Notifications
Clear all
Topic starter
12/06/2026 12:47 am
TL;DR: When CIOs and CISOs fail to align on priorities, communication, and reporting, organisations face slower security decisions, duplicated effort, and greater exposure to breaches and compliance gaps, according to Zluri. The governance problem is not collaboration style, but the absence of shared control over identity, access, and SaaS visibility.
NHIMG editorial — based on content published by Zluri: IT Teams Strategies for CIOs and CISOs to Work Together Effectively
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
Questions worth separating out
Q: How should CIO and CISO teams share ownership of access governance?
A: They should define one governance model for inventory, approval, and remediation, with explicit decision rights for each step.
Q: Why do shadow SaaS and unmanaged identities create executive alignment problems?
A: Because hidden applications create hidden access paths, and hidden access paths bypass normal review and offboarding.
Q: What breaks when reporting between CIO and CISO teams is informal?
A: Informal reporting usually means findings are discussed without a clear path to enforcement.
Practitioner guidance
- Create one authoritative SaaS and identity inventory Use a single system of record for applications, owners, access paths, and exceptions so CIO and CISO teams stop debating the facts.
- Define joint escalation rules for access and risk issues Document who can approve, reject, or force remediation when security findings affect availability, delivery timelines, or business workflows.
- Tie reporting to remediation deadlines Convert dashboards into action by setting target dates for app ownership, access review completion, and deprovisioning of stale identities.
What's in the full article
Zluri's full blog covers the operational detail this post intentionally leaves for the source:
- The four collaboration strategies broken down into practical team behaviours and meeting cadence.
- The SaaS management angle behind the shared visibility discussion, including how the platform positions inventory and reporting.
- The specific ways Zluri describes centralized management, streamlined communication, and customizable dashboards for joint CIO-CISO oversight.
- The article's own examples of how the platform is intended to surface shadow applications and reduce friction between teams.
👉 Read Zluri's article on CIO and CISO collaboration strategies for identity and SaaS governance →
CIO and CISO alignment: what IAM teams need to fix?
Explore further
12/06/2026 10:15 am
Executive alignment is an identity governance control, not a soft-management concern. The article treats CIO-CISO collaboration as coordination, but the deeper issue is control ownership across identity, access, and SaaS visibility. When those responsibilities are split without a shared model of inventory and accountability, governance becomes advisory instead of enforceable. Practitioners should treat executive alignment as part of the access control operating model, not as an adjacent leadership habit.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: How do organisations know whether executive collaboration is improving identity security?
A: Look for shorter time from risk identification to remediation, fewer unowned applications, and fewer repeated exceptions in access reviews. If collaboration is working, teams should be able to prove who owns each app, who approved each exception, and when each entitlement will be closed.
👉 Read our full editorial: CIO and CISO alignment is now an identity governance issue
