Whirpool Corporation focusing on data privacy, protection and loss prevention

Daren K Fairfield
CISO, Whirpool Corporation 

Preparedness to face challenges of data security:   
To face the near challenges in data security, our organization is focusing on data privacy, protection, and loss prevention.  These challenges have driven a change in how we view data privacy more holistically across the globe given the surge in government regulations on privacy and the consumer's expectations.  

We have deployed a global network of privacy champions, capabilities, and training to promote strong data privacy practices.  In addition, we have addressed stronger data access protections and recrafted our least privilege model to drive access to data by those who truly need it to do their jobs.

The best practices adopted for remote working: 
From a technical standpoint, this includes multi-factor authentication for system access, enforcing security tools are current and running on all employee computers, and stronger asset, vulnerability and patch management.  From a human standpoint, we have adopted many health protocols for those coming into the office including limiting who can enter company buildings, social distancing and mask wearing guidelines in workspaces, and daily health checks.  
We have also provided some additional equipment support for those working from home to ensure their productivity and ergonomic situations are supported.  Our employees also receive extensive phishing training and are engaged in our simulated phishing program to raise cybersecurity awareness.

Role of CISOs: 
Our take on the CISO role is that it will continue to evolve and broaden its reach into other areas of risk management, communications, and privacy.  With the takeup of greater digital capabilities across global organizations and building these digital capabilities into consumer products, the CISO's boundaries are becoming less defined as risk needs to be considered beyond the company's four walls.  This includes supplier risk, consumer risk, and product risk.  
The CISO must now be more than just an IT person.  For example, the CISO must now perform roles such as an educator, a risk manager, an auditor, and a corporate communicator.  This need requires more diversity in the skill set for the future role of the CISO and a much greater understanding of the business as all functions are embracing new digital capabilities without traditional IT involvement.