What is a BISO? The business information security officer, defined

A business information security officer (BISO) is a security leader assigned to a specific business unit, segment or region, who carries the CISO's program into that business and carries the business's risks back to central security. The role appears in large, multi-business companies, where one central team cannot follow the risk context of every line of business on its own.

How companies describe the role

Public companies sometimes name BISOs when they explain, in Item 1C of Form 10-K, how their security program reaches the business. IBM's annual report for 2025, filed on 24 February 2026, lists its BISOs among the teams its CISO is responsible for, next to enterprise incident response and the product security incident response team. IBM describes the BISOs as focused on security issues specific to particular business segments.

The same filing places the BISOs in the incident loop. IBM's computer security incident response team works with the office of the CISO, cyber legal staff and the BISOs on a continuing review of incidents, threat intelligence, detections and vulnerabilities, including their impact on clients and regulators.

Why it matters to a CISO

The BISO model depends on a clear answer to one question: whose authority does the BISO carry? The NIST Cybersecurity Framework 2.0, published on 26 February 2024, sets that as a governance outcome: roles, responsibilities and authorities for cybersecurity risk management should be established, communicated, understood and enforced. A BISO who answers to a business head, to the CISO, or to both needs that answer written down before an incident tests it.

For a public company, the structure can also end up in the annual report. Regulation S-K Item 106 asks which management positions or committees are responsible for assessing and managing cybersecurity risk, and how they are informed about incidents. A company that relies on BISOs to do that work in its business segments may describe them there, as IBM does.

What it is not

A BISO is not a deputy CISO: the deputy is second-in-command of the central program, while the BISO localizes it inside one business. A BISO is not the top security seat, so CISO Tribune's Wire, which follows that seat, records a BISO only on promotion into it. Nor is a BISO a field CISO, who advises a vendor's customers rather than any part of the employer's own business.

Where it appears on CISO Tribune

• What is a BISO?: how the model works and when a company needs it.
• Item 1C disclosures: the governance text where companies describe roles like this one.
• The CISO title stack: how security titles combine and split.

Related terms

• Chief information security officer (CISO)
• CISO reporting line