CISO accountability in the era of software supply chain security

This article argues that the SolarWinds/SunBurst fallout and the SEC’s charges have ushered in a new era of CISO accountability, akin to a “cyber-CFO” model governed by transparency and regulatory scrutiny. It highlights software supply chain security and third-party risk management as key drivers, and forecasts four shifts: careful drafting training for executives, preference for well-rounded CISO candidates, increased seniority and risk authority for the role (potentially Section 16 status), and the CISO’s final say on security communications. The piece frames these changes as both a responsibility and an opportunity for CISOs to prioritize security, secure resources, and build trust with stakeholders.