Appointing a first part-time CISO is a sensible step for a mid-sized organization that needs executive security leadership without a full-time hire. Yet the virtual CISO mistakes Saudi Arabia boards and CEOs see most often are rarely about the individual. They come from a mandate that was never written, or was written so loosely that nobody could act on it.
This article describes five common mistakes and gives a short "do this instead" for each. It closes with a one-page mandate outline you can draft before the engagement begins.
Mistake 1: No reporting line to the board
A part-time CISO who reports only to the IT head is in a structural conflict. Security findings about IT operations travel upward through the very function they criticize, and the board hears a softened version or nothing at all. Regulators such as SAMA and the NCA expect security governance to have visibility at senior level, and a reporting line that stops at IT does not give that.
Do this instead: state in the mandate that the CISO reports to the board or a named board committee, with a direct line to the CEO between meetings. Fix the rhythm in advance, for example quarterly reports in business terms, and name who receives them.
Mistake 2: No decision rights
Many organizations appoint a CISO and then require every policy, control change or risk acceptance to be approved elsewhere. The result is an adviser with a title but no authority, and accountability that sits with nobody.
Do this instead: list the decisions the CISO can take alone, the decisions the CISO recommends and others approve, and the decisions reserved for the board. Typical items to place on that list:
- Approval of security policies and standards
- Acceptance of risks below an agreed threshold
- Authority to require remediation from system owners
- Authority to escalate an incident to the CEO or board
- Sign-off on security requirements for new projects and vendors
Where the CISO is to be accountable, say so plainly. Accountability without authority is the most common cause of disappointment on both sides.
Mistake 3: No budget visibility
A CISO who cannot see what is spent on security, or influence what is requested, cannot be held to a strategy. Budget often sits across IT, procurement and business units, and the part-time CISO is shown none of it.
Do this instead: give the CISO read access to security-related spend and a defined role in the annual budget cycle. The mandate does not need to grant spending authority. It should require that the CISO's recommendations are tabled with the budget and that rejected items are recorded with the risk accepted as a result. That record is itself valuable to the board.
Mistake 4: No defined link to the regulator
For organizations supervised by SAMA or subject to NCA controls, someone must own the conversation with the regulator: assessment preparation, evidence, findings and follow-up. When this is undefined, correspondence is handled by whoever answers first, and commitments are made that nobody tracks.
Do this instead: decide who represents the organization to each regulator and in what capacity. Ask whether the CISO may be named in regulatory submissions, which is possible only where the regulator permits it, and agree the scope of that accountability in writing before the engagement starts. Also define who signs off on responses to findings and who tracks closure.
Mistake 5: Vague time commitment and success measures
"Part-time" means different things to different people. Without a stated commitment, the CISO is either unreachable during an assessment or resented for time spent on routine work. Without success measures, the board cannot tell after twelve months whether the engagement worked.
Do this instead: agree a fixed number of days each month, state how it increases during assessments or incidents, and review it quarterly. Then choose a small set of measures the board can follow, such as:
- A security strategy and roadmap approved by the board
- A policy framework in place and aligned to the relevant SAMA and NCA requirements
- A risk register with owners and treatment dates
- Regulatory findings tracked to closure
- A handover plan ready if a permanent CISO is to be appointed
Choose measures of delivery and governance rather than counts of tools or alerts. They are easier to verify and harder to misread.
The one-page mandate
If you can fit the following on one page, the engagement has a sound start. Write each heading and complete it before contracting.
- Purpose and scope: the entities, systems and regulators covered.
- Authority: decisions the CISO takes, recommends or escalates.
- Reporting: to whom, how often, in what form, and the route for urgent matters.
- Budget visibility: what the CISO can see and how recommendations are tabled.
- Regulatory role: who represents the organization, and whether the CISO is named in submissions.
- Time commitment: days each month, how this flexes, and the quarterly review.
- Success measures: the small set the board will track.
- Term and handover: length of engagement and how responsibility passes to a permanent appointee.
Have the board or committee chair approve the page, not only the CEO. That approval is what gives the role standing with staff, auditors and regulators.
How CISO Consulting can help
Our Virtual CISO & Security Leadership service is built around the points above. An experienced CISO leads your security function, reports to your board and represents you to regulators.
The engagement is an ongoing retainer, typically 12 months. Deliverables include a cybersecurity strategy and three-year roadmap, a policy framework and governance charter, quarterly board and committee reports, a risk register and treatment plan, and regulatory correspondence and assessment support. The strategy and policy framework are aligned to SAMA and NCA, and reporting is in clear business terms. If you appoint a permanent CISO, we plan the handover.
On time, the days are agreed at the start and reviewed quarterly, usually a fixed number each month, with more during assessments or incidents. On regulatory submissions, we agree the scope of accountability in writing before the engagement begins.
If you are preparing to appoint your first part-time CISO, we can help you draft the mandate before anything is signed.
