Your comment should be required reading for any CISO that finds themselves without mandate, budget or support from upper management.

In retrospect, after the 2008 crash in the finance world how the role of a CISO was described to me sounded an awful lot like risk officers in a lot of financial organisations.