Most organisations struggle with a single CISO overseeing all their security requirements. But what if you are a global conglomerate with over 100 business units you are consolidating? You need a hierarchy within your CISOs to set standards, control the choice of security products and define policy.
That is exactly what is happening at NTT. Having been through an initial consolidation of business units as NTT Ltd, it is now doing a new consolidation. This time, the controlling organisation is NTT Data. However, it still has to answer to NTT Group in Japan, which is the organisation that owns everything.
To understand how NTT Group manages all of this, Enterprise Times talked with John Petrie, Counsellor to the Global CISO at NTT. While the CISOs report to their local organisations, Petrie says, “I work with all the CISOs of the multiple operating companies within NTT, outside of domestic Japan. Everything from financial discussions to strategy to operational to incident reporting to threat intelligence.”
When asked about the challenge of having many CISOs, Petrie said that the only way to do this was through collaboration and building relationships. It allows everyone to buy in to what you are trying to achieve but with the understanding that a decision will be made. When that happens, everyone then works to make sure it is implemented.
One interesting challenge in bringing so many organisations into line is setting the agenda for tools and processes. Petrie says you must standardise controls and harmonise the tools and processes. He comments, “Standardisation is different than harmonization. We harmonised first. Everybody had to meet these minimum baseline standards.”
To hear what else Petrie said, download the podcast.
Where can I get it?
You can listen to the podcast by clicking on the player below. Alternatively, click on any of the podcast services below and go to the Enterprise Times podcast page.
