I’m a CFO – and suddenly responsible for security. What now?

I know many CFO colleagues who have now either taken on or are on their way to taking on responsibility for their organization’s security. Some have it formally in their job description – others more informally, because it “naturally fell” to the CFO to also handle IT and risk. And in the midst of all this, many of us are sitting and wondering:

“What now?”

I am the CFO at Sicra – a specialized cybersecurity company. Personally, I don’t have operational responsibility for our security – we have skilled professionals who handle that. But I understand how overwhelming it can be for a CFO who suddenly inherits this responsibility – often without resources, experience, or a support structure.

CFO + security = reality

There is little public data on how many CFOs in Norway actually have responsibility for security, but the signals are clear: the role is evolving.

According to the Limited Liability Companies Act, top management – often delegated to the CFO – has a formal responsibility to ensure that security is upheld. This applies even when operations and IT are outsourced, as described in digi.no (Norwegian only). At the same time, PwC emphasizes in its Cybercrime Survey that collaboration between the CISO and CEO is critical for effective security governance. In other words: Strategic leadership must be involved – and the CFO role sits right in the crossfire between strategy, risk, budgeting, and business-critical decisions.

A good example is TOMRA, where CFO Eva Sagemo also assumed responsibility for information security. After a serious cyberattack in 2023, she emphasized how important it is that CFOs with IT responsibility understand both systems and the threat landscape (BackerSkeie/Norwegian only).

So what do you do – as a CFO?

Here are some reflections I’d like to share with those of you who are facing or about to face this reality:

You don’t need to know everything.

But you must understand enough to know what you don’t know. Ask. Learn. And build a minimum level of understanding of threats, dependencies, and what’s truly at stake. As finance professionals, we’re used to thinking in terms of risk and consequence. Use that mindset to better understand the threat landscape, including the financial risks associated with a security breach.
You must own the risk – but not alone.

Make sure security doesn’t become a “side track” in the finance department. Bring in IT, HR, leadership, and the board. A security breach is never just a technical issue – it’s a business issue.
Be proactive.

Don’t wait until you’re in the middle of an attack or flagged in an audit before you act. Start the work now. Ask for help, and build relationships with people who know this better than you.

Need someone to bounce ideas off?

At Sicra, we work with security – all day, every day. We know how complex it is. We also know that not every organization has the need or budget for a full-time CISO. That’s why we offer CISO-for-hire – a flexible way to access deep security expertise without having to build it in-house.

And perhaps even more importantly: We have people you can talk to. People who can explain things clearly, translate the technical, and help you prioritize. So you, as a CFO, don’t have to stand alone in a field you never really asked to be responsible for.