Jerry Perullo, Founder @ Adversarial Risk Management and Former CISO @ ICE Macy Mody, Director of Strategy and Operations @ SafeBase As your company grows, you'll be faced with many leadership hiring questions like when is it the right time to bring on a Chief Information Security Officer (CISO)? Join Jerry Perullo, the founding CISO of Intercontinental Exchange (NYSE:ICE), and Macy Mody, Director of Ops and Strategy at SafeBase, for a lively discussion about the CISO role, how your company can know when the time is right to find one, and what to look for and evaluate in your first security hire.

1. How to Know When It's Time to Hire
a CISO
Jerry Perullo
Founder
Adversarial Risk
Management
1
Macy Mody
Director of Strategy and
Operations
SafeBase

2. Primary Reasons to Hire a CISO
• Altruistic Security
• Regulatory Requirements
• Third Party Risk Management (TPRM)
2

3. Key Considerations for Hiring a CISO
Maturity of
Security Program
3
Timing
Budget & Hiring

4. Where to Begin
T
R
I
C
C
Threats
Risks
Incidents
Controls
Compliance
Cybersecurity & Privacy Governance (CyberGov)

5. 5
TRICC - Threats
Threat Objectives Drive:
• Cybersecurity Mission
• Testing
• Investments
• Risk Appetite

6. TRICC - Risks
Risk Assessment Management Procedure (RAMP)
6

7. TRICC - Incidents
Cyber Incident Response Procedure (CIRP)
7

8. TRICC - Controls
Status of ongoing projects
in response to the Risk
Register
8

9. TRICC - Compliance
• Recap SOC2 audit status
• Inbound TPRM questions
9

10. Key Takeaways
• Start early: Think about security on Day 1
• Don’t wait for a CISO: Stand up CyberGov and use the
TRICC framework to build a foundation
• Compliance is easier when you are secure
10

11. THANK YOU
Jerry Perullo
Adversarial Risk Management
jerry@adversarial.com
Macy Mody
SafeBase, Booth 260
macy@safebase.io