The CISO's Cloud Estate

A buyer-persona view of what a CISO is responsible for across the cloud estate. Pulls together SOC pillars, identity threat detection, data sovereignty controls, and change governance — spanning the Security Operations and Cloud Foundation clusters. The CISO's job is cross-cluster; this map reflects that.

BusinessCapabilityTechnologySource
Compass
  • Businesspersona, use case, outcome
  • Capabilitywhat the org needs to do
  • Technologythe technology choices
  • Sourcewhere the evidence sits
Guided journey · Step 1 of 4

Detection Engineering

The detection engineering pillar from Modern SecOps. The CISO's core function — measurable coverage against MITRE ATT&CK is the metric the board understands.

~ 12 weeks

Search any SKU, capability, risk, or source on this map.

Filter by type

Narrative intro

A CISO's job is cross-cluster. SOC operations sit in Security Operations; identity threat detection bridges Security Operations and Identity Operations; data sovereignty bridges Security Operations and Cloud Foundation; change governance is where security influences the platform's design. This map collects the four pillars a CISO is materially accountable for across the cloud estate. It's a buyer-persona map rather than a delivery programme. Use it for CISO conversations — board reporting, regulator engagement, peer benchmarking. The four pillars together make the CISO's mental model legible.

Key takeaways

  • A CISO's remit is cross-cluster. The four pillars above cut across Security Operations, Identity Operations, and Cloud Foundation.
  • Detection engineering is the visible part of the role; data sovereignty and change governance are where strategic CISOs differentiate.
  • Identity is the modern perimeter — identity threat detection sits across the org chart between Identity Operations and the SOC.
  • Change governance is where security either has a seat at the table or becomes a defensive function. Design-time prevention beats runtime detection at scale.

Programme shape

Estimated duration
26–78 weeks
Estimated FTE
CISO + SOC team + identity architect + sovereignty architect + change governance partner. The CISO's remit crosses functional boundaries — the FTE shape reflects that.
Spend tier
significant
Risk level
elevated

Cross-cluster persona view rather than a delivery programme. The CISO doesn't deliver any single one of these pillars — they're accountable for the posture across all of them. The map is the CISO's mental model, not a project plan.

Back to all maps