Three Lines Model for Cyber Risk: Roles and Assurance

In many organisations nobody can say clearly who owns cyber risk, who challenges it and who gives the board independent assurance that it is under control. The CISO is often expected to do all three at once: run the controls, set the policy, and report on whether the controls work. The Institute of Internal Auditors (IIA) Three Lines Model is the most widely used way to separate those roles, and in 2026 the IIA replaced its 2020 position paper with a new Statement of Position. This guide explains the model as it now stands, how to apply it to cybersecurity in practice, where the CISO sits, how to keep internal audit independent, and how to coordinate assurance without duplication. It is for CISOs, chief risk officers, chief audit executives and board members who need a workable cyber governance structure.

Key takeaways

The 2026 Statement of Position replaces the 2020 paper. The IIA now publishes the Three Lines Model as a Statement of Position, written mainly for the board, with five principles and new guidance on blended roles and integrated assurance.
The first line owns cyber risk. Business and technology owners who operate systems, including the teams that run identity, cloud and endpoints, are responsible for managing the risk day to day.
The CISO is usually a second line role, but often not purely. Where the security function also operates controls, document which activities are first line and protect the challenge role.
Independence is structural. Internal audit reports functionally to the board, has unrestricted access and keeps at least 12 months between running a process and assuring it.
Coordination beats duplication. An assurance map that shows who tests what across the lines and external providers is the single most useful tool for cyber oversight.

From three lines of defence to the Three Lines Model

The older "three lines of defence" framing presented risk management as a set of barriers. The IIA's 2020 position paper, "The IIA's Three Lines Model: An Update of the Three Lines of Defense", dropped the word defence and set out six principles: governance, governing body roles, management and first and second line roles, third line roles, third line independence, and creating and protecting value. It described internal audit as the governing body's "eyes and ears" and stated that independence "does not imply isolation".

The IIA now marks that paper as superseded. Its Statement of Position, "Assurance and Advice in Support of Effective Governance: Three Lines Model", listed by the IIA in July 2026, keeps the principles-based structure but restates it in five principles:

Boards set purpose, risk appetite and expectations, and oversee strategic objectives.
Effective oversight depends on reliable, balanced information about performance, risks and controls.
The board and senior management establish accountability by defining roles and responsibilities.
Distinct sources of assurance, including an independent source, give the board confidence that processes work as intended.
Advisory services complement assurance with insights, perspectives and options.

These are paraphrases; the statement does not give the principles separate titles. The practical changes for cyber governance are an explicit treatment of blended roles (where internal audit performs second line work or the chief audit executive supervises another function), a preference for "integrated assurance", and a clear statement that external assurance providers sit outside the three lines.

Roles applied to cybersecurity

Role	What the IIA statement says	Cyber examples
Board	Strategic direction and oversight; decides whether to establish, expand or combine lines based on risk, complexity, regulation and the need for independent assurance	Sets cyber risk appetite, receives CISO and audit reports, approves the internal audit plan and charter
Senior management	Designs structures to achieve objectives; CEO accountable to the board	Allocates security budget, assigns cyber risk ownership to business leaders
First line	Owns day-to-day risk; designs, operates and monitors processes and controls; control self-assessment; objectivity constrained by operational ownership	IT operations patching servers, cloud platform teams, application owners, identity administrators, the service desk resetting credentials, developers managing secrets
Second line	Expert support, advice, challenge, monitoring and thematic reviews in specialist areas such as compliance and cybersecurity; sufficiently objective to challenge the first line	CISO policy and standards function, security risk management, IT risk in the risk function, privacy and compliance
Internal audit (third line)	Independent, objective assurance and advice on governance, risk management, compliance and control; reports functionally to the board	Cyber audits under the IIA Cybersecurity Topical Requirement, assurance over the second line's own effectiveness
External assurance providers	Outside the three lines; external audit, regulators and accreditation bodies serve external parties	External auditors testing IT general controls, ISO/IEC 27001 certification bodies, regulators, SOC 2 auditors

The statement adds a useful rule for consultants: external service providers engaged for reviews or advice are categorised by the function that engages and directs them. A penetration test commissioned by the CISO is second line evidence; the same test commissioned and directed by internal audit is third line evidence.

Where the CISO sits

The Three Lines Model describes roles, not departments, and the CISO's team usually performs both first and second line activities. The aim is not a perfect org chart but clarity about which hat is being worn for each activity.

Security activity	Usual line	Why
Operating the SOC, EDR, firewalls and email security	First	Day-to-day operation of controls
Administering the identity provider, PAM vault and secrets manager	First	Operating identity controls
Writing security policy and standards	Second	Sets expectations for the first line
Cyber risk assessment and the cyber risk register	Second	Independent view of risk across owners
Control monitoring, compliance checks and thematic reviews	Second	Challenge and oversight of first line controls
Approving security exceptions	Second, with first line risk owner accepting	Challenge belongs to the second line; acceptance belongs to the owner within appetite
Independent assurance on the security programme	Third	Must be outside the CISO's management

Reporting line options

CISO reports to the CIO or CTO: close to operations and good for execution, but the challenge role over IT is weaker because the CISO reviews their own manager's area. Compensate with a dotted line to the CRO or a board committee.
CISO reports to the CRO: clearest second line positioning; risks distance from engineering, so operating controls usually move to IT.
CISO reports to the CEO or COO: high visibility and authority; still requires a clear split between operating and oversight activities.
Split model: a security operations leader in IT (first line) and a smaller security risk and governance team in risk (second line). Common in banks and large regulated firms.

Small organisations rarely have a separate second line for cyber. A part-time or virtual CISO, a risk committee and a co-sourced internal audit can still give the board distinct sources of assurance. See the vCISO Guide and the CISO Guide: First 90 Days.

Independence and objectivity

The statement grounds independence in five things: reporting lines and authority, autonomy over scope and planning, unrestricted access, control over resources, and protection from undue influence. For cyber this has concrete consequences.

Cooling-off period: the IIA states that at least 12 months between responsibility for a process and assuring it is typically sufficient. A security engineer who moves into internal audit should not audit the platform they built in that period.
Advisory before assurance: if internal audit advised on the design of a new identity governance platform, the statement identifies familiarity and self-review threats; define the advisory role, avoid management decisions and tell the board.
Internal audit doing second line work: the statement calls this a direct self-review threat. Safeguards are a documented justification, full disclosure to the board, independent assurance of that area by another party for the duration, and periodic re-evaluation.
Chief audit executive supervising another function: for example, a CAE who also oversees compliance or a cyber monitoring team. Safeguards focus on documented responsibilities (the supervised function keeps operational ownership), board approval of the expanded remit, periodic independent review and ongoing board communication. The statement notes that some highly regulated contexts prohibit such arrangements.
Access: internal audit needs read access to security tooling, logs and identity data. Audit accounts are themselves privileged non-human and human identities that need the same controls as any other.

Integrated assurance and the assurance map

The statement prefers the term integrated assurance and describes it as a more mature form of coordination, not a structural requirement. Reliance on others' work should be thoughtful and overseen by the board, and internal audit can decline to rely on work that does not meet quality expectations. The practical tool is an assurance map.

Cyber risk area	First line monitoring	Second line oversight	Internal audit	External
Privileged and non-human access	Monthly entitlement reports, vault alerts	Quarterly access review oversight, policy compliance checks	Identity audit every year	ITGC testing by external auditor
Vulnerability management	Patch dashboards, SLA tracking	Exception approvals, trend reporting	Audit every 2 years	Penetration test
Third-party access	Vendor onboarding checks	Third-party risk assessments	Audit every 2 years	Supplier SOC 2 reports
Incident response	Runbooks, on-call metrics	Exercise programme	Readiness audit	Regulator inspection
Cloud configuration	Posture management alerts	Standards and deviation review	Cloud audit annually	ISO/IEC 27001 surveillance audit

Agree a shared risk taxonomy with the risk function so every provider uses the same names for cyber risks.
List assurance providers and activities for each risk, including management self-assessments and external reports.
Rate the strength of each source: independence, scope, frequency, competence and evidence quality.
Identify gaps and overlaps and decide where internal audit will rely, test independently or recommend new monitoring.
Align reporting so the board sees one picture of cyber assurance, not three conflicting ones. See the Board Cyber Risk Reporting Guide.
Refresh annually and after major change such as a cloud migration, acquisition or reorganisation of the security function.

The statement allows internal audit to facilitate this coordination given its organisation-wide view, but warns it should avoid owning second line activities.

Implementing the model for cyber

Baseline: list current cyber activities and who performs them. Most organisations find the security team doing all three lines in part.
Assign risk ownership: give each major cyber risk a first line owner in the business or technology, recorded in the risk register. See the Risk Register Template.
Write a RACI: for policy, control operation, monitoring, exception approval, risk acceptance and assurance. Approve it through the security governance committee. See the Security Governance Committee Charter Template.
Document the CISO's dual roles and the safeguards for any first line activity, such as independent review of controls the security team operates.
Update charters: the internal audit charter should record any blended or supervisory responsibilities of the chief audit executive, as the statement suggests.
Build the assurance map and agree reliance with external auditors.
Pilot on one risk area, such as privileged access, for one reporting cycle, then extend.
Review: if the model creates delay or duplicated testing, revisit the RACI rather than reverting to informal arrangements.

Measuring whether it works

Risk ownership coverage: percentage of cyber risks in the register with a named first line owner.
Assurance coverage: share of high cyber risks with at least one independent source of assurance in the last cycle.
Overlap: number of controls tested by more than one line without planned reliance.
Second line challenge: number of first line risk assessments or exceptions changed after second line review.
Self-identified versus audit-identified issues: a rising share found by the first and second lines shows the model working.
Overdue cyber actions: agreed actions past their due date, by line.

Framework mapping

Model element	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Board oversight and risk appetite	GV.RM-01; GV.OV-01, GV.OV-02, GV.OV-03	PM-9 Risk Management Strategy
Defined roles and accountability	GV.RR-01, GV.RR-02	PM-2 Information Security Program Leadership Role
Resourcing the lines	GV.RR-03	PM-3 Information Security and Privacy Resources
Cyber risk in enterprise risk management	GV.RM-03	PM-9 Risk Management Strategy
Second line monitoring	GV.OV-03	CA-7 Continuous Monitoring
Independent assurance	ID.IM-01	CA-2 Control Assessments; CA-2(1) Independent Assessors
Relying on external assurance	GV.SC-07	CA-2(3) Leveraging Results from External Organizations

ISO/IEC 27001:2022 does not use the three lines language, but clause 5.3 (roles, responsibilities and authorities), clause 9.2 (internal audit) and Annex A 5.35 (independent review of information security) support the same separation. See the NIST CSF 2.0 Guide.

Common failure patterns

The CISO marks their own homework: the security team operates controls, assesses them and reports their effectiveness to the board, with no independent view.
No first line ownership: cyber risk is "owned" by the security team, so business leaders never make the trade-offs. Non-human identities are a common example: service accounts and API keys owned by no one, so none of the lines checks them. The Cloudflare Thanksgiving breach traced back to a few service credentials left unrotated because they were wrongly believed unused.
Weak second line risk assessment before major change: in the Capital One breach, the US OCC cited a failure to establish effective risk assessment processes before moving significant IT operations to the public cloud, and a failure to correct deficiencies in a timely manner.
Internal audit absorbed into operations: audit staff run access reviews or vulnerability scans "temporarily" for years without board disclosure or independent cover.
Silos instead of coordination: three teams test the same quarterly access review while cloud and third-party access go untested.
Model on paper only: a RACI exists but exceptions are approved by the people who requested them.

Practitioner checklist

Read the IIA Three Lines Model Statement of Position and retire references to the 2020 paper in policies and charters.
Assign a named first line owner to every major cyber risk, including non-human identity risk.
Classify each security team activity as first or second line and document safeguards for dual roles.
Confirm the CISO has a route to the board or a board committee independent of the operations they oversee.
Record any blended or supervisory roles of the chief audit executive in the internal audit charter and tell the board.
Apply a cooling-off period of at least 12 months before staff assure processes they ran.
Build and maintain a cyber assurance map with a shared risk taxonomy.
Agree reliance arrangements with external auditors and certification bodies.
Track the six metrics above and report them to the risk or audit committee.

Three Lines Model for Cyber Risk Guide: Roles, Independence and Assurance