The question for the CISO is whether, from your position in the organisation, you can contribute directly to business risk discussions.

If you are, this is good as it increases your knowledge of the organization’s risk appetite. Does it also mean more access to and more tremendous respect from your C-level peers?