CIO Cyber & Risk Network

A vendor independent forum to learn from and share with your peers

"I'd like to thank you for a fantastic discussion regarding cyber security, the discussion was facilitated very well."

The CIO Cyber & Risk Network Mandate:

To provide CIOs in Australian organisations with a forum in which to share their issues and approaches to cyber security and risk. The intended outcome is that organisations make better informed decisions to help protect their organisations, staff, customers and the economy.

Introduction

Not all Australian organisations are fortunate enough to have a Chief Information Security Officer. But not having a CISO doesn’t mean the challenge of managing cyber risk goes away. IBRS clients have been telling us that the frequency with which they are being asked to report on cyber security to their boards has increased. Now, four times a year is the minimum, and the board members are asking better, more in-depth, questions. The CIO Cyber and Risk Network is a vendor independent forum for CIOs to share with and learn from each other.

Benefits

Through interaction with your peers, gain an understanding of effective security practices.
Save time and effort by sharing policies, frameworks and security literature.
Discuss vendors and services from people who are using them or have moved on from them.
Discuss different approaches to security.
Raise ideas, challenges and solutions to the network of CIO's to provide their independent thoughts and advice.

Format

4 gatherings per year. Each gathering will be for 5 hours; 4 hours as a formal facilitated discussion and a 1 hour informal session which is an opportunity for the CIOs to have the 1:1 and small group conversations to follow up to the formal session.
IBRS will facilitate each gathering.
IBRS will also coordinate any external guests.
All gatherings are closed door, and held under the Chatham House Rule.
A summary of findings is distributed after each gathering.
Participate in a distribution list of like minded CIOs.
Should a CIO not be available to attend a gathering, sending a direct report is possible but discouraged. If direct reports are sent too often, as determined by the group, the CIOs’ invitation to participate may be withdrawn and no refund will be offered.

About the Moderator

James Turner w114 h140

James Turner is the founder of CISO Lens and has specialised as a security industry analyst and advisor since 2005. James is IBRS alumni and was an advisor for IBRS from 2007-2018, and now facilitates the CIO Cyber & Risk Network on behalf of IBRS. James gathers, curates and disseminates information that is of strategic importance to the cyber risk management of Australia and New Zealand’s largest organisations. James publishes the CISO Lens Benchmark, an annual report providing independent, local and current data on budgets, team sizes and security functions and strategy. James also writes opinion pieces on strategic cyber matters for The Australian Financial Review.

Highlights

CIO Cyber & Risk Network March 2020

The Cyber and Risk Network March gathering focused on the following areas:

1. Supply chain risk. This discussion revolved around the impact of both security incidents as well as interruptions due to natural disasters, and drew on both local and international examples.

2. The labour overhead to get many security products to work, and a CIO's need for these security tools to be quieter. "Investigating one false positive is still incredibly expensive in terms of time".

3. Ransomware preparation and business continuity issues. The CIO should be best placed to help their business understand its critical dependence on technology.

4. What to expect from vCISO & “CISO-as-a-Service”. It's (hopefully) better than nothing, but unless they have accountability and skin in the game, they're a security consultant.

5. Cyber insurance; market trends, exemptions and expectations.

Testimonials

"At the February 2019 gathering, the CIOs had one particular conversation about the new Australian mandatory breach notification scheme that saved me weeks of work and thousands of dollars. It's an important area for me and I got the value of the annual membership right there."

Global CIO

“Our first Cyber & Risk Network meeting justified the participation time and energy. Networking and experience sharing is critical in cyber risk management, and getting first hand feedback and input for phishing simulation tools allowed us to make a better solution choice.”

APRA regulated CIO

CIO Cyber & Risk Network Schedule

June 3rd 2020 - Sydney