Glossary
What is an interim CISO? Covering the security seat between chiefs, defined
An interim CISO runs the security program between one chief's exit and the next one's start. Why the seat must be filled, how it differs from acting or fractional.
An interim CISO is the person who runs an organization's security program for a defined period after the permanent chief information security officer (CISO) leaves and before a successor starts. The role can go to an internal deputy, to an executive who adds it to existing duties, or to an outside security executive hired for a fixed engagement.
Why the seat cannot simply stay empty
For many regulated firms the CISO is a legal requirement, not an option. New York's 23 NYCRR Part 500 states that each covered financial entity shall designate a CISO, who may be employed by the firm, an affiliate or a third-party service provider. The Federal Trade Commission's Safeguards Rule requires covered businesses to designate a "Qualified Individual" to oversee their information security program. A departure therefore leaves an obligation that someone has to cover.
Public companies face a disclosure angle as well. Item 106 of Regulation S-K asks which management positions are responsible for cyber risk and what expertise those people bring. When the seat is vacant at filing time, the annual report describes whoever holds it, which is how interim and acting CISOs come to appear in 10-K filings at all.
Interim, acting and fractional
The three words describe different arrangements. An acting CISO is usually an existing employee doing the job alongside their own. An interim CISO holds the seat for a set period, often with a brief to stabilize the program and hand it over. A fractional CISO is a standing part-time arrangement with no vacancy behind it. When the interim comes from outside, both regulators above keep accountability with the firm: it must retain responsibility for compliance and name a senior person to oversee the provider.
What it means in a career
For a deputy, an interim stint is a public trial run for the permanent job, and some of the routes traced in this site's career-path studies pass through a number-two role before the top seat. For an outside executive, interim work can become a career of its own, moving between organizations at the point of transition. Either way, the interim period marks the end of one person's tenure and the start of a search.
Where it appears on cisospotlights.com
- The interim and acting CISO record, which collects filings that name a temporary security leader, with no view on why a seat fell vacant.
- The tenure record, for the runs that end in those vacancies.