Mastering the CISO Maturity Model

Mastering the CISO Maturity Model

Speakers: Derek Cheng, CISO, Deliveroo

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=lEGyxTr5Ajo

Overview

In "Mastering the CISO Maturity Model," Derek Cheng, the distinguished CISO of Deliveroo, unveils a largely unknown yet profoundly impactful framework that defines the various stages of a Chief Information Security Officer's role within an organization. Introduced to Cheng seven years prior, this model, originally developed by executive recruiters, serves as a critical tool for companies to identify the specific type of CISO they require and for security leaders to strategically navigate their career trajectories. Cheng’s insightful presentation demystifies this model, offering a candid look at how he has leveraged it across his extensive 27-year career in cybersecurity.

The talk transcends a mere academic explanation, providing practical, real-world examples from Cheng's CISO tenures at Electronic Arts (EA), TalkTalk, and Deliveroo. He meticulously maps his experiences to the model's five levels, illustrating the nuances of reporting structures, stakeholder engagement, and strategic influence that differentiate each stage. By sharing his personal journey and the specific questions he employs during job interviews, Cheng empowers current and aspiring CISOs to assess their current roles, identify pathways for professional growth, and effectively communicate security's value beyond the traditional IT silo. This article will delve into the intricacies of the CISO Maturity Model, its practical applications, and the defensive implications for organizations striving to elevate their cybersecurity leadership.

Background

▶ Watch: Introduction and personal CISO journey highlights (0:00)

The genesis of the CISO Maturity Model lies in the nuanced demands of executive recruitment. Executive search firms, tasked with finding suitable CISOs for diverse organizations, recognized a fundamental challenge: the title "CISO" masks a wide spectrum of responsibilities, reporting lines, and strategic influence. A CISO for a startup differs significantly from one at a multinational corporation, or one in a highly regulated industry versus a rapidly evolving tech firm. To address this, leading executive search companies developed a standardized CISO Maturity Model, typically ranging from one to five levels, to better categorize the role's scope and required experience. This framework allows them to match client needs with candidate profiles more precisely and, crucially, to benchmark compensation.

Despite its utility in the executive search world, the model remains largely unfamiliar to many CISOs themselves. Derek Cheng's discovery of this model seven years ago marked a pivotal point in his career. With 27 years in cybersecurity, starting as an ethical hacker at Ernst & Young, transitioning through Deloitte's security and privacy practice, and holding his first global CISO role at Electronic Arts (EA) for eight years, Cheng possessed a wealth of experience. His journey continued through a challenging post-breach CISO role at UK telecommunications giant TalkTalk (following their significant 2015 data breach) and currently as CISO at Deliveroo, a role he joined during its IPO and has grown the security department from three to 68 people, recently navigating an acquisition by DoorDash. This extensive background provided Cheng with a unique lens through which to validate and apply the CISO Maturity Model. He emphasizes that the model primarily reflects where the company positions the CISO role, rather than solely the individual's inherent skill set, a crucial distinction often overlooked by security professionals.

Key Findings

▶ Watch: Deep dive into CISO Maturity Model levels 1-5 (4:00)

The CISO Maturity Model, as presented by Derek Cheng, delineates five distinct levels of CISO roles, each characterized by specific reporting structures, spheres of influence, and strategic engagement. A striking observation from the model is the current landscape of CISO roles, particularly in the UK. Cheng's headhunter revealed that approximately 70% of CISOs in the UK operate at Level One, indicating a significant prevalence of foundational security roles. Conversely, Level Five CISOs are exceedingly rare, with the vast majority observed in the United States, highlighting a global disparity in strategic cybersecurity leadership.

The five levels are:

• Level One: The IT Problem. At this foundational stage, cybersecurity is predominantly perceived as an IT issue. The CISO typically reports directly to a CIO and exerts influence primarily within the IT function. The work is often transactional and audit-driven, focusing on compliance and immediate technical remediation rather than broader strategic risk.
• Level Two: Beyond IT. Here, the organization begins to recognize cybersecurity as more than just an IT concern. The CISO starts engaging with stakeholders outside of IT, such as the people (HR) team, finance, legal, and privacy departments. They may contribute materials for board or audit committee updates, acting in a more relational and reactionary capacity, with a growing awareness of Governance, Risk, and Compliance (GRC) and risk management principles. Cheng categorized his CISO role at EA, despite leading an 80-person team, as a Level Two due to reporting lines and limited strategic involvement.
• Level Three: Strategic Influencer. As a CISO reaches Level Three, they develop stronger relationship skills and become more comfortable and regular in their engagement at the board level. This role is characterized by a change-oriented mindset, fostering innovation and cultivating relationships with industry peers. A deep understanding of the company's risk appetite becomes a critical component of their function. Cheng positioned his post-breach CISO role at TalkTalk and his current role at Deliveroo at Level 3.5, indicating significant advancements beyond the foundational stages.
• Level Four: Critical Decision Maker. At this stage, the CISO's role becomes highly strategic, involving them in critical and highly confidential business decisions, such as Mergers & Acquisitions (M&A). Their input is sought and valued in shaping the company's future and managing associated risks.
• Level Five: Trusted Advisor. The pinnacle of the CISO maturity model, a Level Five CISO is a trusted advisor to the executive team, often reporting directly to the CEO. They provide regular, high-level updates to the board and are considered prime candidates for Non-Executive Director (NED) roles, signifying their deep integration into the company's overall strategic governance.

A pivotal insight from Cheng is the emphasis that the model assesses where the company places the role, not the individual's inherent capabilities. An exceptionally skilled CISO might still find themselves in a Level One role if the organization's culture and structure dictate that placement. This distinction is crucial for CISOs to avoid taking their role's maturity level personally and instead focus on understanding the organizational context.

Technical Deep Dive

▶ Watch: Mapping personal CISO roles to the maturity model (6:40)

While the CISO Maturity Model itself is a strategic and organizational framework, its application necessitates deep engagement with technical, operational, and governance aspects of cybersecurity. Moving through the maturity levels involves significant shifts in reporting structures, the scope of influence, and the integration of security into core business functions.

At Level One, security often functions as a reactive technical support unit, primarily focused on patch management, basic network security, and addressing audit findings. The CISO’s influence is limited to the IT department, meaning security initiatives are often driven by technical mandates rather than strategic business objectives.

Transitioning to Level Two and beyond, the CISO's mandate expands dramatically. Derek Cheng's experiences vividly illustrate this evolution. At EA, despite a large team of 80, the CISO role was assessed as Level Two due to reporting to a CIO (who reported to a CTO) and a lack of involvement in critical business decisions like M&A or studio closures. Security was primarily reactive to these events, highlighting a disconnect from strategic planning. The security function focused on strong security risk management but was not yet integrated into the highest levels of corporate strategy.

The shift at TalkTalk post-data breach exemplifies a rapid leap in maturity. Prior to Cheng’s arrival, the company was arguably at Level 1.5, with no official CISO role, a Director of Security reporting to the CTO, and a reliance on an ineffective Managed Security Service Provider (MSSP). The data breach forced a fundamental re-evaluation. Upon joining, Cheng established an official CISO role, reporting directly to the COO, a crucial change that elevated security to a peer level with the CTO. This structural change enabled him to migrate away from the MSSP model and build a 24x7 Security Operations Center (SOC), a significant operational improvement. Furthermore, Cheng instituted a bi-monthly PLC security board and a monthly security committee, ensuring regular, high-level visibility. His involvement in "restricted projects," such as redundancies and the sensitive Huawei security debacle (requiring DV clearance, one level higher than top secret in the UK), demonstrated a profound integration into national security and critical business decision-making. The culmination of this maturity was the transformation of security from a cost center to a profit center by offering security-as-a-service to business customers—a testament to aligning security with revenue generation.

At Deliveroo, Cheng further solidified this strategic integration. While reporting to the CTO (with the CIO as a peer), the security function's maturity is evident in its NIST maturity score progression from 1.5 to over 3. This indicates a structured, measurable improvement in security capabilities and processes. Key technical governance elements include quarterly audit committee updates and an annual board update. Crucially, Cheng is involved months in advance in restricted projects like opening or exiting new markets (e.g., Qatar), allowing proactive security planning. The most advanced aspect is Deliveroo's explicit cyber risk appetite, which is one of 11 principal risks publicly disclosed in their annual report. Cheng actively participates in executive sessions where the risk appetite for each principal risk is voted upon, and cybersecurity consistently ranks as having the lowest risk appetite. This clear, board-level mandate provides immense leverage to drive security initiatives, ensuring a higher level of maturity is maintained to stay within acceptable risk parameters. Deliveroo is also exploring security-as-a-service for its restaurant partners, mirroring the strategic success at TalkTalk.

These examples highlight that advancing through the CISO Maturity Model is not just about personal skill but about engineering the organizational context for security. This includes establishing appropriate reporting lines, building robust GRC frameworks, implementing effective security operations (like a 24x7 SOC), and proactively integrating security into the company's most sensitive and strategic business processes.

Demo / Proof of Concept

▶ Watch: Key questions to assess CISO role maturity in interviews (12:00)

While Derek Cheng's talk did not feature a traditional technical demonstration with code or live exploits, his entire presentation served as a proof of concept for the practical application of the CISO Maturity Model in navigating and advancing a cybersecurity career. He demonstrated how he "reverse engineered" the model to strategically assess and secure his desired level of support and influence in new CISO roles.

Cheng outlined the specific questions he asked during his eight rounds of interviews for the Deliveroo CISO position, effectively using them as a diagnostic tool to gauge the company's perceived maturity level for the role:

1. Do I have board and audit committee support? Am I expected to give updates? (At Deliveroo, the answer was yes: annual board updates and quarterly audit committee updates). This directly probes the strategic visibility and governance integration of the CISO role.
2. Do I get involved in restricted projects? (At Deliveroo, yes: involvement months in advance for redundancies, data exfiltration concerns, new market entries/exits). This assesses the CISO's integration into critical, confidential business operations.
3. Who are the key stakeholders to the CISO role? Cheng noted he didn't even need to ask this directly at Deliveroo, as his interview schedule itself spoke volumes—meeting VPs of Engineering, the CTO, General Counsel, DPO, and People Leader demonstrated broad cross-functional engagement beyond IT.
4. Is the company risk appetite for cybersecurity clear and understood? (At Deliveroo, while not fully formalized initially, discussions revealed a strong willingness to clarify and support a defined risk tolerance). This question is vital for understanding the executive team's alignment and commitment to managing cyber risk.
5. Is cyber seen as an IT problem, or does the rest of the business acknowledge its need? This fundamental question directly addresses the organizational perception of cybersecurity. At Deliveroo, the answer was unequivocally that it's seen as a business-wide concern.

These questions, derived directly from the CISO Maturity Model's characteristics, allowed Cheng to validate that Deliveroo was offering a role aligned with his desired Level 3.5 maturity, ensuring the necessary support and influence he sought. His career trajectory, from a Level Two CISO at EA to a Level 3.5 at TalkTalk post-breach, and finally to a similarly mature role at Deliveroo, provides compelling evidence that the model is a viable framework for career assessment and progression.

Defensive Implications

▶ Watch: Driving company-wide security awareness with roadshows (15:40)

The CISO Maturity Model offers profound defensive implications for organizations and security leaders alike. For organizations, understanding where their CISO role sits on this spectrum is crucial for effective cybersecurity governance and risk management. A Level One CISO, confined to IT, will inherently struggle to influence broader business risk, leaving the company vulnerable to threats that span organizational silos. Progressing to higher maturity levels means integrating security into the fabric of business decision-making, leading to more resilient and secure operations.

Defenders can leverage this model in several ways:

1. Self-Assessment and Gap Analysis: CISOs should use the model to honestly assess their current role's maturity level, not their personal capabilities. This involves evaluating reporting lines, the breadth of stakeholder engagement, involvement in strategic projects (M&A, new markets), and the clarity of the organization's cyber risk appetite. This assessment can highlight areas where the CISO role is under-resourced or under-positioned to effectively manage risk.
2. Strategic Communication and Relationship Building: To elevate the CISO role, security leaders must actively build relationships outside of IT. Cheng's success at Deliveroo demonstrates the power of proactive engagement with HR, Legal, Finance, and other business units. Tactics like "security roadshows" are highly effective: creating bespoke content tailored to each department's concerns (e.g., security awareness for HR, financial impact for Finance) and, crucially, presenting this information by going to their leadership meetings. This demonstrates security's relevance and secures crucial leadership buy-in.
3. Aligning Security with Business Risk and Objectives: CISOs must translate technical security issues into business risks and opportunities. Cheng's experience at Deliveroo, where cybersecurity is one of the 11 principal risks with the lowest risk appetite, provides immense leverage. By actively participating in discussions about organizational risk appetite and demonstrating how security directly supports business objectives (e.g., security-as-a-service becoming a profit center at TalkTalk), CISOs can gain executive support and drive momentum for their initiatives.
4. Proactive Involvement in Business Initiatives: Security should not be an afterthought. CISOs need to push for involvement in critical business projects from their inception, whether it's M&A, market expansion, or even workforce changes. This allows for security by design, preventing reactive and costly remediation efforts later on.
5. Elevating Governance and Reporting: Regular, clear, and relevant updates to the board and audit committee are essential. These updates should focus on business risk, strategic initiatives, and key metrics rather than purely technical details. This fosters trust and ensures cybersecurity is perceived as a strategic enabler rather than a technical impediment.

By consciously applying the principles of the CISO Maturity Model, organizations can nurture more effective security leadership, and CISOs can strategically enhance their influence, leading to a more robust and integrated defensive posture against evolving cyber threats.

Key Takeaways

• The CISO Maturity Model (Levels 1-5) is a vital framework used by executive recruiters to define and assess the strategic placement and influence of a CISO role within an organization.
• The model highlights a significant disparity in CISO maturity globally, with 70% of UK CISOs at Level One and Level Five roles being exceedingly rare, predominantly found in the US.
• A CISO's maturity level is determined by the company's placement of the role, including reporting lines (e.g., CIO vs. COO vs. CEO), rather than solely the individual's skill set.
• Advancing maturity involves expanding influence beyond IT, engaging diverse stakeholders (HR, Legal, Finance), integrating GRC practices, and actively participating in critical business decisions like M&A and new market entries.
• Proactive strategies such as tailored "security roadshows" and firm-wide talks on incident impact are crucial for building relationships, securing leadership support, and demonstrating security's business-wide relevance.
• Clearly defined and board-level endorsed cyber risk appetite provides significant leverage for CISOs to drive security initiatives and align them directly with organizational objectives, potentially transforming security from a cost center to a profit center (e.g., security-as-a-service).

About the Speaker(s)

Derek Cheng is the Chief Information Security Officer (CISO) at Deliveroo, a role he has held for approximately five years, during which he has scaled the security department from three to 68 individuals and navigated the company's IPO and recent acquisition by DoorDash. With an extensive career spanning 27 years in cybersecurity, Cheng began as an ethical hacker at Ernst & Young after graduating from university in San Francisco. He further honed his expertise at Deloitte in their security and privacy practice before joining Electronic Arts (EA), where he spent eight years, four of which were as their first global CISO. Following EA, Cheng took on the challenging CISO role at UK telecommunications company TalkTalk for five years, joining after a major data breach and successfully rebuilding trust and transforming the security function. His experience includes working with governmental bodies, earning DV clearance during the Huawei security issues, and pioneering "security-as-a-service" initiatives.