“Just remember, if there's a breach, the CISO is the first person to get fired.”
Someone actually said that to me during an interview for an outsourced Chief Information Security Officer role. I remember thinking, Okay. No problem. Not because I was naive about the risks, but because I understood the responsibility I was being asked to carry. Today, when I work with nonprofit leaders, I see that same responsibility playing out in a different way.
When security fails at a nonprofit, it's not just the organization that's at risk. It's the people and communities who depend on it.
Ten years ago, firing the CISO after a breach was common thinking. As if removing one person would magically fix the problem. It wouldn't. And it still won't. Thankfully, our understanding of security leadership has evolved, but one thing hasn't changed.
Accountability.
Hold Yourself More Responsible Than Anyone Could Ever Hold You Accountable
Throughout my more than 20 years in security, including speaking at global security conferences, I've taught one principle:
“You must hold yourself more responsible than anyone else could ever hold you accountable.”
That's a different level of leadership, and it's one I believe every nonprofit executive director, CEO, and board member should embrace.
It means confronting uncomfortable truths. Admitting when you're wrong, making difficult decisions, and refusing to wait for a crisis before taking action. It doesn't mean being perfect.
It means leading with integrity, even when nobody is watching (which you're already doing, but when does security play into that?).
Not Every Nonprofit Leader Operates at This Level
I'm going to be direct about that. Some organizations are still operating with security plans, policies, and training that haven't been updated in years. Some leaders know their organizations are vulnerable but continue postponing difficult decisions. I understand. Budgets are tight, staff are exhausted, the demands are relentless, but limited resources don't eliminate your responsibility to protect the people who trust you.
The nonprofit leaders who bring me into their organizations understand this. They're not necessarily the ones with the largest budgets. They're the ones willing to ask:
What happens to our staff, our community, and our mission if we don't act?
They're willing to confront what could happen and take responsibility for doing everything reasonably within their power to prepare. That's leadership.
This Is ConsciouslySecure Leadership
A ConsciouslySecure leader doesn't wait for disaster to recognize the value of protection. They take responsibility before someone else demands accountability.
So here's my question:
If a serious security incident happened in your nonprofit tomorrow, what would you wish you had done today?
If you already know the answer, what's stopping you? You cannot prevent every incident, but you can decide how seriously you take your responsibility to prepare.
Hold yourself more responsible than anyone else could ever hold you accountable.
Not because you're afraid of losing your position, but because the people who depend on your leadership deserve nothing less.
Happy Halloween, Samhain, and Day of the Dead!
Did you follow our 8th Annual ConsciouslySecure Awareness Month this October? Be sure to check out the last 31 days of posts.