Chief Information Security Officer (CISO)

Role Summary

The Chief Information Security Officer (CISO) is responsible for establishing, implementing, maintaining, and continually improving Swedwise AB's Information Security Management System (ISMS) in accordance with ISO 27001:2022 requirements. The CISO ensures that information security is appropriately managed across the organization, protecting the confidentiality, integrity, and availability of information assets.

Current Assignee: [TBD - Name to be assigned by management]

Role Type: Part-time functional role (estimated 20-30% time allocation)

Reporting Line: Reports directly to CEO

Context for Swedwise

Given Swedwise's size (~35 employees) and business model (SaaS development, consultancy), this is a part-time role designed to be combined with other operational responsibilities. The focus is on practical, proportionate security management that supports business growth while meeting ISO 27001 certification requirements and customer expectations.

Time Allocation Estimate

For a company of Swedwise's size, the CISO role typically requires:

• Steady state: 20-25% (1 day per week)

  • Ongoing ISMS maintenance
  • Regular reviews and monitoring
  • Security awareness activities
  • Routine risk assessments

• Implementation phase: 40-50% (2 days per week)

  • Initial ISMS development
  • Control implementation
  • Preparation for certification audit

• Incident response: Variable (as needed)

  • Immediate response to security incidents
  • Investigation and remediation

Key Responsibilities

1. ISMS Leadership and Coordination

• Establish and maintain the ISMS framework in accordance with ISO 27001:2022
• Define the scope of the ISMS in consultation with management
• Coordinate ISMS activities across all organizational units
• Promote information security culture and awareness throughout Swedwise
• Act as the organization's subject matter expert on information security
• Champion continuous improvement of the ISMS

2. Risk Assessment and Treatment

• Establish and maintain the information security risk assessment methodology
• Coordinate information security risk assessments (at least annually)
• Identify and evaluate information security risks and opportunities
• Propose risk treatment plans to management
• Monitor the effectiveness of risk treatment measures
• Maintain the risk register and ensure it remains current

3. Security Policy and Documentation

• Develop and maintain information security policies
• Ensure security procedures are documented, implemented, and maintained
• Maintain the Statement of Applicability (SoA)
• Coordinate document control for ISMS documentation
• Review and approve information security guidelines and standards
• Ensure policies align with business objectives and compliance requirements

4. Control Implementation and Oversight

• Oversee the implementation of ISO 27001 Annex A controls
• Work with technical teams to implement security controls
• Ensure controls are appropriate for Swedwise's size and context
• Monitor control effectiveness through metrics and KPIs
• Coordinate with SaaS development teams on secure development practices
• Ensure security considerations in cloud service usage

5. Incident Management Leadership

• Establish and maintain the information security incident management process
• Lead the incident response team during security incidents
• Ensure incidents are properly documented, investigated, and resolved
• Analyze incident trends and recommend preventive actions
• Report significant incidents to management and affected parties
• Coordinate with external parties (customers, authorities) as needed

6. Compliance and Legal Requirements

• Identify applicable information security legal and regulatory requirements
• Monitor compliance with ISO 27001 and related standards
• Ensure Swedwise meets customer contractual security requirements
• Coordinate with legal counsel on data protection and privacy matters
• Monitor changes in legislation affecting information security
• Maintain evidence of compliance for audit purposes

7. Security Awareness and Training

• Develop and maintain the information security awareness program
• Ensure all staff receive appropriate security training
• Coordinate role-specific security training (e.g., for developers)
• Create and distribute security awareness materials
• Track training completion and effectiveness
• Foster a security-conscious culture across the organization

8. Management Reporting

• Report ISMS performance to CEO and Management Team
• Participate in management reviews
• Present security metrics and KPIs
• Recommend resource allocation for security initiatives
• Escalate significant risks and issues to management
• Provide security input to business decisions

9. Internal Audit Coordination

• Plan and coordinate information security internal audits
• Review internal audit findings and ensure corrective actions
• Track and close audit non-conformities
• Provide subject matter expertise during audits
• Ensure audit evidence is properly maintained

10. External Relations and Certification

• Act as primary liaison with the ISO 27001 certification body
• Coordinate certification and surveillance audits
• Manage relationships with security vendors and consultants
• Participate in industry security forums and networks
• Stay current with security trends and best practices
• Represent Swedwise in security-related customer discussions

11. Third-Party Security Management

• Assess information security risks of suppliers and partners
• Ensure security requirements in supplier contracts
• Monitor third-party compliance with security requirements
• Coordinate security reviews of cloud service providers
• Manage security aspects of customer integrations

12. Asset and Access Management

• Oversee the information asset register
• Ensure appropriate classification of information assets
• Monitor access control procedures
• Review user access rights periodically
• Ensure proper handling of customer data
• Coordinate secure disposal of information assets

Authority

The CISO has the authority to:

Decision-Making Authority

• Approve information security policies and procedures
• Classify security incidents and determine response priorities
• Approve or reject access to sensitive information systems
• Mandate security controls for new systems or projects
• Suspend systems or access in case of security threats
• Approve security exceptions with documented risk acceptance

Escalation Authority

• Escalate security issues directly to CEO when necessary
• Request immediate action from any department head on security matters
• Invoke business continuity procedures in case of major incidents
• Require security assessments for new initiatives

Resource Authority

• Request budget allocation for security tools and training
• Recommend allocation of personnel to security projects
• Engage external security consultants (within approved budget)
• Prioritize security improvement initiatives

Limitations

• Major expenditures require CEO approval (as per financial authorization matrix)
• Risk acceptance decisions rest with senior management (CISO recommends)
• Business decisions remain with respective business unit leaders
• CISO advises but does not override business unit authority

Required Competencies

Education and Qualifications

Minimum:

• Bachelor's degree in Computer Science, IT, Cybersecurity, or related field
• OR equivalent practical experience in information security (5+ years)

Preferred:

• Formal information security management training
• ISO 27001 Lead Implementer or Lead Auditor certification

Professional Certifications (Recommended)

Highly Recommended:

• ISO 27001 Lead Implementer or Lead Auditor
• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)

Valuable:

• CISA (Certified Information Systems Auditor)
• CEH (Certified Ethical Hacker)
• CompTIA Security+
• Cloud security certifications (AWS, Azure, Google Cloud)

Experience

Essential:

• Minimum 3-5 years experience in information security
• Experience implementing security controls in business environments
• Understanding of ISO 27001 requirements and implementation
• Experience with risk assessment and management
• Knowledge of cloud security (SaaS context)

Desirable:

• Experience in consulting or professional services environment
• Previous involvement in ISO 27001 certification project
• Technical security experience (network security, application security)
• Experience with security in Scandinavian regulatory environment
• Project management experience

Technical Skills

• Understanding of information security principles and best practices
• Knowledge of common security threats and vulnerabilities
• Familiarity with security tools and technologies
• Understanding of network and system security
• Knowledge of secure software development practices
• Cloud security concepts (AWS, Azure, etc.)
• Basic understanding of cryptography and encryption

Business and Management Skills

• Strategic thinking and business acumen
• Project management and coordination
• Change management and influencing skills
• Communication (written and verbal) in English and Swedish
• Stakeholder management
• Training and presentation skills
• Analytical and problem-solving abilities

Personal Attributes

• Strong ethical standards and integrity
• Attention to detail
• Ability to balance security with business needs
• Pragmatic and solution-oriented approach
• Ability to work independently
• Calm under pressure (especially during incidents)
• Continuous learner - keeps current with security trends

Key Relationships

Internal Relationships

Primary:

• CEO: Direct reporting line, strategic alignment, resource approval
• Management Team: Security strategy, risk discussions, policy approval
• Quality Lead: IMS integration, audit coordination, improvement initiatives
• IT Manager/Technical Lead: Control implementation, incident response, technical security
• Development Teams: Secure development practices, code reviews, security in SaaS products
• Customer Success: Customer security requirements, security in contracts
• All Staff: Security awareness, training, policy compliance

Supporting:

• PMO: Security in project management, security project tracking
• Resource Management: Training coordination, security competency development
• HR: Security in onboarding/offboarding, personnel security, confidentiality agreements

External Relationships

Regular:

• Certification Body: Audit coordination, certification maintenance
• Security Consultants: Specialist expertise, penetration testing, gap assessments
• Cloud Service Providers: Security features, incident coordination, compliance documentation

As Needed:

• Customers: Security questionnaires, audit support, incident notification
• Legal/Data Protection Authority: Breach notification, compliance matters
• Law Enforcement: Serious security incidents, cybercrime
• Industry Peers: Best practice sharing, security forums

Performance Indicators

The CISO's performance is evaluated based on:

ISMS Effectiveness

• Successful achievement and maintenance of ISO 27001 certification
• Number and severity of security incidents (trend reduction)
• Mean time to detect and respond to incidents
• Number of outstanding high-priority security risks
• Percentage of planned security controls implemented on time
• Audit findings (non-conformities, observations)

Compliance and Governance

• Percentage of policies and procedures reviewed on schedule
• Compliance rate with security policies across the organization
• Timely closure of audit findings and corrective actions
• Documentation quality and completeness
• Risk register currency and accuracy

Awareness and Culture

• Security training completion rate (target: 100% within 30 days of joining)
• Annual security awareness training completion (target: 100%)
• Staff security awareness survey results
• Number of security incidents caused by user error (trend reduction)
• Engagement in security initiatives

Operational Excellence

• Availability of critical systems (contribution to uptime)
• Customer satisfaction with security responsiveness
• Time to resolve security incidents
• Accuracy and timeliness of management reporting
• Stakeholder feedback (internal and external)

Continuous Improvement

• Security improvement initiatives implemented
• Innovation in security practices appropriate to Swedwise's context
• Professional development and currency with industry trends
• Contribution to business enablement (not just "saying no")

Deputy and Backup Arrangements

Deputy CISO

• Role: [TBD - Name to be assigned by management]
• Purpose: Acts as CISO during absence (vacation, illness)
• Authority: Full CISO authority during designated periods
• Competency: Should receive similar training and knowledge transfer

Incident Response Backup

For security incident response outside normal hours:

• Primary: CISO (as per on-call arrangements)
• Secondary: IT Manager or designated Technical Lead
• Escalation: CEO for major incidents

Knowledge Management

To ensure continuity:

• CISO maintains documented procedures for all key activities
• Deputy CISO receives regular briefings and shadowing opportunities
• Critical information (e.g., risk register, ongoing issues) is documented and accessible
• CISO provides handover documentation before extended absences

Succession Planning

• CEO identifies potential internal candidates for CISO role development
• CISO provides mentoring to potential successors
• Key competencies and certifications are encouraged across relevant staff
• Cross-training in security management is encouraged

Review and Updates

This role description is reviewed:

• Annually, as part of management review
• When there are significant changes to the ISMS scope
• Following major organizational changes
• After certification audits (to incorporate lessons learned)
• When ISO 27001 standard is revised

Approval

Role	Name	Signature	Date
CEO	[TBD]
CISO	[TBD]

---

Document Control

• Location: /content/role-descriptions/ciso-role.md
• Format: Markdown with YAML frontmatter
• Version History: Tracked in Git
• Next Review: [TBD - Set upon approval]