Keeping your information security and cybersecurity programs up to snuff can be difficult for community banks. Having the proper personnel to achieve that goal may be the greatest challenge, particularly in the CISO position.
Maintaining a full-time CISO on staff can be expensive, especially when most community banks only need 30-40 hours per month of this type of specialized work.
Handing the responsibility to other employees can have consequences too. The wearing of many hats means that the designated "ISO" just doesn't have the time or expertise to give information security the attention it deserves.
To address the issue of having an independent and qualified CISO, some community banks are turning to 3rd party relationships for help.
This is often referred to as a Virtual CISO (vCISO): the CISO being a strategic security leader and advisor, and virtual meaning that it's not a conventional in-house employee.
While a Virtual CISO is not for everyone, more and more community banks are finding it to be an affordable way to strengthen and enhance their Information Security Programs.
You don't have to outsource the decision making and acceptance of risk, and you really shouldn't as a long term solution. What the vCISO role offers is outsourced guidance and advisory services at the proper level for your organization.
One solution that I've found to be a nice "middle ground" is to create an in-house information security committee. Your vCISO would provide the necessary services to give that committee the proper support, and in turn, the committee responsible for oversight and final decision-making.
While the ideal situation is that every bank would have an in-house full-time CISO, we all know that is not always an option. Examiners understand the challenges that banks face when filling this role and know that banks are looking for help in unconventional areas.
While I would love to work with you forever, I know that is not always the best for you, the client. My services are designed with an educational base, and can be structured in a way that you and your staff become less dependent on the vCISO role as time goes on (if that's your ultimate goal).
If this is a concern for you and you'd like to eventually be self-sustaining in the CISO role, ask me about my "step down" approach to gently transition over the course of a multi-year engagement.
Read through our whitepaper, 14 Things Banks Should Consider Before Hiring a Virtual CISO.
Set up an informal chat on the fit at your organization
We will discuss if the vCISO concept is right for you, and what your long-term goals are. This service is not for everyone, but for those with this specific need, a vCISO can make a big impact on your information security program at an affordable cost.
For more info, please visit our LinkedIn Page or you can email us at support@bedelsecurity.com.
