Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Governance Roles, the CISO and Reporting Lines
Who does what
| Role | Responsibilities |
|---|---|
| Board of directors | Accountable for information security; approves strategy and risk appetite; oversees through a committee |
| Executive management | Sets the tone; provides resources; owns business risks; supports the program visibly |
| Security steering committee | Senior cross-functional group that aligns security with business priorities and resolves conflicts |
| CISO / information security manager | Develops, runs and reports on the security program |
| Information owners | Business managers who classify their information, approve access and accept residual risk |
| Custodians | Usually IT: implement and operate the protection owners require |
| Users | Follow policy, protect credentials, report incidents |
| Internal audit | Independent assurance that the program works |
The CISO’s job
The chief information security officer (or information security manager) typically:
- develops the security strategy and program in partnership with the business
- advises management and the board on information risk, in business terms
- sets security policies and standards and oversees controls
- leads incident management and security operations
- measures and reports program effectiveness
- builds and leads the security team and manages its budget
The CISO manages the program. They don’t own the business’s risks; owners and senior management do.
Owners, custodians and users
These three roles appear constantly in exam questions:
- The information owner is a business manager. They decide how sensitive the information is, who may access it and whether remaining risk is acceptable.
- The custodian, usually IT, stores and protects the information as the owner directs: backups, access setup, hardening.
- Users use the information as authorised and follow policy.
A security administrator grants access as approved. They don’t decide who should have it.
Where the CISO reports
The reporting line decides whether the CISO’s warnings reach the people who can act on them. Reporting to the CEO, COO, chief risk officer or general counsel gives authority and independence from IT delivery. Reporting to the CIO is common, but can create a conflict: the person responsible for delivering IT projects on time also decides how much security slows them down. Many organisations add a dotted line to the board’s risk or audit committee.
Example. A CISO reports to the head of infrastructure, who delays a critical patch to protect a launch. The CISO’s warning never reaches the executive team. Moving the reporting line to the COO, with a dotted line to the risk committee, fixes the escalation path.
Writing roles down
- Job descriptions include security responsibilities for every relevant role, not just security staff.
- RACI charts show who is responsible, accountable, consulted and informed for each security process.
- The security policy names the key roles and lines of authority.
- Roles are communicated and reinforced, so people know what’s expected.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who is accountable for information security? | The board / senior management |
| Who classifies data and approves access? | The information owner |
| Concern with the CISO reporting to the CIO | Conflict of interest; reduced independence |
| The CISO’s main role | Develop and manage the program; advise on risk |
| Best way to clarify security responsibilities | Documented roles (e.g. RACI), communicated to all |
In short
- The board is accountable for information security; executive management provides resources and owns business risk.
- The CISO or information security manager develops, runs and reports on the security program; they don't own the business's risks.
- Information owners (business managers) classify data, approve access and accept residual risk; custodians (often IT) implement the protection.
- The CISO should report high enough, and independently enough of IT delivery, to raise risks without being overruled.
- Roles and responsibilities should be written down (job descriptions, RACI) and communicated.
- Clear lines of authority let the security manager escalate issues quickly when risk exceeds appetite.
Exam traps
- Security is everyone's responsibility, but accountability must be assigned to named roles.
- The CISO doesn't accept business risk on the owner's behalf.
- A CISO reporting to the CIO can face conflicts between security and delivery deadlines.
- IT is usually the custodian of data, not its owner.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Who does what
Where the CISO reports
ExampleA CISO reports to the head of infrastructure, who delays a critical patch to protect a launch. The CISO's warning never reaches the executive team. Moving the reporting line to the COO, with a dotted line to the risk committee, fixes the escalation path.
1 / 9