CISO Reporting Structure, the Five Models and What the Filings Show

TL;DR: Chief information security officers (CISOs) report to one of five places: the chief information officer, the chief executive officer, the chief technology or operating officer, the general counsel or chief risk officer, or a board committee. In the IANS and Artico Search 2026 benchmark, 64% still report into information technology (IT) leadership. Each line trades off budget, independence and board access. Many 10-K filings do not name the line at all.

Who does the CISO report to at most companies?

Most chief information security officers (CISOs) still report into information technology (IT) leadership, but a large minority do not. In the IANS and Artico Search 2026 benchmark, 64% of CISOs report into IT leadership. The other 36% report to business leaders such as the chief executive officer, the chief operating officer, the general counsel or the chief risk officer. That survey drew on responses from 662 CISOs collected between April and November 2025.

Of the 416 appointments on the Wire as of October 23, 2026, the chart shows how many carried each top security title, from CISO at 386 to VP of security at 1.

Our own record tracks titles, not reporting lines. Of 416 appointments on the Wire, 386 carried the CISO title. Chief security officer came a distant second with 16, and combined chief information officer and security titles were rare. For a definition of the role, see CISO.

Titles are moving up

The same benchmark found that executive-level titles are spreading. In large enterprises, executive-level representation rose from 33% in 2023 to 47% in 2025. It also found that executive-level CISOs are more likely than their vice president (VP) or director-level peers to report outside of IT. In our reading, the title and the reporting line tend to move together. A promotion in title often comes with a different boss.

What the filings show, and what they leave out

US public companies describe cybersecurity governance in Item 1C of the annual Form 10-K. Some name the reporting line outright. Many do not.

The gap matters. A filing that names a board committee for oversight describes how the board hears about risk. It does not say who the security leader works for day to day.

When you read a peer's 10-K, check three things: whether a CISO is named, whether the text says who that person reports to, and whether the board update comes from the CISO or from someone above. Our guide to reporting lines in 10-K filings walks through more examples. The reporting lines report and the disclosures tracker carry the wider set.

The five reporting models and the trade-offs each creates

Each reporting line shapes three things a chief information security officer (CISO) needs: money, a voice that is not filtered, and a path to the board. No single model delivers all three. The table below sets out the trade-offs as we read them, and the conflict points are the ones that tend to surface in a crisis.

One finding frames the comparison. IANS and Artico Search report that "Executive-level CISOs are significantly more likely to report outside of IT to these other business leaders than their VP- or director-level peers". In our reading, the reporting line and the title tend to move together.

How to read the table

The CIO line is the default for a reason: security and IT share tools, staff and vendors, and the budget conversation is simpler. The cost is that the CISO grades the work of the person who grades the CISO. Some companies soften this with a dotted line to the general counsel or a standing session with the audit committee.

In our reading, it works only when the CEO keeps a fixed cadence. Without one, a direct report with no recurring agenda slot can see less of the CEO than a CIO's deputy does.

The legal and risk line suits regulated firms where disclosure and control testing dominate the job. Watch the engineering relationship closely here. A business information security officer (BISO) inside the product groups can carry security into delivery teams that the CISO no longer sits beside.

A board committee rarely serves as the only line. We think it works as a second channel: a guaranteed audience if management and security disagree.

For how these choices show up in public filings, see CISO reporting lines in SEC 10-K filings and our reporting lines report.

What are the arguments for reporting outside IT?

The case for a line outside the chief information officer (CIO) rests on three arguments. None of them says the CIO is the problem. They say the structure puts the chief information security officer (CISO) where certain conflicts are predictable.

Independence

When the CISO reports to the person who runs the systems under review, findings about those systems reach the top through their owner. A critical gap in a platform the CIO chose and funded has to be escalated by someone whose performance review the CIO writes.

In our reading, that is the core of the independence argument. It is less about distrust and more about an awkward route for bad news.

Budget conflict

Under a CIO, security and IT usually draw from one budget. A data loss prevention rollout competes with a cloud migration or an enterprise resource planning upgrade. The CIO makes a sensible call for IT, and the security work slips a quarter.

We think boards find this argument the easiest to follow, because it shows up in budget documents rather than in organizational theory.

Risk framing

Surveys describe a role that has moved past technology. The IANS and Artico Search 2026 benchmark says CISOs are increasingly expected to serve "not only as technical leaders but also as enterprise-wide digital risk strategists" (IANS). A line to the chief executive officer, general counsel or chief risk officer presents security as business risk, not as an IT line item.

The same report found that executive-level CISOs are significantly more likely to report outside IT than their vice president- or director-level peers (IANS). That is a correlation. It does not show that moving the line raises the title, or the reverse.

The operational case against

Most controls run on IT systems. A CISO outside IT needs patching, identity changes and network rules delivered by teams that do not report to them. In our reading, that distance can slow incident response and turn the CISO into a reviewer rather than an operator.

Scope is the other concern. The report found that more than half (52%) of CISOs say their scope is no longer fully manageable (IANS). Adding business-facing duties to a stretched role can make that worse. The survey drew on 662 CISOs, with data collected between April and November 2025 (IANS).

For definitions, see CISO reporting line. For who answers for what after an incident, see our guide to CISO accountability.

What 10-K governance disclosures show in practice

Two recent Form 10-K filings show how much, and how little, Item 1C can reveal about where the chief information security officer (CISO) sits. Both describe board oversight in detail. Only one names the security leader's boss.

Egain: a named CISO with a stated reporting line

Egain Corp states the line plainly: "Our CISO, who reports to the Chief Financial Officer, leads the company" technology and security strategy. That single clause places the role in the finance-reporting model covered earlier in this guide.

The filing also describes "annual cybersecurity reporting to the board of directors by senior leadership". Oversight sits with the audit committee, which "is charged with oversight of data privacy and cybersecurity risks". The CISO gives the committee annual updates, meets the full board at least once a year, and must inform the Audit Committee immediately if an incident is deemed material.

Duluth Holdings: committee oversight, no CISO named

Duluth Holdings Inc. names no CISO. Its audit committee "is formally charged with oversight of cybersecurity risk". The risk work is split between two teams. Internal audit facilitates an annual risk assessment that includes cybersecurity, and a quarterly cyber risk assessment run by the information technology team, including its vice president of information technology, goes to the audit committee.

The committee chair then reports significant cybersecurity updates to the full board in executive sessions of its quarterly meetings. Duluth also sets a low escalation bar: incidents with moderate or higher business impact, even if immaterial, are reported to the audit committee.

How to find the line yourself

Open the company's latest 10-K on EDGAR and go to Item 1C, Cybersecurity. Then work through it in this order:

1. Search for "reports to". If the phrase is missing, the filing does not disclose the line.
2. Note which title leads the program. A CISO title and an IT vice president title suggest different structures.
3. Check who presents to the board or committee, and how often.
4. Read the escalation language for material and non-material incidents.

In our reading, a missing reporting line is itself a data point, though not proof of any particular structure. Our reporting lines report and board committee oversight report compare these disclosures across filers, and the glossary entry on the CISO reporting line defines the terms used here.

Does the reporting line change after a breach?

The pressure point is the clock. The deadline runs from the materiality determination, not from discovery. The rule asks companies to make that determination "without unreasonable delay" (SEC).

The filing has to cover the material aspects of the incident's nature, scope and timing (SEC). A delay is possible only when the United States Attorney General finds that immediate disclosure would pose a substantial risk to national security or public safety and tells the Commission in writing (SEC). Companies that are not smaller reporting companies had to comply by December 18, 2023. Smaller reporting companies had to comply by June 15, 2024 (SEC).

Why an incident puts the reporting line under review

What follows is our view, not a finding from the filings.

In our reading, a four-day window shows how information moves between security, legal, finance and the board. If the chief information security officer (CISO) sits two layers below the people who make the materiality call, the lag shows up fast. We think that is why boards often revisit the security seat after a material incident. The question is less about blame and more about whether the person holding the facts was in the room in time.

We also think the change, when it comes, tends to surface in the annual report, not in the incident filing. Item 106 asks companies to describe management's role and expertise in managing material cyber risk (SEC). It also asks whether cyber risks, including those from previous incidents, have materially affected the company or are reasonably likely to (SEC). That is where a new reporting line usually becomes readable.

How to track changes on the record

A practical routine:

• Pull the incident filing from our cyber incidents report and note the date.
• Compare the governance sections of the 10-Ks before and after the incident on the disclosures and companies pages.
• Check moves for a new security leader or a changed title at the same company.
• For how the materiality call itself gets made, see our Item 1.05 materiality decision guide.

How to negotiate a reporting line before you accept the seat

The reporting line is easiest to change before you sign. Once you start, every request to move it can read as a complaint about your new boss. We think the offer stage is when a hiring executive has the most reason to agree to terms.

It helps to know where most peers sit. In the IANS and Artico Search 2026 benchmark, 64% of chief information security officers (CISOs) still report into information technology (IT) leadership, and 36% report to business leaders such as the chief executive officer, chief operating officer, general counsel or chief risk officer. The same survey found that 52% of CISOs say their scope is no longer fully manageable. Scope is part of this negotiation too.

For public companies, there is also a disclosure angle. The Securities and Exchange Commission (SEC) rule, effective September 5, 2023, requires periodic disclosure of management's role in assessing and managing material cybersecurity risks and the board's oversight of those risks. What the company has already written in its 10-K gives you a baseline to test the interview answers against. Our disclosures pages collect those filings.

Questions to put to the hiring executive

Get it in writing

Verbal promises tend to fade after a reorganization. Before you accept, ask for these items in the offer letter or a role charter:

• The title of the person you report to, and what happens to the line if that person leaves.
• Your standing access to the board or its risk or audit committee.
• Your role in incident materiality decisions.

The disclosure questions overlap with personal exposure, which our guide on CISO personal liability covers. For how a company's answers may be read, put the specific wording to your own counsel.

If the answers stay vague, note it. A vague answer on escalation usually stays vague in a crisis. Once you are in the seat, the first 90 days plan covers how to test whether the agreed terms hold. Our reporting lines report has comparison data by company.

What this guide does not cover

This guide does not cover pay, executive search or how to structure the security team below the security leader. It describes what Securities and Exchange Commission rules say and what public filings show, and it is not legal or financial advice. Put questions about specific wording or personal exposure to your own counsel. For the rules and the record behind it, see Does the CISO Report to the CIO? What 22 SEC 10-K Filings Actually Say.