The higher education CISO role inside a research university: Stanford's Amy Steagall

Where the CISO sits in University IT

Stanford's University IT (UIT) leadership page describes a leadership team built around the Chief Information Officer. The page says the team includes the CIO and the heads of the units that report directly to him. Amy Steagall, the Chief Information Security Officer, is listed among those unit leaders.

Her reporting structure has two lines. The leadership page states that she answers both to the CIO and to the university's risk function. The same page describes the arrangement from the CIO's side, saying Gallagher shares leadership of two groups.

Research Computing has a comparable shared arrangement, according to the page. Its executive director, Ben Rogers, is described as answering to both the research administration and the CIO. In Stanford's structure, then, security and research computing each sit inside UIT while also reporting to a university office outside IT.

The CIO's own reporting line is set out on the same page. The page also notes that the CIO sits at the university's senior leadership table and co-chairs a campus technology body. Steagall's interview, discussed below, was published by Stanford's IT Community site as part of its "Conversations with the CIO Council" series.

What the Information Security Office covers

Both documents give the same description of the office Steagall runs. The leadership page and the IT Community profile say the Information Security Office has two jobs: protecting assets and meeting legal and policy obligations.

In her interview, Steagall ties that work to the university's academic purpose. She describes the office's mission as supporting research and teaching. She also says the aim is to let people work securely without being held back by security.

She refers to the people the office serves as customers and names three groups: faculty, staff and students. She describes education and outreach as part of the office's work, calling protection of these groups the "first line of defense."

Background: a military career before higher education

Steagall came to the university from the military rather than from another campus. The leadership page says she joined Stanford in 2020 after a long Air Force career.

The page describes her last military post as a cyber command role.

Her education, as listed on the leadership page, combines security management and law. In the IT Community interview, she describes that law degree as still in progress at the time she spoke.

The leadership page shows that other members of the team took different routes. The CIO, according to the page, held CIO posts at Harvard Business School and the University of San Francisco and earlier worked in venture capital and financial technology. Other unit heads came up through finance, enterprise systems or research computing, several of them within Stanford itself. Steagall is the only member whose listed background is military.

Priorities she named for the next two to three years

Asked about her goals, Steagall put measurement and efficiency first. She said the purpose of those metrics is to inform senior leadership.

She described cloud security as a multi-provider problem.

She also named zero trust as a continuing program, starting with endpoints. She said that work includes authentication and the university's baseline standards, carried out with other parts of the institution.

The last item on her list was user education. She said the office plans awareness and outreach programs "designed to reach our customers where they are."

Challenges and working conditions

Steagall named two challenges and described them as expected. She added that she sees them as opportunities as well as challenges.

She describes her leadership approach in a short phrase. She says she sees her job as protecting her team's personal goals and making sure they have the resources to do their work.

She was also direct about hours. She explains that classified military work kept a clear line between the job and home, while at Stanford the work goes wherever she goes. She says she has to make a deliberate effort to switch out of the CISO role at the end of the day.

What she tells IT staff about careers

The interview closes with her advice to early and mid-career IT staff at Stanford. She begins with the shape of a career.

She describes a phrase her team hears from her and explains what it means. She tells staff to use those assignments to build new skills and to "always leave it better than you found it."

She also lists the habits she connects with success, including asking for help and offering it. She closes by urging staff to take mental health breaks without guilt.

Taken together, the two Stanford documents describe a CISO who heads one of the CIO's direct-report units and also reports to the Chief Risk Officer. Her office is charged with both protection and compliance. She arrived after 25 years in the Air Force, and her stated near-term work covers metrics, cloud controls, zero trust, authentication standards and user education.