Security chiefs failing to get the message across

Chief information security officers (CISOs) must work harder to understand the business and articulate in business language if they want to see their security strategy on the boardroom agenda.

The warning came from security certification organisation ISC2 and consultancy PricewaterhouseCoopers (PwC), which launched their Lost in Translation report at RSA Conference Europe 2010 today.

The companies explained that security chiefs are still not communicating well enough with the business, and need to make their proposals "crisp and clear" in business terms, making any threats and risks relevant to their particular organisation.

PwC director William Beer added that CISOs could also benefit from spending five to 10 per cent of their time speaking face-to-face with members of the organisation.

"There are natural allies out there," he said. "Sometimes you don't realise how important your friends in legal, compliance and internal audit actually are. "

Other recommendations include keeping an eye on emerging technologies and threats to head off potential problems before they occur, using analytics if appropriate to "predict and prevent".