The relationship between the chief information security officer and the chief financial officer has evolved from a mere transactional, enterprise-budgetary conversation to a strategic alliance that shapes an organization's security posture and business resilience. This transformation underscores the strategic importance of a robust relationship between CISOs and CFOs. It's not just about securing budget and optimizing security efforts; it's about determining whether security initiatives receive the necessary funding, executive support, and organizational alignment to succeed.
The CISO-CFO relationship is where cybersecurity strategy meets business reality.
However, in many companies, the current state of CISO-C-Suite relationships leaves much to be desired. The lack of cohesiveness in these relationships is not just a missed opportunity; it's a high cost to organizations in their risk mitigation efforts. As Theresa Payton, CEO at Fortalice Solutions, LLC, rightly points out, the role of today's CISO is to bridge divides and forge partnerships that make security a business enabler. To do this with CFOs, CISOs need to speak the language of finance.
Surprisingly, PwC's 2025 Global Digital Trust Insights survey found that only 47% of CISOs are involved in strategic planning with CFOs regarding cybersecurity investments in their organizations. And just 26% of companies usually have controls in place to respond rapidly to cyber threats. These deficiencies point to weaknesses in internal controls and can expose organizations to regulatory scrutiny and stakeholder distrust.
These weaknesses are why CISOs such as Adam Ennamli, global head of operational risk management at Deel, say the CISO role requires considerable business acumen. "But there needs to be more efforts, in my opinion, from the CISO, to translate their technical acumen into the financial and business language," he says.