Security governance
Importance: Essential (5 of 5)
Sets policy, standards, and program direction, and measures whether controls hold in practice.
← All career guides10 of 10 skills47 of 53 courses
Executive and leadership
Chief Information Security Officer
Owns the security program — risk, policy, compliance posture, and the budget behind them — and is accountable for the risk the organization accepts.
Skill coverage
100%
Course coverage
89%
Skill coverage shows how much of the role's capability map already has a published course. Course coverage shows how much of the mapped course pipeline for this role has shipped.
- Role skills
- 10
- Published coverage
- 10
- Relevant courses
- 47
Capability map
Skills
Importance describes how central each capability is to the role. Course coverage shows where you can build the skill in the current OpenSkills catalog.
01
Security program
4 capabilities
Security frameworks
Importance: Essential (5 of 5)
Applies standards and compliance frameworks to assess posture.
Course coverage
- CIS Controls
- ISO/IEC 27001
- NIST Cybersecurity Framework
- PCI DSS
- Security Controls
- Security Audit and Certification Readiness (planned)
Security risk management
Importance: Essential (5 of 5)
Quantifies security risk and decides what to remediate, transfer, or accept.
Security assurance
Importance: Very important (4 of 5)
Proves controls work through metrics, audit evidence, and independent testing.
Course coverage
- Security Metrics
- Attack Surface Management
- Database Auditing and Compliance
- Security Operations Fundamentals
- Security Patch Management
- Vulnerability Management
- Security Information and Event Management
- Security Audit and Certification Readiness (planned)
02
Compliance and privacy
3 capabilities
Regulatory compliance
Importance: Essential (5 of 5)
Translates legal and regulatory obligations into controls the organization can evidence.
Course coverage
- GDPR for Technology Teams
- ISO/IEC 27001
- PCI DSS
- AI Governance and Compliance
- EU Digital Regulation for Technology Leaders (planned)
Privacy and data protection
Importance: Very important (4 of 5)
Holds the organization to its obligations over personal data, end to end.
Third-party risk
Importance: Very important (4 of 5)
Assesses and monitors the risk carried by suppliers, platforms, and the software supply chain.
Course coverage
- Software Supply Chain Security
- Technology Vendor Management
- Dependency Security
- Open Source Security
- Software Bills of Materials
- Technology Procurement
- Third-Party and Supply Chain Risk Management, Contract and SLA Negotiation (planned)
03
Resilience and leadership
3 capabilities
Crisis management
Importance: Essential (5 of 5)
Leads the organization through breaches and major incidents, including what gets said and to whom.
Course coverage
- Ransomware Defense
- Security Incident Response
- Post-Incident Reviews
- Cyber Crisis Management (planned)
Service continuity
Importance: Very important (4 of 5)
Keeps critical services recoverable through continuity planning and tested recovery.
Board communication
Importance: Essential (5 of 5)
Explains technology bets, risk, and spend to boards and executives in terms they can act on.
Course coverage
- Executive Reporting and Dashboard Design
- Stakeholder Mapping and Influence
- Technical Stakeholder Communication
- Board Communication for Technology Leaders, Cyber Crisis Management (planned)
Learning path
Relevant courses
Core foundations
The concepts this role is built on.
- Business Continuity for IT
- CIS Controls
- Disaster Recovery
- Executive Reporting and Dashboard Design
- GDPR for Technology Teams
- ISO/IEC 27001
- NIST Cybersecurity Framework
- PCI DSS
- Ransomware Defense
- Security Awareness
- Security Controls
- Security Governance
- Security Incident Response
- Security Metrics
- Security Policies and Standards
- Security Program Management
- Security Risk Management
- Software Supply Chain Security
- Technology Risk Management
- Technology Vendor Management
- Board Communication for Technology Leaders, Cyber Crisis Management, EU Digital Regulation for Technology Leaders, Security Audit and Certification Readiness, Third-Party and Supply Chain Risk Management (planned)
Supporting knowledge
Adjacent knowledge that improves day-to-day judgment.
- AI Governance and Compliance
- Attack Surface Management
- Cybersecurity FundamentalsFree
- Data Loss Prevention
- Data Retention
- Database Auditing and Compliance
- Dependency Security
- Identity Governance and Administration
- Open Source Security
- Post-Incident Reviews
- Privacy Engineering
- Privileged Access Management
- Ransomware-Resilient Backups
- Risk Registers and Contingency Planning
- Security Architecture
- Security Operations Fundamentals
- Security Patch Management
- Security Principles
- Software Bills of Materials
- Stakeholder Mapping and Influence
- Technical Stakeholder Communication
- Technology Procurement
- Threat Intelligence
- Threat Modeling
- Vulnerability Management
- Zero Trust Architecture
- Contract and SLA Negotiation (planned)
Specializations
Deeper paths for particular environments or directions.
Put the map to work
Find Chief Information Security Officer roles.
Search multiple job sources at once with queries tailored to this career, then use the skill map above to evaluate what each role actually asks for.