“I’m probably going to lose my job, but compared to the people above me, I’m probably losing the least. They’re going to lose their fortune, their wealth.”

Who They Brought In 

Lorenzo Toscano is the Deputy CISO at MCPC, a company of nearly 500 employees across about six offices. His rise was fast. Several people above him left in a short window, with the security team already at a bare minimum, so after only three years in security he asked the CIO for a shot at the role and promised to go back where he came from if it did not work. It worked. He moved from information security officer to Deputy CISO within the past few months. He also earned a Master of Legal Studies, which pulled him into redlining customer contracts alongside the company’s lawyer. This was his first podcast. 

What Got Loud 

• Lorenzo believes the CISO should report to the CEO or president, not the CIO, because leadership owns the risk and security only manages it for them. 
• A customer MSA that ran 40 pages about three and a half years ago, with roughly 15 pages of security and privacy terms, now carries about five more pages on AI. 
• A SOC 2 report used to be the checkbox. Now customers copy the same controls into the contract and ask to audit the environment too. 
• MCPC blocks unapproved AI tools at the DNS level and allows only paid enterprise accounts, but no control stops someone from taking a picture of their screen. 
• On one contract under $50,000, a customer questionnaire cost his team 25 hours.

The Rundown 

Lorenzo started with what MCPC does beyond the obvious. Data disposition is one of its offerings, and because many customers are uneasy about anyone disposing of their data, the company relies on independent audits that certify wiping, shredding, and recycling. SOC 2 is his bread and butter. As Deputy CISO, he now sits in the strategy room and helps shape the security side of the product, a change from being the person who “sits in a closed office, sees the alert, writes the report, and angrily emails the rest of the company.” 

When Melissa asked whether the CISO should report to the CIO, Lorenzo said neither. His own CIO is a former security consultant and his IT manager is an all-star, so the relationship works. Still, he argued most compliance frameworks make leadership ultimately responsible for risk. Programs delegate the management of that risk to security, not the ownership, so security belongs under the CEO or president rather than under a middleman. 

His legal training shaped the next stretch. “Knowledge for the sake of knowledge means nothing,” he said, which is why he started working with the company’s lawyer on contracts where IT, security, and compliance were not being represented. The change he has watched since is the AI language: no AI use without consent, no training on customer data, and a definition of customer data broad enough to include a contact’s name and email sitting in a vendor’s ITSM tool. His redline approach is to stop the obligation at MCPC and add “commercially reasonable” safeguards for suppliers. 

“You can’t be unreasonable. At the same time, it’s a negotiation.” 

On the control side, MCPC pairs training with AI gateway tools, DNS blocking, and enterprise accounts it pays for, and it does not let personnel use personal ChatGPT or Claude accounts. He gave the example of a new AI product that trains on user data by default and gets blocked with a warning splash screen. Beyond that, the acceptable use agreement and discipline do the rest, including when an employee posts a golf outing photo with a customer’s representative. 

Customer diligence has also grown. A SOC 2 report and bridge letter once satisfied most customer due diligence requirements. Today, organizations increasingly demand additional evidence of cybersecurity controls, data protection practices, encryption standards, and third-party risk management processes. Healthcare customers, many with HITRUST, are the most attentive. He tied the questionnaire problem to his earlier days, when a small contract cost 25 hours and the margin was gone, agreeing the juice was not worth the squeeze. 

From his previous SOC role, he described mid-market clients between 60 and 400 employees who came through incident response, and about one in three signed on for ongoing services. The pushback was a security manager worried about a job, or a belief they could do it cheaper. His answer is that a piece is always missing, specialized talent is hard to find, and an MSP gets better EDR licensing and real 24/7 coverage. He also described hiring an analyst from the automotive insurance-audit world who started 10 to 15 percent under market with room to grow.  

Real Talk 

Lorenzo is candid about where the pressure sits. The reporting line, the AI clauses, and the audit requests all come back to the same issue: customers want proof, and security leaders need leadership backing to deliver it. His point about “commercially reasonable” language is practical, because it keeps a contract’s security demands in proportion to what the deal is worth. 

If your Microsoft 365 environment hasn’t been reviewed lately, let’s fix that before someone else does it for you. Visit www.SOCSoter.com