What is a deputy CISO? The security chief's second-in-command, defined

A deputy CISO is the second-ranking leader of an organization's security function, acting on authority the chief information security officer delegates, such as running security operations or a defined share of the program, and standing in when the CISO is unavailable. For a board, the role is the internal answer to succession: who runs security if the CISO leaves.

Why it matters to a board

Succession is where a deputy becomes visible outside the company. HubSpot's annual report for 2023, filed on 14 February 2024, disclosed that its CISO would leave on 1 March 2024 and that the deputy CISO would be promoted into the role that day. The filing described the incoming CISO's background: more than 25 years in security and infrastructure, a master's degree in cybersecurity, and a CISSP certification held since 2012.

That level of detail tracks what the SEC asks for. Regulation S-K Item 106 requires a company to say which management positions are responsible for cybersecurity risk and what expertise they bring, and its instructions list prior work experience, degrees and certifications as examples. A named, qualified deputy lets a company answer that question on the day the CISO leaves.

Regulators also expect delegation. New York's Part 500 lets the CISO or a qualified designee review a financial firm's secure-development procedures at least once a year, which is the kind of standing duty a deputy can own.

What it is not

A deputy CISO does not hold the seat. Final accountability stays with the CISO, and CISO Tribune's Wire does not record a deputy appointment as a move in the top security seat; a deputy's promotion to CISO is recorded like any other appointment. The deputy is also distinct from a business information security officer, who is embedded in one business unit, and from an interim CISO, who covers the top seat itself until a permanent appointment.

Where it appears on CISO Tribune

• The deputy CISO: when you need one: what the role should own and how it fails.
• Named successor or empty chair: which CISO exits on the Wire came with a successor already named.
• Company pages: the succession history behind each seat.

Related terms

• Chief information security officer (CISO)
• Interim CISO
• CISO tenure