Should Cybersecurity Leadership Finally be Professionalized?

Professionalization could be a solution to the increased cybersecurity risk for corporate and national security; and the mental health and even physical liberty of CISOs. But it’s not easy.

Professionalization for cybersecurity leadership has long been mooted but never actioned. Times are changing. The CISO role has expanded and become critical for both individual companies and national security. Threats to personal mental well-being have escalated, and CISOs can be held criminally liable for corporate security failures.

In 2013, the National Research Council (NRC) published Professionalizing the Nation’s Cybersecurity Workforce? Criteria for Decision-Making. The NRC’s conclusions were negative: cybersecurity is too dynamic to establish a baseline of requirements; the knowledge and competencies required are too extensive to allow professionalization; and in an age of cybersecurity skills shortage, professionalization could provide additional barriers for entry.

Within two years, Martin Zinaich (CISO ...