Where Should the CISO Report? CEO, CIO, CRO or Counsel

Where the CISO reports decides who can quietly overrule security, whose budget security competes with, and whether bad news reaches the board intact. Boards and executives revisit the question after an incident, a regulatory finding or a new CISO hire, and the debate usually collapses into "CIO or CEO". This guide compares the four common lines, CEO, CIO or CTO, Chief Risk Officer and General Counsel, plus the COO and CFO variants, against what regulators and supervisors actually require. It covers the conflicts each line creates, the safeguards that make any line workable, decision guidance by size and sector, how to change a line without losing momentum, and how to measure whether the arrangement works. It is written for CEOs, board members, CISOs and the executives they might report to. For the wider structure of the security function, see the Security Operating Model and Organisation Design Guide.

Key takeaways

Independence is the real requirement, not a job title. Supervisors ask for authority, segregation from the people whose work security challenges, and direct access to the board; few prescribe a single executive.
Reporting to the CIO is a known conflict. The US FFIEC Information Security booklet says information security officers should be independent of IT operations staff and should not report to IT operations management.
Every line needs the same three safeguards. A written right of direct access to the board or its risk or audit committee, a recorded process for overruling security, and an escalation path for incidents that does not depend on the line manager.
Match the line to the function's job. A CISO who mainly runs operations needs proximity to technology; a CISO who mainly provides oversight and challenge needs distance from it. Many large firms split the two.
Measure the arrangement. Time to escalate, overruled decisions, findings closed by the CIO's estate and board time given to cyber show whether the line works in practice.

What the reporting line actually controls

A reporting line is shorthand for five things that matter more than the organisation chart:

Agenda: whose priorities set the security roadmap, and whether security work competes for the same budget as the projects it reviews.
Escalation: how fast and how unfiltered a material risk or incident reaches the CEO and the board.
Challenge: whether the CISO can report that a peer's or their own manager's systems are out of tolerance without career risk.
Leverage: whether the CISO can get engineering and operations teams to act on findings quickly.
Stature: whether the CISO is in the rooms where acquisitions, product launches and outsourcing decisions are made early enough to shape them.

No single line maximises all five. Leverage tends to be highest under the CIO; challenge and escalation tend to be strongest under the CEO or a risk function. The design task is to choose the line that fits the CISO's main job, then compensate for the weaknesses in writing.

What regulators and supervisors say

Most rules require accountable leadership, adequate authority and board reporting rather than a specific manager. The closest any major source comes to prescribing a line is the FFIEC position on IT operations.

Source	What it requires or expects	Effect on the reporting line
FFIEC IT Examination Handbook, Information Security booklet (September 2016)	Information security officers should report directly to the board or senior management, have sufficient authority, stature, knowledge and independence, and be independent of IT operations staff, not reporting to IT operations management	Strongest supervisory signal against a CISO line into IT operations at US banks
NYDFS 23 NYCRR 500.4 (amended effective 1 November 2023)	Covered entities designate a CISO; the CISO reports in writing at least annually to the senior governing body and timely on material cybersecurity issues; the governing body oversees risk management and confirms sufficient resources	Requires a direct CISO channel to the board whatever the line
EU DORA, Regulation (EU) 2022/2554, Articles 5 and 6	Management body bears ultimate responsibility for ICT risk; ICT risk management is assigned to a control function with an appropriate level of independence to avoid conflicts of interest, with segregation of ICT risk management functions under a three lines or internal risk and control model; the framework is subject to internal audit	Pushes financial entities to separate ICT risk oversight from ICT operations, often under the CRO
EU NIS2 Directive (EU) 2022/2555, Recital 137	Management bodies should approve cybersecurity risk-management measures and oversee their implementation	Board accountability; no prescribed line
US SEC Regulation S-K Item 106	Listed companies describe in Form 10-K the board's oversight of cybersecurity risk and management's role, including the relevant expertise of those managers	The line, and how the board hears from the CISO, becomes a public disclosure
UK Cyber Governance Code of Practice (April 2025)	Clearly defined roles with cyber ownership at executive and non-executive level, formal reporting at least quarterly and regular two-way dialogue with the CISO or equivalent	Board access and dialogue, not a specific line

For the detail of each regime, see the NYDFS Part 500 Guide, the DORA Guide, the SEC Cybersecurity Disclosure Rules Guide and the UK Cyber Governance Code of Practice Guide.

The options compared

CISO reports to	Best fit	Main strength	Main conflict or risk	Compensating control
CEO	Firms where security is core to the product or licence; post-incident rebuilds	Mandate, stature, unfiltered escalation	CEO bandwidth; weaker day-to-day leverage over IT	Joint objectives and an interface agreement with the CIO or CTO
CIO or CTO	Smaller firms; security still mostly technical delivery	Proximity to engineering, fast execution	Security findings criticise the manager's own estate; shared budget	Direct board or committee access; separate budget line; independent testing
Chief Risk Officer	Regulated financial services; CISO acting mainly as second line	Independence, enterprise risk framing, aligned with three lines models	Distance from engineering; risk of becoming a compliance reviewer	Operational security engineering in IT with a dotted line to the CISO
General Counsel	Privacy-heavy or litigation-exposed businesses	Legal privilege and disclosure discipline; independence from IT	Legal framing can slow engineering decisions; privilege can be over-used	Clear rules on what is privileged; technical leadership retained in security
COO or CFO	Operations-led or cost-focused firms; CISO covering physical and operational resilience	Business process view; budget authority	Security judged mainly on cost; limited technical understanding	Risk-based funding case; board risk committee access

Reporting to the CEO

When it is chosen: security is part of the product (payments, identity, security vendors, critical infrastructure), the business is rebuilding trust after an incident, or the board wants a single accountable executive for cyber risk. What can go wrong: the CEO cannot give the CISO the time a CIO would, so the CISO becomes visible but isolated, and IT teams see security as an external auditor. What makes it work: a monthly one-to-one that actually happens, a written interface agreement with the CIO and CTO covering change, architecture and incident roles, and shared objectives so security outcomes appear in technology leaders' goals too.

Reporting to the CIO or CTO

When it is chosen: it is the historical default because security grew out of IT, and it works well where the security function is small and mostly builds and runs controls. What can go wrong: the CISO's findings are about the CIO's own estate and projects. When a release date, a cost target or an outsourcing decision conflicts with a security risk, the person who decides is the one whose objectives are at stake. The FFIEC guidance names this directly as a segregation of duties problem. What makes it work: a ring-fenced security budget, a documented right of direct access to the audit or risk committee without the CIO present, independent testing of controls by internal audit or a second-line team, and a rule that accepting a risk above appetite needs a decision-maker other than the CIO.

Reporting to the Chief Risk Officer

When it is chosen: regulated financial services, where DORA and similar regimes expect ICT risk oversight to be independent and segregated, and where the CISO's main role is to set policy, assess risk and challenge. What can go wrong: the CISO loses contact with engineering, findings turn into compliance tickets, and operational security drifts back into IT without clear leadership. What makes it work: an explicit split, with an operational security leader in technology owning SOC, IAM and engineering, a dotted line between that leader and the CISO, and a clear statement of which team is first line and which is second line. The Three Lines Model for Cyber Risk Guide covers how to draw that split.

Reporting to the General Counsel

When it is chosen: organisations with heavy privacy exposure, regular litigation, or a combined privacy and security office; sometimes after an incident where disclosure handling went wrong. What can go wrong: engineering decisions become legal negotiations, and legal privilege is applied so widely that the board and auditors see less, not more. What makes it work: a written privilege protocol that covers forensic reports and incident investigations without hiding routine risk reporting, technical decision rights retained by the CISO, and the same direct board access as any other line. The CISO's own exposure in disclosure decisions is covered in the CISO Personal Liability Guide.

Reporting to the COO or CFO

When it is chosen: organisations where operational resilience, physical security and fraud are joined with cyber, or where the CFO owns enterprise risk. What can go wrong: security is managed mainly as a cost line. What makes it work: a risk-based budget case linked to the risk appetite statement, and a security risk report that reaches the board risk committee directly. See the Security Budget and Investment Planning Guide.

Decision guidance

Start with the CISO's main job: if most of the role is running controls and operations, a technology line with strong safeguards is workable; if most of it is oversight, challenge and board reporting, choose a line outside IT.
Regulated financial services: expect supervisors to look for independence from ICT operations. A CISO under the CRO with an operational security leader in technology, or a CISO under the CEO with a second-line technology risk team under the CRO, are both common and defensible designs.
Small organisations (one to five security staff): a CIO line is usually practical. Write the board access right and the risk acceptance rule anyway, and consider an external or internal audit review of security each year to supply independence.
Mid-sized organisations: the move from CIO to CEO or COO usually happens when security starts reporting to the board on its own, or when the first major incident shows that escalation through IT was too slow.
Large and multi-business organisations: the question shifts from one line to a split of duties. Decide where second-line cyber risk oversight sits, where operational security sits, and how business-unit security officers connect to both.
Product security and technology companies: where the CTO owns the product, a CISO reporting to the CEO with a strong peer relationship to the CTO avoids security reviewing its own manager's product decisions.
Interim and part-time CISOs: the same safeguards apply to a vCISO; write them into the contract. See the vCISO Guide.

The safeguards that make any line work

Whatever the line, document these in the CISO's role charter and the board or committee terms of reference:

Safeguard	What to write down	Why it matters
Direct board access	Right to attend the audit or risk committee and meet its chair without the line manager present, at least annually and on request	Lets material risk bypass a conflicted manager; NYDFS requires a written annual CISO report to the governing body
Risk acceptance authority	Who can accept a security risk at each level, with the decision recorded and the CISO's view attached	Stops quiet overrides; shows the board who owns residual risk
Incident escalation	Triggers for informing the CEO, General Counsel and board; who decides materiality and disclosure	Escalation must not depend on one person; disclosure deadlines are short
Budget visibility	Security budget shown as its own line with its own business case	Prevents security being traded against the projects it reviews
Independent assurance	Internal audit or second-line testing of security controls on a set cycle	Separates the team that runs controls from the team that says they work
Interface agreements	Written roles between the CISO and CIO, CTO, CRO and General Counsel on change, architecture, risk and incidents	Fills the gaps any single line leaves

For what the board report itself should contain, see the Board Cyber Risk Reporting Guide; for which committee should own cyber, see Security Steering Committee vs Board Risk Committee.

Where identity fits

Identity is often the first place a reporting line conflict shows. Identity and access management frequently sits in IT operations while identity risk, privileged access and non-human identity governance sit with the CISO. If the CISO reports outside IT, write down who owns the identity platform, who owns access policy and who certifies access, so that service accounts, API keys and workload identities do not fall between teams. See the NHI Ownership Guide.

How to change a reporting line

Diagnose first: collect evidence of the problem (slow escalations, overruled findings, budget trade-offs, audit or supervisory comments) rather than starting from a preferred title.
Agree the CISO's main job: operations, oversight or both. If both, decide whether to split operational security from second-line oversight.
Pick the line and draft the safeguards together: board access, risk acceptance, escalation, budget and interface agreements are part of the decision, not follow-up work.
Brief the board or its committee: the committee should approve the change, since it changes how it hears about cyber risk. Listed companies should check whether the change affects the description of management's role in their annual disclosure.
Move people and budgets in one step: avoid a period where the CISO reports to one executive but the team and budget sit with another.
Run a test escalation: a tabletop exercise with the new line in place shows whether escalation and disclosure decisions now flow as designed. See the Tabletop Exercise Guide.
Review after two quarters: check the metrics below; if escalation or leverage has worsened, adjust the interface agreements before changing the line again.

Rollback is rarely a reversal of the line itself; it is usually a correction of the safeguards. Frequent changes of reporting line damage the CISO's standing more than an imperfect line with strong safeguards.

Measuring whether it works

Metric	How to measure	Healthy signal
Escalation time	Time from a material security issue being identified to the CEO and board chair being informed, from incident records	Within the time set in the escalation policy, every time
Overruled decisions	Security recommendations overruled per quarter, with who decided and whether it was recorded	All overrides recorded by an authorised decision-maker
Risk acceptance hygiene	Share of accepted risks with an owner, expiry date and CISO view attached	Close to 100%
Findings ageing by owner	Overdue security findings grouped by owning executive, including the CISO's own manager	No executive's estate consistently ageing worse than others
Board time on cyber	Committee minutes: minutes spent on cyber and private sessions with the CISO per year	Regular agenda time and at least one private session a year

Common failure patterns

The line changes, the safeguards do not: the CISO moves to the CEO, but risk acceptance still sits with the CIO and budgets stay in IT, so nothing changes in practice.
Escalation filtered by the line manager: bad news is reworded or delayed on its way to the board because it reflects on the manager's own area.
Second line with no first line: the CISO moves under the CRO and the operational security work that used to be led by the CISO has no owner in IT.
Privilege over-used: under the General Counsel, routine risk reports are marked privileged and stop reaching the auditors and committees that need them.
Title without access: a "reports to the CEO" CISO who never gets time with the CEO or the board, and whose stature exists only on the chart.
Disclosure decisions resting on one person: materiality and notification decisions made by the line manager alone, without the CISO, General Counsel and a disclosure committee.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	GV.RR-01	Leadership responsible and accountable for cybersecurity risk
NIST CSF 2.0	GV.RR-02	Roles, responsibilities and authorities established, communicated and enforced
NIST CSF 2.0	GV.RM-01	Risk management objectives established and agreed by stakeholders
NIST SP 800-53 Rev. 5	PM-2, PM-29	Information security programme leadership role; risk management programme leadership roles
ISO/IEC 27001:2022	Clause 5.3; Annex A 5.2, 5.3	Roles, responsibilities and authorities; information security roles; segregation of duties
EU DORA	Articles 5(2), 6(4), 6(6)	Management body responsibility; independent ICT risk control function; internal audit
NYDFS Part 500	500.4	CISO designation, annual and timely reporting to the senior governing body

Practitioner checklist

State the CISO's main job (operations, oversight or both) before debating the line.
Check sector rules: FFIEC expectations, NYDFS 500.4, DORA Articles 5 and 6, NIS2 and SEC disclosure.
Write the CISO's right of direct access to the audit or risk committee into its terms of reference.
Define who can accept security risk at each level and record every acceptance with the CISO's view.
Set incident escalation triggers to the CEO, General Counsel and board that bypass the line manager.
Show the security budget as its own line with its own business case.
Arrange independent testing of security controls by internal audit or a second-line team.
Agree written interfaces between the CISO and the CIO, CTO, CRO and General Counsel.
Track escalation time, overruled decisions and findings ageing by executive every quarter.

Where Should the CISO Report: CEO, CIO, CRO and General Counsel Options Compared