Dear Cyber Security Risk Leader
The CISO have little or no control over organisation’s culture and will do well to assess whether it supports him/her in delivering what the organisation has asked for, or what they need. Is he/she prepared to give them what they have asked for or what they need. The organisation may actually not know what they need and may just want him/her to be a tick in the box.