The Rise of the BISO Role

### Overview In this presentation, Manuel Chowrimootoo, Business Information Security Officer (BISO) at Cogeco Communications, discusses the emergence and practical implementation of the BISO role. After joining a newly formed 15-person corporate cybersecurity team in January 2020 under the CISO's leadership, Chowrimootoo was tasked with building awareness, establishing a service catalog, and operationalizing cybersecurity as a service across disparate business units and corporate departments. The session outlines the mandate, operating structure, procedural developments, and lessons learned from establishing the BISO function from the ground up.

### Key Topics - **Understanding the BISO Mandate**: Defining the BISO as an enabler and operational bridge between centralized security and business units, contrasting with the CISO's strategic focus. - **The Cyber Roadshow**: Launching introductory tours across corporate functions (legal, procurement, internal audit, project management) to understand people, processes, and tools. - **Operationalizing Cybersecurity as a Service**: Evolving from informal spreadsheets and shared mailboxes to formalized request forms, structured intake workflows, and resource allocation tracking. - **Risk Management Integration**: Partnering directly with internal audit, enterprise risk, and governance teams to identify critical findings and prioritize remediation. - **Demonstrating Value**: Generating qualitative and quantitative reporting, such as tracking effort hours, maintaining status dashboards, and setting formal delivery timelines.

### Technical Details & Operational Mechanics - **CISO vs. BISO Division**: The CISO operates at a strategic tier, collaborating with executive committees (e.g., Audit Committee, VP of Internal Audit, CIO, CTO). In contrast, the BISO operates at the tactical and operational layer, working directly with audit directors, individual auditors, and business unit IT architecture and operations teams to close specific findings. - **Service Request Evolution**: Initial intake relied on a general mailbox, phone numbers, and an Excel template. As volume grew and services stabilized, this was decommissioned in favor of user-friendly electronic forms featuring prebuilt drop-down menus tailored to known service offerings. - **Service Offerings**: Core delivered services included architectural reviews, scans for PCI compliance, third-party vendor reviews, and log monitoring. - **KPIs and Metrics**: To avoid the early pitfall of "best efforts" SLAs, the team formalized timelines once sufficient operational data was captured. For example, security opinions were benchmarked to an average delivery turnaround of two weeks. - **Reporting Structure**: Reporting was tailored by audience—executive-level views used red/yellow/green indicators for red flags, while business unit managers received weekly or twice-weekly updates covering open project statuses, effort hours, and deadlines.

### Takeaways - **Interpersonal Over Technical Skills**: The BISO role requires wearing multiple hats (negotiator, project manager, security advocate) and communicating effectively across different domains, from corporate attorneys to infrastructure engineers. - **Avoid Over-Promising**: Relying on unmeasured commitments leads to dissatisfaction; teams should capture performance metrics before cementing firm delivery timelines. - **Senior Leadership Backing**: Explicit alignment with CISO and CTO strategic plans, paired with executive sponsorship, ensures the BISO is accepted onto critical decision-making committees. - **Actionable Steps for Organizations**: Within the first few weeks, identify designated cybersecurity contacts and obtain the cybersecurity service catalog and policy documentation. Within three months, review policies, address gaps, and confirm formal communication channels for requesting security engagements.