts the central security program to one business unit and carries its priorities back.
By Hadass Liza Bitton15 min read#guide#biso#security-leadership
Guide · October 24, 2026
Data security posture management (DSPM) finds sensitive data, classifies it and maps who can reach it. How it works and how to test it.
By Hadass Liza Bitton15 min read#guide#dspm#data-security
Guide · October 23, 2026
A chief information security officer job description asks for one leader who sets security strategy and owns policy, budget and risk decisions.
By Hadass Liza Bitton18 min read#guide#ciso-careers#nice-framework
Guide · October 23, 2026
Most security chiefs report into technology leadership (64%), the rest to business leaders. The five models, their trade-offs and what 10-K filings show.
By Hadass Liza Bitton14 min read#guide#ciso-reporting-line#board-oversight
Guide · October 23, 2026
Average total pay for a US chief information security officer (CISO) was $1,447,000 in the Heidrick & Struggles 2025 survey, down 12% on lower equity.
By Hadass Liza Bitton17 min read#guide#ciso-compensation#executive-pay
Guide · October 23, 2026
Chief information security officers typically stay 2 to 3 years at one company, per IANS, though large enterprise CISOs average 10 years in the role overall.
By Hadass Liza Bitton18 min read#guide#ciso-tenure#ciso-careers
Guide · October 23, 2026
The chief information security officer (CISO) owns cyber risk and the security program; the chief information officer (CIO) builds and runs the systems.
By Hadass Liza Bitton18 min read#guide#ciso-role#security-leadership
Guide · October 21, 2026
Security thought leadership is named, specific analysis from working security leaders, not vendor marketing with a byline. What the buyer-trust data shows, what counts as genuine in 2026, and how CISO Tribune tracks it in Voices.
By Hadass Liza Bitton6 min read#thought-leadership#guide#voices
Guide · October 18, 2026
US disclosure rules put accountability on the company, not a named CISO. EU law goes further, naming the management body itself personally liable. Here is what the SEC's and the EU's own texts say, and what 2026 survey data shows about the gap between being held accountable and being given the authority to match.
By Hadass Liza Bitton7 min read#accountability#guide#sec
Guide · October 13, 2026
37 terms a security leader needs on the record: core threat and defense vocabulary from CISA's NICCS glossary, plus the NIST CSF 2.0 Functions and the SEC's materiality test, each sourced to the primary document.
By Hadass Liza Bitton6 min read#glossary#ciso-role#guide
Guide · October 10, 2026
CISO Tribune read the cybersecurity governance disclosure (Item 1C) in 22 companies' own, freshly filed Form 10-K reports. Only one named its CISO, and that filing was already out of date by the time the person left. Here is what the filings actually say about reporting lines.
By Hadass Liza Bitton9 min read#regulation#sec#guide
Guide · October 9, 2026
What a CISO needs to know about governing AI in 2026: NIST's AI Risk Management Framework (Govern, Map, Measure, Manage), the 12 risks in NIST's Generative AI Profile, and the May 2026 CISA-led joint guidance on agentic AI. Sourced to the primary documents.
By Hadass Liza Bitton7 min read#ai-governance#guide#nist
Guide · October 9, 2026
The two cases every personal-liability conversation cites, SEC v. SolarWinds and the Uber Joe Sullivan prosecution, did not end the way most retellings suggest. What the SEC alleged, what a federal judge dismissed, what a jury convicted, and where both cases stand now, sourced to the actual court and SEC documents.
By Hadass Liza Bitton7 min read#liability#guide#sec
Guide · October 9, 2026
A step-by-step decision aid for the SEC's Item 1.05 materiality call: the reasonable-investor test, why discovery does not start the four-business-day clock, and when an incident belongs under Item 8.01 instead.
By Hadass Liza Bitton8 min read#regulation#sec#guide
Guide · October 8, 2026
What to do in the first 90 days as a new CISO, structured around NIST's Cybersecurity Framework functions and CISA's baseline security practices: assess before you buy, build a risk register boards can read, then report.
By Hadass Liza Bitton6 min read#ciso-role#guide#first-90-days
Guide · October 8, 2026
There is no CISO degree and no single route to the seat. What the certification bodies, career guides and CISO Tribune's own record show about the path: typical prior roles, the certifications that actually come up, and how long it takes.
By Hadass Liza Bitton6 min read#ciso-role#career#guide
Guide · October 8, 2026
What the SEC's 2023 cybersecurity rules actually require: the four-business-day Item 1.05 incident clock, the annual Item 106 governance disclosure that shows up as 10-K Item 1C, and the 2024 guidance narrowing Item 1.05 to material incidents only.
By Hadass Liza Bitton6 min read#regulation#sec#guide
Guide · October 7, 2026
A CISO owns an organization's cybersecurity risk end to end: strategy, the security program, incident response and the board conversation. Sourced to NIST, CISA, Okta, Splunk and IANS Research.
By Hadass Liza Bitton8 min read#ciso-role#career#guide
