Home › Blog › How to Sell to a Bank CISO: Security Reviews, Documents and First Contact
What a bank CISO owns, what their security review asks a vendor for, the rules behind it (NYDFS 500.11, DORA, PRA SS2/21), and how to get through it faster.
By Moe Alhosni · Published 2 November 2026 · 6 min read
Short answer: A bank CISO almost never buys from you, but they can stop any deal that touches the bank's data or systems. They own information security risk, and regulators make them check vendors. Win them with evidence, not a pitch: a SOC 2 Type II or ISO 27001 report, a recent penetration test summary, clear answers on where data sits and who can access it. Send the security pack early, before the business sponsor asks.
This page is one of five on the people in a bank's buying committee. The main guide is lead generation for selling to banks and credit unions, and the bank buying committee map shows all ten roles on one page.
I spent 4 years and 7 months at Moody's in London (October 2019 to April 2024), most recently as Assistant Director, Sales, working with central banks, financial institutions and asset managers. What follows is the general version, built from published regulatory guidance and how bank buying committees usually work. No former employer's data or method, and no client named. Where I make a claim about the rules, I link the rule. None of this is legal advice.
The chief information security officer owns the bank's information security programme. For a vendor, that means the CISO's team runs, or signs off, the security part of your due diligence:
In a large bank you will deal with a third-party security team under the CISO, not the CISO in person. In a small bank or credit union, the "CISO" may be one person, or an outsourced service.
The CISO's team is not being difficult. It is doing what its supervisors require.
| Where | Rule or guidance | What it asks the bank to do about vendors |
|---|---|---|
| New York | 23 NYCRR 500.11, third-party service provider security policy | Written policies covering identification and risk assessment of providers, minimum cybersecurity practices, due diligence and periodic assessment |
| US (federal) | Interagency Guidance on Third-Party Relationships: Risk Management (Federal Reserve, FDIC and OCC, June 2023; also OCC Bulletin 2023-17) | Due diligence and ongoing monitoring scaled to risk, including information security |
| EU | Digital Operational Resilience Act (DORA), applying since 17 January 2025 | ICT third-party risk management, including contract terms and a register of ICT arrangements |
| UK | PRA SS2/21, outsourcing and third party risk management and FCA FG16/5 on cloud and third-party IT | Risk-based due diligence, data security, access and audit rights, exit plans |
Read the New York rule once. It is short, and it reads like the outline of every security questionnaire you will get.
Have these ready before the first security call:
Put these in a single security pack with a contact name. A pack that answers 80% of the questionnaire before it arrives can save weeks.
Do not cold-email a bank CISO to sell them your product unless security is what you sell. For everyone else:
If you do sell security tooling to banks, a direct email to the CISO works best when it names a specific control gap or a rule (one of the rows above) and offers evidence, not a demo.
Security review usually runs alongside third-party risk, after the business sponsor has a case and before procurement finalises the contract. In practice it is often the longest single step. That is why the bank buying committee map puts it on the critical path, and why procurement and compliance will wait for it.
Not by law, but most banks expect independent assurance such as a SOC 2 Type II report or ISO 27001 certification. Without one, expect a longer review, more questions and possibly an on-site or remote audit.
It depends on the bank, the data you touch and how ready you are. A complete security pack sent before the questionnaire arrives is the biggest thing you control.
Only if you sell security. Otherwise go through the business sponsor and ask for the name of the third-party security reviewer.
DORA's obligations fall on EU financial entities, but they pass requirements to their ICT providers through contracts and monitoring. If you sell ICT services to EU banks, expect DORA-driven contract terms.
If you hire anyone to book meetings with banks, us included, get three things in writing first.
Then put your deal size and close rate into the cost per meeting calculator for financial services and see what a bank meeting is worth to you before anyone quotes you a price. Our own terms are a one-off setup of $1,000–$3,000, then $200–$500 per qualified meeting that took place, or a flat $5,000 a month, with no minimum term. We have not run a campaign for a bank-facing client yet, and we say so up front.
If you sell to banks and want to talk through your committee map or your first sequence, book 30 minutes or email moe@roimaxi.com.
Moe Alhosni, founder, ROI Maximizer (M Ventures LTD, 4 Beau Street, Bath BA1 1QY).
About the author: Moe Alhosni, founder of ROI Maximizer. Before that he spent 4 years and 7 months at Moody's in London (October 2019 to April 2024), most recently as Assistant Director, Sales, working with banks, asset managers and private equity firms. He runs the campaigns behind the first-hand data on this site. LinkedIn
After Moody's he was Sales Director at Coinshift, a Web3 treasury management company (2024). Before Moody's he worked at BLOM Bank France in London on settlements and customer service, including AML/KYC record updates. Full career
Or run the free GTM teardown on your own site for the ICP, cold email and numbers specific to your company.
ROI Maximizer is a trading name of M Ventures LTD, registered in England and Wales, company no. 15554493. Registered office: 4 Beau Street, Bath BA1 1QY, United Kingdom. moe@roimaxi.com
© 2024–2026 M Ventures LTD. Privacy notice · Editorial policy · Methodology · Corrections