Should the CISO report to the CIO?

It is the most common structure and works when the biggest risks are inside the IT estate, but it creates a conflict of interest: the CISO ends up auditing the person who writes their performance review. Companies where security is an enterprise risk increasingly move the CISO out from under the CIO.

Do regulators care who the CISO reports to?

Increasingly, yes. NYDFS Part 500 requires covered financial firms to designate a CISO who reports on the security program to the board, and frameworks like NIST CSF 2.0 elevate governance as a first-class function. No US rule mandates a specific reporting line, but regulators expect the CISO to have real access to the board.

What is the best reporting line for a CISO?

There is no single best answer. The test is whether the CISO can escalate risk without their boss filtering it, has budget authority proportionate to their accountability, and gets board access more than once a year. Any line that passes that test can work; any line that fails it will not.

Analysis

Who should the CISO report to? The reporting-line decision, explained

CISO reporting lines compared — CIO, CTO, CEO, CFO, general counsel, and CRO — with the tradeoffs of each and what regulators increasingly expect.

By CISO Tribune Editorial · Published February 10, 2026 · 3 min read

TL;DR: The reporting line is not an org-chart detail — it decides whether security is treated as a technology cost or an enterprise risk. CISO-to-CIO is the most common structure and the most conflicted. The trend in regulated industries is out from under IT and toward the CEO, general counsel, or chief risk officer, with direct board access as the non-negotiable.

Why the reporting line matters more than the title

Two CISOs with identical titles can hold completely different jobs. One presents to the board quarterly, owns a budget, and can stop a product launch. The other files tickets upward through a CIO who also owns the systems being criticized. The difference is the reporting line. It determines three things: who filters the CISO's risk messages before leadership hears them, whose priorities set the security budget, and whether the CISO can survive delivering bad news.

What are the common CISO reporting structures?

CISO → CIO. Still the most common. Pros: proximity to the infrastructure and the people who run it, faster remediation. Cons: a structural conflict of interest — the CISO's findings are often about the CIO's own estate, and the CIO controls the CISO's budget, rating, and airtime. Security competes with uptime and delivery for the same dollar.

CISO → CTO. Common in product and software companies where the crown jewels are the codebase and the platform. Same conflict as the CIO model, shifted toward engineering velocity: the person accountable for shipping fast also grades the person paid to slow shipping down when it's unsafe.

CISO → CEO. The cleanest signal that security is an enterprise concern. Works when the CEO actually gives the role time; fails when "reports to the CEO" means fifteen minutes a quarter. Most defensible after an incident, in security-branded companies, and in businesses where trust is the product.

CISO → General counsel or chief risk officer. The fastest-growing pattern in regulated industries. It frames security as risk and liability rather than infrastructure, aligns incident response with privilege and disclosure decisions, and removes the IT conflict. The cost: distance from engineering, and a boss who may not speak the technical language.

CISO → CFO. Rare, and usually a sign the company sees security purely as spend to be controlled.

What do regulators expect?

No US regulation dictates the line, but the direction is unmistakable. NYDFS Part 500 requires covered financial-services companies to designate a CISO and have the security program reported to the board. The SEC's cybersecurity disclosure rules make public companies describe board oversight of cyber risk in the 10-K — awkward to draft when the CISO is three layers down in IT. NIST CSF 2.0 added Govern as a core function, formalizing what boards already suspected: security governance is board business.

How should a company decide?

Skip the org-chart theology and apply three tests. Escalation: can the CISO put a risk in front of the CEO and board without an intermediary softening it? Money: does the CISO control a budget matched to what they'll be blamed for? Access: does the CISO brief the board (or a committee) at least quarterly, alone in the room for part of it? A CIO-reporting CISO with all three beats a CEO-reporting CISO with none. Candidates evaluating an offer should test the same three — the answers predict whether the job is real.

Frequently asked questions

Should the CISO report to the CIO?: It is the most common structure and works when the biggest risks are inside the IT estate, but it creates a conflict of interest: the CISO ends up auditing the person who writes their performance review. Companies where security is an enterprise risk increasingly move the CISO out from under the CIO.
Do regulators care who the CISO reports to?: Increasingly, yes. NYDFS Part 500 requires covered financial firms to designate a CISO who reports on the security program to the board, and frameworks like NIST CSF 2.0 elevate governance as a first-class function. No US rule mandates a specific reporting line, but regulators expect the CISO to have real access to the board.
What is the best reporting line for a CISO?: There is no single best answer. The test is whether the CISO can escalate risk without their boss filtering it, has budget authority proportionate to their accountability, and gets board access more than once a year. Any line that passes that test can work; any line that fails it will not.

Sources

CISO Tribune Editorial

Editorial Desk

The CISO Tribune editorial desk reports on security leadership: who holds the role, who is leaving it, and what the moves mean. Every appointment entry is verified against a primary source before publication.