Security governance
Importance: Essential (5 of 5)
Sets policy, standards, and program direction, and measures whether controls hold in practice.
← All career guides10 of 10 skills53 of 54 courses
Executive and leadership
Chief Information Security Officer
Owns the security program — risk, policy, compliance posture, and the budget behind them — and is accountable for the risk the organization accepts.
Skill coverage
100%
Course coverage
98%
Skill coverage shows how much of the role's capability map already has a published course. Course coverage shows how much of the mapped course pipeline for this role has shipped.
- Role skills
- 10
- Published coverage
- 10
- Relevant courses
- 53
Capability map
Skills
Importance describes how central each capability is to the role. Course coverage shows where you can build the skill in the current OpenSkills catalog.
Security governance: 7 more courses
Security frameworks: 3 more courses
Security risk management: 2 more courses
Security assurance: 5 more courses
Regulatory compliance: 2 more courses
Privacy and data protection: 1 more course
Third-party risk: 5 more courses
Crisis management: 1 more course
Board communication: 2 more courses
Chief Information Security Officer capability map
- Chief Information Security Officer
- Security program
- Compliance and privacy
- Resilience and leadership
01
Security program
4 capabilities
Security frameworks
Importance: Essential (5 of 5)
Applies standards and compliance frameworks to assess posture.
Course coverage
- CIS Controls
- ISO/IEC 27001
- NIST Cybersecurity FrameworkFree
- PCI DSS
- Security Audit and Certification Readiness
- Security Controls
- SOC 2 Compliance (planned)
Security risk management
Importance: Essential (5 of 5)
Quantifies security risk and decides what to remediate, transfer, or accept.
Security assurance
Importance: Very important (4 of 5)
Proves controls work through metrics, audit evidence, and independent testing.
02
Compliance and privacy
3 capabilities
Regulatory compliance
Importance: Essential (5 of 5)
Translates legal and regulatory obligations into controls the organization can evidence.
Privacy and data protection
Importance: Very important (4 of 5)
Holds the organization to its obligations over personal data, end to end.
Third-party risk
Importance: Very important (4 of 5)
Assesses and monitors the risk carried by suppliers, platforms, and the software supply chain.
03
Resilience and leadership
3 capabilities
Crisis management
Importance: Essential (5 of 5)
Leads the organization through breaches and major incidents, including what gets said and to whom.
Service continuity
Importance: Very important (4 of 5)
Keeps critical services recoverable through continuity planning and tested recovery.
Course coverage
Board communication
Importance: Essential (5 of 5)
Explains technology bets, risk, and spend to boards and executives in terms they can act on.
Learning path
Relevant courses
Core foundations
The concepts this role is built on.
- Board Communication for Technology Leaders
- Business Continuity for IT
- CIS Controls
- Cyber Crisis Management
- Disaster RecoveryFree
- EU Digital Regulation for Technology Leaders
- Executive Reporting and Dashboard DesignFree
- GDPR for Technology Teams
- ISO/IEC 27001
- NIST Cybersecurity FrameworkFree
- PCI DSS
- Ransomware Defense
- Security Audit and Certification Readiness
- Security Awareness
- Security Controls
- Security GovernanceFree
- Security Incident ResponseFree
- Security Metrics
- Security Policies and Standards
- Security Program Management
- Security Risk Management
- Software Supply Chain Security
- Technology Risk Management
- Technology Vendor Management
- Third-Party and Supply Chain Risk Management
Supporting knowledge
Adjacent knowledge that improves day-to-day judgment.
- AI Governance and ComplianceFree
- Attack Surface Management
- Contract and SLA Negotiation
- Cybersecurity FundamentalsFree
- Data Loss Prevention
- Data Retention
- Database Auditing and Compliance
- Dependency Security
- Identity Governance and Administration
- Open Source Security
- Post-Incident Reviews
- Privacy Engineering
- Privileged Access Management
- Ransomware-Resilient Backups
- Risk Registers and Contingency Planning
- Security Architecture
- Security Operations Fundamentals
- Security Patch Management
- Security PrinciplesFree
- Software Bills of Materials
- Stakeholder Mapping and Influence
- Technical Stakeholder CommunicationFree
- Technology Procurement
- Threat IntelligenceFree
- Threat Modeling
- Vulnerability Management
- Zero Trust Architecture
- SOC 2 Compliance (planned)
Specializations
Deeper paths for particular environments or directions.
Put the map to work
Find Chief Information Security Officer roles.
Search multiple job sources at once with queries tailored to this career, then use the skill map above to evaluate what each role actually asks for.