What is a CISO? The chief information security officer, defined

A chief information security officer (CISO) is the executive accountable for an organization's cybersecurity program: setting its security strategy and policy, running the security function, answering for incidents, and reporting the resulting risk to senior management and the board. The title marks who holds final accountability for security risk, not who is the most senior security engineer.

How rules and standards define the seat

New York's Department of Financial Services (NYDFS) gives the title legal force for the banks, insurers and other firms it licenses. Its cybersecurity regulation, 23 NYCRR Part 500, defines the CISO as "a qualified individual responsible for overseeing and implementing a covered entity's cybersecurity program and enforcing its cybersecurity policy." Each covered entity must designate one. The CISO must report in writing at least once a year to the senior governing body, which the rule defines as the board, a board committee or an equivalent body.

In US federal agencies the seat has a statutory lineage. The NIST glossary treats CISO as a synonym for the senior agency information security officer, the official who carries out the agency chief information officer's responsibilities under the Federal Information Security Modernization Act (FISMA). CISA's NICE Workforce Framework calls the matching work role Executive Cybersecurity Leadership: it sets the vision and direction for an organization's cybersecurity operations and resources, and holds authority to make decisions that affect the organization broadly.

Why the SEC does not require the title

The Securities and Exchange Commission (SEC) proposed that public companies disclose whether they have a designated CISO, then left that element out of the final rule adopted on 26 July 2023. Its reasoning: naming the management positions responsible for cybersecurity risk, with their expertise, would typically show whether a company has a CISO or someone in a comparable position. The title is optional for a US public company. Describing who runs the function is not.

What the title is not

A job title containing CISO does not always mean the seat. A deputy CISO runs part of the program under the CISO. An interim CISO covers the seat until a permanent appointment. A field CISO advises a vendor's customers and runs no one's internal program. Where a company calls its top security role chief security officer (CSO), CISO Tribune records it as the same seat.

How CISO Tribune records the seat

The Wire records appointments and departures in the top security seat only. Its editorial gate rejects titles qualified as deputy, assistant, associate, acting, interim or field CISO, because none of them holds final accountability. Company pages show each seat's succession, and the open seats board lists seats where a confirmed departure has no confirmed successor yet. The full mandate, from strategy to the board conversation, is in What does a CISO do?.

Related terms

• CISO reporting line
• Regulation S-K Item 106
• Board cybersecurity oversight
• CISO tenure