Chief Technology Officer/Chief Information Officer (CTO) – The CTO, also known as CIO, is the head of the company’s technical assets

The CTO’s focus should be on making certain that the Enterprise is running as smoothly as possible and it set up to support the key business objectives.  Depending on the size of the company, the departments under the CTO umbrella have a wide range of responsibilities that have some aspect of building and supporting electronic products and/or business processes. In a nutshell, the CTO is the person that translates the executive plans for the company into “technical speak” and controls how the IT related staff works to support those executive plans.

Chief Information Security Officer (CISO – sounds like See So) – The responsibility of this position is the integrity of the technical systems

The CISO, in most situations, will report to the CTO.  IT Security is the primary driving point of this person/department.  Again, depending on the size of the company the title may change some (Director of IT Sec, VP of Cybersecurity, etc.), but the function will remain the same.  A number of companies I work with also “outsource” some of the work to internal operations or third-party companies to manage the day to day efforts, while serving in an oversight and advisory manner.  The where and how the work get’s done is less important than making sure that it is done correctly.  This group also tends to be the primary point of contact when working with external auditors/assessors on compliance related efforts.

Data Privacy Officer (DPO) – Tasked with representing the customer’s interest within the environment

This position is a relatively new position that is quickly becoming one of, if not the most important leadership position in the enterprise.  It also has a much different approach to the focus of their mission.  The Data Privacy Officer’s main focus is on the integrity and management of the customer data.  I know what you may be thinking right now.  “Didn’t you just say that was the job of the CISO?” Well, yes.  I did say something similar to that.  Let us look again.  The DPO’s main focus is on the integrity and management of the CUSTOMER DATA.  There are two subtle differences in the approach between a CISO and DPO.

1. Customer Data – The DPO’s approach is that as a representative of the customer.  Their job is to make certain that the company isn’t doing anything that places the customer at risk or acts in a way that is outside of the agreed upon terms between the company and the customer that provided their personal data.  This is a direct response to the focus of privacy acts and regulations popping up around the globe, such as GDPR (EU Privacy) and CCPA (California) and the expectation of many more governments passing similar laws.
2. Hierarchy – Typically the DPO is outside of the IT department.  While they are a technical resource, and require technical knowledge to do their job properly, due to the nature of them being a voice on behalf of the customer they usually report outside of IT to avoid conflicts or internal pressure that may sway them from doing their job correctly out of fear of losing it.  In larger companies the DPO will report to the legal department.  In companies that don’t have legal departments in house, they can also report directly to the President/CEO.  Of course, that does not mean there is a need to do a reorg if this isn’t how you have the structure within your company.  If things are working well and the DPO is a Rockstar – then don’t fix something that isn’t broken.

conclusion – What does this mean for the data privacy needs of your organization? 

To be honest, I cannot give a specific answer on that (without talking to you.)  My best suggestion would be to have the round table discussion with the leadership of your company and confirm that you have someone that is designated as the “voice of the customer” and get them trained on how the relevant security regulations will affect your business operations.  You can also hire a DPO.  According to Glassdoor, the average salary for a DPO (as of Sep 2022) is right at $113,000, ranging up to $277,000.  This is a national average, so cost will vary drastically based on the market.  You can also hire consultants if looking to save money on annual spending.  You could probably get a good privacy consultant for a third of the cost of a full time DPO, that can work with  your IT and HR leadership to build, design, and implement your privacy program in a compliant manner across all areas you are doing business.

As always, if you have any questions reach out to us via social media or the contact information listed on the website.

Thanks for reading.  Talk to you soon!

Shawn Adams – @TBF_shawn (twitter)

The post Decluttering the IT Sec Alphabet for Data Privacy appeared first on Shawn's Blog.