Industry studies and surveys consistently point to the average tenure for a Chief Information Security Officer (CISO) ranging from 18 months to 4 years.