Update
A New Home and Name for This Research
I moved this research platform to research.joechawley.com and renamed it Joe C. Hawley · Research.
Cybersecurity governance, risk, and value
Independent research exploring the human side of cybersecurity governance, leadership, and risk-informed decision making.
Current Research
BISO GovernancePaused
The Business Information Security Officer as a Governance Intermediary: Improving Cybersecurity Decision Quality Through Trust, Influence, and Risk-Based Decision Making
The Business Information Security Officer (BISO) functions as a governance intermediary and boundary-spanning leadership role that enables organizations to navigate competing cybersecurity and business priorities through structured risk-based decision making.
Research Progress
↑ Current
Current Stage: Interviews
Why This Research Matters
Existing BISO literature focuses primarily on role definitions, reporting structures, stakeholder engagement, and security-business communication. Limited research examines how BISOs influence organizational decision-making, improve governance processes, facilitate risk acceptance, or contribute to decision quality. How BISO effectiveness should be measured remains largely unaddressed. This research investigates the BISO as a governance intermediary rather than a communication function, and addresses that gap directly.
From the Research Journal
View all entries →Milestone
A New Research Direction: The Realized Value of Cybersecurity
I am starting Project 002, which asks how security organizations can consistently measure and communicate the realized business value they deliver. Project 001 is paused.
Milestone
Choosing a Method and a First Framework for Project 002
I selected Design Science Research for Project 002, drafted framework v0.2 (the Realized Value Cycle), and reframed practitioner interviews as evaluation rather than discovery.