The CISO position in a healthcare organization is typically created with a great deal of responsibility, without providing an appropriate level of authority. To be effective, the CISO must over time, acquire a power base to effectively exert influence over the organization and build an adaptive cybersecurity program that reduces risk to acceptable levels while operating within a reasonable annual budget. This presentation will discuss various forms of organizational and personal power that a CISO can seek out to build a base of power from which to draw upon to influence the people, process and initiatives required for an effective cybersecurity program.

Learning Objectives:

1. Describe ways in which power can be garnered to advance the CISO’s ability to influence others in the organization

2. Implement activities that can increase power where little formal authority is given by the organization.

3. Employ politics to advance cybersecurity agendas while supporting their organizational mission.

Toby Gouker, PhD, GSLC, Graduate Program Director, Technical Management, University of Maryland, Baltimore County; also VP of Strategy, First Health Advisory Solutions