CISO Hannah Suarez: Cyber Risk Management Must Start with the Business
Summary
CISO Hannah Suarez says organizations should align cybersecurity with business priorities, clarify cloud and supplier responsibilities, and select framework controls based on risk rather than treating compliance as a checklist.
Key points
- Suarez advises CISOs to understand business priorities and assign clear ownership for risks and controls.
- For cloud services, organizations should establish who operates each component and who is responsible for compliance and security.
- She recommends choosing framework controls based on business risk and ISMS needs to avoid framework-driven compliance fatigue.
- She identifies supply-chain vulnerabilities as an urgent concern, including suppliers' plans to use sensitive data in AI models.
- She urges executive involvement and a clear understanding of vendors, suppliers, and operators.
- She says compliance programs can help startups build trust with enterprise customers, while risk management should support business growth.
Article Details
- Topic
- CISO perspectives on business-aligned cyber risk management, cloud responsibility, compliance frameworks, and supply-chain risk.
People
Industries
AviationHaving worked across several industries—including telecommunications, aviation, and software startups—and across multiple international markets, Hannah understands that effective cyber risk management is not just aboutsoftware startupsHaving worked across several industries—including telecommunications, aviation, and software startups—and across multiple international markets, Hannah understands that effective cyber risk management is not just aboutTelecommunicationsHaving worked across several industries—including telecommunications, aviation, and software startups—and across multiple international markets, Hannah understands that effective cyber risk management is not just about