CISO vs CIO vs CSO vs CTO: Who Owns What

TL;DR: The chief information security officer (CISO) owns the security program and the risk it exists to manage, while the chief information officer (CIO) builds and runs information technology (IT). A chief security officer (CSO) can mean the same job as a CISO or a wider seat that adds physical and personnel security. The chief technology officer (CTO) usually decides what the company builds and how. Titles vary, so check charters, not names.

What is the difference between a CISO and a CIO?

The short answer: the chief information security officer (CISO) owns the security program and the risk it exists to manage. The chief information officer (CIO) owns the delivery and day-to-day running of information technology (IT). In our reading, the CIO builds and operates the systems, and the CISO sets how much risk those systems may carry and checks whether the controls hold.

The CISO side, grounded in the NICE Framework

The role sits in the Oversight and Governance category, which provides leadership "so the organization may effectively manage cybersecurity-related risks to the enterprise and conduct cybersecurity work." Its task list makes the ownership concrete. Among other tasks, the role is expected to:

• "Establish a cybersecurity risk management program"
• "Manage cybersecurity budget, staffing, and contracting"
• "Determine the effectiveness of enterprise cybersecurity safeguards"
• "Advise senior management on organizational cybersecurity efforts"

One caveat matters. The framework states that "Work Roles are not synonymous to job titles or occupations." Read it as a description of the work a CISO typically carries, not as a job description your organization must copy.

The CIO side is our reading

The NICE work role does not define the CIO, and none of the sources for this section do. The CIO column below is our own reading of how the split usually works in practice, so test it against your own charter.

The friction point, in our reading, is who accepts residual risk. When the CIO both runs the systems and signs off on their risk, the person under delivery pressure is also the one deciding what is safe enough. That is why reporting lines draw so much attention; see how CISOs report and what a CISO does day to day.

A practical check: pull your CISO's charter and compare it to the four tasks above. Any task that sits with the CIO or nobody is a gap worth naming at your next leadership review.

Who owns what across the four roles

Titles move between companies. The work behind them moves less. The table maps each title to the work it usually carries. Every column is our reading, and the budget and reporting columns are our own view of common patterns, not survey data. As the previous section noted, NICE work roles are not job titles, so the mapping column is a judgment too.

How to read the table

Start with authority. The Executive Cybersecurity Leadership role "possesses authority to make and execute decisions that impact an organization broadly, including policy approval and stakeholder engagement" (NICCS). If your CISO cannot approve policy, the accountability column describes a role on paper.

The CIO and CTO rows map to different work roles. Technology Portfolio Management covers "managing a portfolio of technology investments" (NICCS). Enterprise Architecture "develops technology rules and requirements that describe baseline and target architectures" (NICCS). In our reading, that split is where budget friction between the two usually starts.

Legal exposure is the column readers most often get wrong. One listed task for the executive security role is to "Advocate organization's official position in legal and legislative proceedings" (NICCS). Its knowledge statements include "Knowledge of privacy laws and regulations" (same source). Check whether your charter gives that advocacy to the CISO or to counsel. This describes the framework, not what any law requires of you.

The CSO overlap shows up in one task: "Determine the operational and safety impacts of cybersecurity lapses" (NICCS). Where a separate CSO exists, decide in advance who owns that judgment.

The framework rarely names titles. The operational technology (OT) engineering role is an exception: it "Interfaces with Chief Information Security Officer, plant managers and industrial cybersecurity technicians" (NICCS). One training listing addresses "the Director of IT or Security, CISO, CIO, CTO, CEO, or other Executive Leadership roles" together (NICCS). Shared ownership is the expected case.

For reporting lines in detail, see our reporting structure guide and the reporting lines report.

Is a CSO the same as a CISO?

Not always. A chief information security officer (CISO) runs cybersecurity. A chief security officer (CSO) title can mean the same job, or a wider one that also takes in buildings, people and continuity. In our record, CISO is by far the usual title for the top security seat. CSO is a small minority.

Of 416 top security appointments in our record, 386 used the CISO title and 16 used CSO, with the rest spread across other titles.

Source: CISO Tribune record: 416 appointments on the Wire, as of 2026-10-23

Titles of the top security seat on the record

Label	appointments
CISO	386
CSO	16
Other top security title	11
Combined CIO and security title	2
VP of security	1

In our record of 416 appointments on the Wire, 386 carried the CISO title and 16 carried CSO. Another 11 used some other top security title, 2 combined the chief information officer (CIO) and security roles, and 1 was a vice president of security. These counts show a naming pattern, not a scope pattern. A CSO at one company may do exactly what a CISO does at another.

Where the wider seat comes from

The NICE role description cited earlier already extends past networks into physical spaces. The task and knowledge lists point the same way. The role is expected to "conduct an effective enterprise continuity of operations program" and to "develop critical infrastructure protection policies and procedures." It also calls for knowledge of insider threat tools and techniques and of cyber safety principles and practices. Those duties sit close to physical security, personnel vetting and plant safety, which is the ground a broad CSO usually covers.

The framework also keeps a narrower role, Systems Security Management, described as "responsible for managing the cybersecurity of a program, organization, system, or enclave." In our reading, that split mirrors the title question. One seat sets direction across the enterprise. Others run security for a defined scope.

What to check

• Read the job description and the org chart, not the title. The same three letters cover very different remits.
• Ask who owns badge access, guard contracts and background checks. If the answer is the security chief, the seat is broad.
• Check whether a separate CISO reports to the CSO. If one does, the CSO's attention may sit above day-to-day cyber operations.
• Compare reporting patterns in our reporting lines report, and see the CISO glossary entry for the narrower definition.

How a CISO differs from a CTO

The chief technology officer (CTO) usually decides what the company builds and how it builds it: languages, cloud platforms, architecture and release cadence. The chief information security officer (CISO) owns the risk those decisions create. That split is our reading, not a formal rule. The training listing mentioned earlier names both roles as audiences without dividing their duties, so the contrast here is our own.

Put plainly, a CTO is judged on what ships. A CISO is judged on what goes wrong after it ships. Both outcomes trace back to the same engineering choices, so in our reading the two roles meet at the release calendar more than anywhere else.

The same course lists two objectives next to each other: "Managing and Implementing Technologies for the Enterprise" and "Orchestrating A Functional Vulnerability Management Program". We think that pairing describes the handoff well. One side picks and runs the technology. The other tracks the weaknesses it carries.

Where security reviews meet release schedules

None of these conflicts means one role is wrong. A CTO who delays every release for a theoretical issue loses the business. A CISO who signs off on every exception ends up owning risk nobody chose on purpose.

Practical steps for a sitting CISO

• Agree on thresholds before the deadline. Set which severity levels block a release and which go into a tracked backlog, and get the CTO to sign the list.
• Give every exception an expiry date and a named business owner, so accepted risk stays visible.
• Put security engineers in design reviews at the start, not in a final gate the week before launch.
• Share a small set of metrics both leaders report on, such as open high-severity findings by product and average time to fix.
• Consider a business information security officer embedded with engineering, so the CISO is not the only contact for every release dispute.

The relationship works best, in our view, when the CTO treats security findings as engineering inputs and the CISO treats delivery dates as real constraints. For a fuller picture of the security side, see what a CISO does.

Who owns security when there is no CISO?

When the CISO seat is empty, the work keeps coming. Someone still approves policy, accepts risk and briefs the board when an incident lands. In our reading, three fallbacks cover most organizations.

The three common fallbacks

Each can work. The test is whether the stand-in holds the authority the role needs, not just the title.

What has to keep moving

The executive work role described earlier makes a useful checklist during a vacancy. Some of its tasks drop quietly when nobody owns them. The role is expected to acquire resources to support cybersecurity program goals and objectives and to coordinate cybersecurity policy review and approval processes. It is also expected to implement protective or corrective measures when a cybersecurity incident or vulnerability is discovered.

A practical step: write down, by name, who owns each of those tasks today. Any task with no name beside it is the real exposure, whoever sits in the CIO chair.

Security as a top-leadership duty

Defaulting to the chief executive is less odd than it looks. Training listed by the National Initiative for Cybersecurity Careers and Studies (NICCS) treats cyber risk as a leadership matter. One course is designed specifically for CEOs, business owners, executives, and organizational leaders who safeguard digital assets. Its objectives include learning to ask the right cybersecurity questions of IT staff and vendors and understanding accountability at the executive level.

We think that framing is a fair test for any fallback. Whoever holds security should be senior enough to answer for it and able to question the technology team rather than report through it.

Where to track open seats

Our record follows vacancies as they open and close. Open seats lists current CISO vacancies, and time to fill shows how long searches run. For the stopgap roles, see virtual CISO and interim CISO. New appointments appear on moves.

Can one person hold the CIO and CISO roles?

Yes. The harder question is what the arrangement costs.

Why the framework allows it

The NICE Workforce Framework for Cybersecurity (NICE Framework) defines a work role as "A grouping of work for which someone is responsible or accountable". An earlier section noted that these roles are not job titles. In our reading, that means one person can carry several roles at once, and the framework does not say which combinations to avoid. It describes the work. The org chart decides who does it.

Where the trade-off sits

Some roles in the framework describe running systems. Systems Authorization is responsible for "operating an information system at an acceptable level of risk" to the organization and others. Other roles describe checking them. Security Control Assessment covers "conducting independent comprehensive assessments" of management, operational and technical controls.

In a combined seat, one executive picks the platform, sets the patch schedule and owns the uptime target. The same executive then tells the board whether those choices left the company exposed. We think this is a structural conflict, not a character flaw. Even a careful leader will find it hard to report that their own budget call created the risk.

Common combined setups

Ways to restore some separation

• Send a short security risk summary straight to the audit committee or the chief executive officer (CEO), alongside the combined executive's own report.
• Give control testing to internal audit or an outside assessor, so assessment sits outside the operating chain.
• Write down who may accept risk, and require a second signature when the combined executive accepts risk in systems they run.
• Review the setup at growth points: a new regulator, a large acquisition, or a first serious incident.

For how reporting lines shape this choice, see our guide to CISO reporting structure and the reporting lines report.

Which role answers to the board on cyber risk?

For a public company, the clearest answer to this question sits in the annual report. Regulation S-K Item 106 is the Securities and Exchange Commission (SEC) disclosure rule on cybersecurity risk management, strategy and governance. Our glossary entry sets out what the rule asks a company to describe about management's role and the board's oversight.

What the framework says the role does upward

The Executive Cybersecurity Leadership work role includes a task to "Advise senior management on organizational cybersecurity efforts." The same role is tasked to communicate the value of cybersecurity to organizational stakeholders and to establish a cybersecurity risk management program.

The framework does not name a title. In our reading, these tasks describe the person a 10-K should point to when it explains who briefs the board. That person may be a chief information security officer (CISO), a chief information officer (CIO) or a chief security officer (CSO).

What to check in a filing

The framework lists a task to scope analysis reports to various audiences. In practice, a board briefing is a different document from an operations report. If a filing describes board updates but names no management owner, the operating chain is hard to see from outside.

Patterns from our record pages

These are our observations, not counts. Some filings name a CISO and describe that person's experience. Others name only the CIO or a risk committee. A third group names a committee of the board but stays vague on how often management reports to it.

For a deeper look at reporting lines in filings, see CISO reporting lines in SEC 10-K filings. Committee structures are covered in board committee oversight. Individual company disclosures are on /disclosures.

A practical step for a sitting security leader: read your own company's latest filing next to your actual reporting line. If the two differ, that gap belongs in the next conversation with your general counsel. It is a question of accuracy, and counsel can say what the rule requires in your case. The board cybersecurity oversight entry explains the terms you will meet in that discussion.

Where legal and disclosure exposure sits for each role

This section does not state any legal duty as settled for any seat. It covers where incident and disclosure work tends to land in practice, and which documents show where it lands in your own company. For anything binding, the answer sits with counsel.

The framework puts legal advocacy in the security executive's job

The same role lists knowledge of evidence admissibility laws and regulations and skill in evaluating laws.

In our reading, the framework expects the security leader to know whether logs, disk images and timelines will hold up later. It also expects that leader to speak for the company once a matter reaches a court or a legislature. The role also carries a task to disseminate incident and other Computer Network Defense (CND) information.

Form 8-K Item 1.05 and who supplies the facts

For public companies, the incident disclosure question runs through Form 8-K Item 1.05, and the glossary entry covers what the item asks for. The filing is a company act. The facts in it usually come from the CISO's team: what happened, when it was found and what is known about impact.

We think each seat's exposure follows who supplied, reviewed and signed off each fact. Our guide to the disclosure rules and our guide to personal liability go further.

What to check in your own documents

• Incident response plan: who declares an incident and who escalates it to the people deciding on disclosure.
• Disclosure committee charter or disclosure controls: whether the CISO is a named member or only an input.
• Directors and officers (D&O) insurance policy: whether the CISO is covered as an officer.
• Indemnification agreement, bylaws or employment contract: what each seat is promised if named in a claim.
• Delegation of authority: who may speak for the company to regulators and the press.
• Legal hold and evidence procedure: who preserves logs, and when that starts.

Where a document is silent on a seat, write that gap down. It is the question to raise with the general counsel before an incident, not during one.

What this guide does not cover

This guide does not cover compensation, team sizing or rules beyond the Securities and Exchange Commission (SEC) items it mentions, and it does not rank or recommend vendors or providers. It describes what the framework and disclosure rules say and what a reader can check. It is not legal or financial advice, and questions about what a rule requires in your case belong with your general counsel. For the rules and the record behind it, see What Does a CISO Do? Responsibilities, Reporting Lines and Required Skills.