CISOs Are Now Running Business Resilience. Most Companies Haven't Noticed.

Key points

• Chief information security officers (CISOs), the executives responsible for a company's digital safety, are increasingly expected to own business recovery after a cyberattack or outage, not just prevention.
• CrowdStrike created a dedicated chief resilience officer role after its 2024 global outage, but most companies are piling that responsibility onto existing CISOs instead.
• Consultant Aimee Cardwell warns that sensitive files sitting in unexpected places like accounting folders fall entirely outside standard perimeter defences.
• CommVault CSO Bill O'Connell says business continuity plans left as unread documents fail in a real crisis; rehearsal is what makes recovery work.
• Cardwell argues companies must set explicit tolerances for data loss, not just recovery speed, because the two goals can pull in opposite directions.

The title on the business card still reads "Chief Information Security Officer." The actual job is something else.

Over the past several years the role has stretched well past keeping hackers out. CISOs now carry real responsibility for what happens after something goes wrong: how quickly a business gets back on its feet, how much data it loses, whether it survives at all. Three practitioners who spoke to CSO Online describe a profession quietly absorbing duties nobody formally assigned.

What changed, and why does it matter?

The shift is practical, not ceremonial. John Bruggeman, a consulting CISO who serves organisations from a 75-employee firm to a 40,000-person global company, frames it plainly: security professionals who came up through IT have always thought about uptime. The question was always how to avoid being totally down.

Boards and chief executives are now asking the same question out loud, prompted by high-profile outages. After CrowdStrike's faulty software update caused a worldwide technology failure in 2024, the company appointed its first chief resilience officer, a signal to regulators and investors that resilience had moved to the top of the agenda.

Few companies will create that post. For most, the work lands on whoever already owns cybersecurity. Bruggeman is direct about the language: if changing the word from "backup" to "resilience" is what gets board funding, a CISO will make that swap without hesitation.

What does "resilience" actually mean in practice?

It is more than restarting servers quickly. Cardwell draws a clear line between two separate goals: restoring systems and protecting data. Organisations habitually focus on the first and underweight the second.

The right balance depends on what a company holds. A bank, Cardwell argues, should accept two days of downtime rather than expose customer financial records. A company like Amazon, which converts credit card numbers into harmless codes through a process called tokenisation before storing them, risks far less from a breach, so every minute offline costs millions and speed back matters most.

Setting those tolerances explicitly is what CISOs now need to drive. Most organisations measure how long recovery takes. Far fewer set a formal limit on how much data loss they will accept.

Cardwell offered a concrete example: a healthcare provider that ran 15 years of patient records through its billing process, attaching names and identification numbers to invoices sitting in an unprotected accounting folder. No firewall was watching that folder. The breach came not through the front door but through a filing cabinet nobody thought to lock.

"Shadow data", files that exist outside the systems IT officially manages, is where much of today's resilience risk hides. AI tools are making that problem worse, because they pull from wherever data lives. We covered how AI is amplifying this kind of hidden-data exposure in our 14 July story on incident response gaps and AI failures.

Cardwell is pointed on access controls too: every CISO will say role-based access control is the single most important thing a company can do, and every CISO will also say they have never seen a company that does it better than 70 percent.

Bill O'Connell, CommVault's CSO, offers a practical anchor: define the smallest version of the business that still functions, then build recovery priorities around that core. He calls the discipline "ResOps", a deliberate practice of repeatedly rehearsing recovery the way software teams rehearse deployments.

Plans that live in documents fail. O'Connell is blunt: the hardest moments in any incident are always the steps no one practised. Knowing who to call and where to find information under pressure is a muscle built only through repetition.

Should you worry about your own data?

If your employer or bank suffers an outage, find out first whether data was taken or systems were simply unavailable. A temporary outage with no data exposure requires nothing from you. A breach involving financial details or login credentials means changing passwords and watching for suspicious contact.

Boardroom language matters here too. When executives reach for the word "resilience" rather than "backup", funding tends to follow. That funding eventually determines whether the organisation holding your data has actually practised what happens when things go wrong.

The real watch item is the gap between the plan on paper and the drill that never happened. Cardwell's accounting-folder example is a useful test: ask your security team when they last checked somewhere nobody thought to look.