An information security officer (ISO) makes sure the security policy is actually carried out. The CISO sets direction and answers to the board; the ISO keeps day-to-day security in order.
Job adverts use the two titles almost interchangeably, which makes hiring harder than it should be. Get it wrong and you end up with a strategist closing tickets, or a hands-on officer suddenly expected to brief the board.
What does an information security officer do?
The ISO runs and polices information security across the organisation. The remit is broad, yet it keeps coming back to two questions. Where are our risks, and are the controls we agreed on doing their job?
A typical ISO portfolio covers:
- running or facilitating risk assessments with system and process owners;
- maintaining policies and procedures, for instance on access management, suppliers and backups;
- following up security incidents and feeding the lessons back into policy;
- preparing for internal and external audits and closing findings;
- running awareness activity so staff know what is expected of them;
- reporting to the CISO, the security manager or straight to senior management.
The ISO is usually the go-to person for IT teams and suppliers as well. They rarely configure firewalls themselves, but they do need to follow what an engineer is telling them and judge whether a control really covers the risk.
ISO vs CISO: where the line falls
The difference comes down to mandate and audience. A CISO owns the security strategy, advises the board and fights for budget. The ISO sits a level below, turning that strategy into policy and controls and checking that people follow them.
Unsure which one a role profile describes? Look at who the person spends most time with. If it is the board, the regulator and the external auditor, you are hiring a CISO. If it is process owners, IT teams and internal auditors, you want an ISO.
Smaller organisations sometimes fold both roles into one person. That can work, provided everyone knows which hat is on when that person reports to the board on their own work. Large organisations often go the other way, with several ISOs per division or domain reporting into a single CISO. If it is that senior role you need, my piece on hiring an interim CISO is a better starting point.
What NIS2 in the Netherlands and DORA expect
The Netherlands brought NIS2 into national law through the Cyberbeveiligingswet (Cbw, the Dutch Cybersecurity Act), in force since 15 August 2026. Under it, the board approves the measures taken under the duty of care, oversees their implementation and must know enough to judge risks and controls. Directors are expected to take appropriate training for that.
The Dutch national cyber security centre, NCSC, sets out ten duty-of-care measures, ranging from risk analysis and incident response to supply chain security and regular checks on whether controls work. Each organisation decides for itself which measures are appropriate. As I read the law, nothing obliges you to appoint someone with the title CISO or ISO.
Even so, this is where the case for an ISO is strongest. A board that signs off controls and must oversee them needs someone who follows that work every day and reports on it candidly, which is exactly the ISO's job.
Financial services leave less room for interpretation. Under DORA, the management body bears ultimate responsibility for ICT risk. The Dutch regulator AFM expects an independent role to manage ICT risk, with control and audit functions placed with sufficient independence. At a bank or insurer, then, you also have to decide where the ISO sits in the three lines of defence model: in the first line alongside IT, or in the second line as the overseer.
Which ISO profile fits your sector?
The tasks look much the same everywhere. The standards an ISO works to do not.
- Government. For essential entities in the Dutch government sector, the BIO2 baseline has been legally tied to the Cbw duty of care since 15 August 2026. An ISO in a public body needs to know that baseline inside out. For the hiring side, see cyber security for government.
- Financial services. You want someone fluent in DORA who understands how a supervisor looks at the separation between the lines. Experience with ICT risk management and third-party risk counts for a lot.
- Healthcare. Dutch care providers are legally required to demonstrate compliance with NEN 7510, the national healthcare information security standard. The current version dates from December 2024, and existing certificates must be transitioned by 20 February 2027. An ISO who has already steered that transition has a real head start. How NEN 7510 fits with the new act is covered in NEN 7510 under NIS2.
When to bring in an interim ISO
Interim works best when the work is clearly defined and the capacity is missing: your permanent ISO leaves just before an audit, say, or audit findings pile up with nobody to own them. Another classic is a Cbw or DORA programme whose policies are signed off while implementation has stalled.
In each case the interim needs to work independently from the first morning. So press candidates on a comparable assignment: which standard, what scale, and what state did they leave it in?
If the thing you need does not exist yet, such as a security function built from scratch, an ISO is rarely the first hire. You need someone to set direction and bring the board along before that.
Interim or permanent: my view
My advice is to settle who will report to the board on whether controls work, and only then pick the title. If that reporting sits with a CISO, the CISO needs an ISO to do the work. Without a CISO, your ISO must be senior enough to deal directly with the executive team, and that is a heavier profile altogether.
For long-term, day-to-day work I lean towards a permanent hire. The role improves as the person gets to know the organisation. Interim earns its keep as a bridge or for a programme with an end date. Combining the two also works well: an interim ISO lays the groundwork while you recruit a permanent one.
Need an ISO?
At MVPeople we supply interim and freelance security officers through MVPeople freelance and interim, and through MVPermanent if you would rather hire permanently. The information security officer hiring page shows the profiles we place. If governance and standards are the real gap, look at GRC and compliance.
Want to talk the profile through? Call or email me and we will firm up the role before you take it to market.
