Nownet Security
Home / Consultant CISO / White paper
White paper

CISO reporting lines: where accountability and culture collide

Where the CISO reports decides whether accountability for cyber risk is real. Put the security leader under the function they are meant to challenge, and accountability and culture start pulling in opposite directions. This paper compares the common reporting lines, shows where they break down and sets out the structure that makes security leadership work.

Nownet Security · Published 9 November 2026

Contents
  1. 01Why it matters now
  2. 02The common reporting lines
  3. 03Where culture and accountability clash
  4. 04What the right structure looks like
  5. 05Pulling the same way
  6. 06Ten questions for the board
  7. 07Where to start
  8. →How Nownet Security helps
  9. →Sources

Executive summary

Most cyber governance failures are not failures of tools or policy. They are failures of structure: unclear ownership, conflicted reporting lines and decision rights that don't match accountability. The Chief Information Security Officer's (CISO's) reporting line sits at the centre of all three.

A CISO who reports to the Chief Information Officer (CIO) is asked to challenge the plans, budget and risk decisions of their own manager. However capable the people, that structure sets accountability and culture against each other. Deadlines beat risk, bad news is softened on its way to the board, and security becomes either the department of "no" or a rubber stamp.

Organisations are moving away from that model. In Heidrick & Struggles' 2025 survey, 42% of CISOs reported directly to the CEO, three times the share a year earlier. Regulation is moving accountability the same way: NIS2, DORA and the UK's Cyber Governance Code of Practice all place it with the board and senior management.

There is no single right box on the organisation chart. What matters is that five conditions hold, whoever the CISO reports to:

  1. An independent route to the board. The CISO can reach the board or its risk committee without going through the people whose work they assure.
  2. Building is separate from assuring. The people who build and run technology are not the only people who judge whether it is secure.
  3. The business owns the risk. Business leaders own cyber risk in their areas; the CISO advises and challenges.
  4. Authority matches accountability. Whoever is accountable has the budget, authority and escalation route to act, including the right to pause a go-live.
  5. Bad news travels fast. Leaders reward early escalation and look for causes, not culprits, when things go wrong.

01Why the reporting line matters now

The CISO role has changed. It was once a senior technical post inside IT. Today the CISO is expected to explain cyber risk in business terms, advise the board and stand behind what the organisation tells regulators, customers and insurers.

Boards, meanwhile, are accountable in their own right:

  • NIS2 requires the management bodies of essential and important entities to approve cybersecurity risk-management measures, oversee their implementation and follow training. They can be held liable for infringements.
  • DORA makes a financial entity's management body ultimately responsible for managing ICT risk. Firms other than microenterprises must give a control function responsibility for managing and overseeing ICT risk, independent enough to avoid conflicts of interest, and keep risk management, control and internal audit functions segregated in line with the three lines of defence model.
  • The UK's Cyber Governance Code of Practice, published in April 2025, asks boards to agree senior ownership of cyber risk, set a risk appetite, promote a culture of positive behaviours and accountability, and hold regular two-way dialogue with the CISO.
  • For FCA-regulated firms, SYSC 4.1.1R already requires a clear organisational structure with well-defined, transparent and consistent lines of responsibility.
  • NIST CSF 2.0 opens its roles and responsibilities category with the same idea: organisational leadership is responsible and accountable for cybersecurity risk, and fosters a culture that is risk-aware, ethical and continually improving (GV.RR-01).

None of these says who the CISO must report to. All of them assume a structure in which accountability is clear, the people who assure controls are independent of the people who run them, and the board hears an unfiltered view of risk. The reporting line decides whether those assumptions hold.

02The common reporting lines

Most organisations place the CISO in one of five positions. Each can work, and each fails in a predictable way when the safeguards around it are missing.

Where the CISO sits decides whether the board hears about risk unfilteredTwo common structures, simplified
The CISO reports to the CIO The person who assures the technology reports to the person who runs it The CISO reports to the CIO The board sits above the CEO, the CEO above the CIO, and the CISO reports to the CIO. Cyber risk reaches the board through the CIO, and the CISO has to challenge the person who sets their objectives and budget. Board and its risk committee CEO CIO runs delivery CISO Cyber risk reaches the board through the CIO The CISO challenges the person who sets their objectives
The CISO has an independent route The CIO and CISO are peers, and the CISO has direct access to the board The CISO has an independent route The CIO and the CISO both report to the CEO as peers. The CIO builds and runs technology; the CISO sets standards and assures them. The CISO also has direct access to the board and its risk committee, so the board hears the CISO directly. Board and its risk committee CEO CIO builds and runs CISO sets and assures direct access peers: challenge and support The board hears the CISO directly
Reporting lineWhy organisations choose itWhere it breaks downSafeguards it needs
CIO or CTOSecurity sits close to the technology and the teams that fix things, under one budgetThe CISO assures their own manager's estate, competes with delivery for budget, and reaches the board through the CIOA direct route to the board's risk or audit committee; a CISO opinion the CIO cannot edit; risk acceptance outside the IT line
CEOSignals that cyber risk is business risk; direct access to strategy and the executive teamCEOs have little time, and the CISO can drift away from engineering and deliveryA strong working relationship and shared objectives with the CIO; a written mandate
Chief Risk OfficerA natural second-line home, independent of delivery, with one view of enterprise riskSecurity becomes compliance-led and loses influence over how systems are builtSecurity engineering in the first line; technical depth in the CISO's team
COO, General Counsel or CFOLinks security to operational resilience, legal exposure or costPriorities follow that function's lens, at a distance from technologyA seat in technology planning; reporting to the board's risk committee
Split: first-line security under the CIO, a second-line CISO under the CRO or CEOCommon in large regulated firms; separates running security from assuring itGaps and duplication between the teams, and disputes over who owns whatWritten responsibilities for each team; one shared view of risk; a joint forum chaired outside IT

The trend is away from IT. In the same Heidrick & Struggles survey of 371 CISOs, the share reporting to a CIO or CTO fell from about half to 30% in a year.

A reporting line on its own decides little, though. A CISO who reports to the CEO but has no say over delivery is no better placed than one who reports to the CIO with a standing slot at the audit committee. What matters is whether the safeguards in the last column are in place.

03Where culture and accountability clash

When the structure is wrong, the same patterns appear in every sector. They are rarely caused by bad people. They come from asking good people to hold two loyalties at once.

PatternWhat you seeThe structural cause
Marking your own homeworkFindings are negotiated down before they reach the board; dashboards stay green until an incidentThe function that builds and runs systems also certifies that they are secure, with no independent check
Accountability without authorityThe CISO is blamed after an incident but could not fund the fix, enforce the policy or pause the releaseAccountability was assigned to the CISO; budget and decision rights were not
Authority without accountabilityDelivery teams accept risk informally to hit a deadline, and "temporary" exceptions never expireThere is no written risk appetite or acceptance process, so the person accepting a risk does not answer for it
Security owns securityBusiness leaders treat cyber risk as the CISO's problem and security as IT's costOwnership of systems and data was never assigned to the business
Filtered bad newsThe board hears about cyber risk second-hand and is surprised by incidentsThe CISO's only route to the board runs through a manager with an interest in the message
The department of "no", or the rubber stampSecurity either blocks late or waves things through, and teams find workaroundsSecurity is brought in at the end of delivery, with no agreed criteria or escalation route
Activity reported as progressReports count patches, courses and tickets rather than risk reducedThere is no agreed appetite or outcome measure, so activity is all there is to report

Culture is what people do when the structure leaves them to choose. If raising a risk means contradicting your manager's plan, most people will stay quiet. If informal risk acceptance is the only way to hit a deadline, people will accept risk informally. Awareness campaigns cannot fix that. Structure can.

04What the right structure looks like

The Institute of Internal Auditors' Three Lines Model gives the frame. The governing body is accountable for oversight. First-line roles deliver services and manage the risk in them. Second-line roles provide expertise, support, monitoring and challenge on risk. Internal audit, the third line, gives independent assurance and stays independent of management.

The CISO is usually a second-line role. Many CISOs also run first-line services, such as security operations or incident response. Where they do, someone independent of the CISO, usually internal audit, should assure those services.

The CISO assures the first line, and internal audit assures the CISOThe Three Lines Model applied to the CIO and CISO · highlighted: the evidence the CISO relies on
The CISO assures the first line, and internal audit assures the CISO The governing body, the board and its committees, sits above three lines. The first line, the CIO and business owners, reports on risk and performance to the governing body and gives the second line evidence of control. The second line, the CISO and risk function, sets policy and standards for the first line and gives the governing body an independent view of risk. The third line, internal audit, assures the CISO's own services and gives independent assurance to the governing body. Governing body: the board and its committees Accountable for oversight; sets risk appetite, roles and resources First line CIO and business owners Build, run and protect systems Own the risk in their areas Second line CISO and risk function Set policy and standards Monitor, challenge and assure Third line: internal audit Independent assurance to the governing body risk and performance reports independent view of risk policy and standards evidence of control assures the CISO's own services

Scroll sideways to see the whole diagram.

Five conditions turn the model into a working structure:

  1. An independent route to the board. Whatever the line management, the CISO presents to the board or its risk or audit committee in person, and meets the committee chair privately at least once a year. The UK Code expects formal cyber reporting at least quarterly and regular two-way dialogue between the board and the CISO.
  2. Building is separate from assuring. The CIO's teams build and run controls. The CISO sets the standard and tests that it is met.
  3. The business owns the risk. Every important system and data set has a named business owner who accepts risk within the agreed appetite. The CISO advises, challenges and records any dissent, but does not own risk in other people's systems.
  4. Authority matches accountability. It is written down who can accept which level of risk, who can pause a go-live on security grounds and how disagreements escalate. The CISO has the resources and a voice in investment that match what they are held to account for, as NIST CSF 2.0 expects (GV.RR-03).
  5. Bad news travels fast. Leaders thank people who raise problems early, treat near misses as lessons, and review incidents for causes rather than culprits.

05Making culture and accountability pull the same way

Structure sets the conditions. Leadership behaviour decides whether people trust them. Seven practical steps help:

  1. Publish the decision rights. A one-page statement of who decides risk appetite, risk acceptance, exceptions, go-live sign-off and incident declaration removes most arguments before they start.
  2. Give the board the CISO's own words. The CISO's assessment reaches the board unedited, with management's response alongside it rather than merged into it.
  3. Make exceptions expire. Every exception to security policy has a named owner, an expiry date and the agreement of both the risk owner and the CISO. The board sees how many are open and how old they are.
  4. Agree a risk appetite that changes decisions. If the appetite statement has never stopped or changed a project, it is not doing its job.
  5. Bring security in early. Agree security criteria at the start of delivery, and train security champions in delivery teams, so the CISO is not the last gate before go-live.
  6. Share objectives. Put risk outcomes in delivery leaders' objectives, and delivery outcomes in the CISO's. The CIO and CISO succeed or fail together.
  7. Learn without blame. Review incidents and near misses for causes, share the lessons and protect the people who raised them.

06Ten questions for the board

Use these to test your own structure. If the honest answer to several is "we don't know", the reporting line deserves a closer look.

  1. Who does the CISO report to, and does that person own the systems the CISO assures?
  2. When did the CISO last brief the board or its risk committee directly?
  3. Who can accept cyber risk on the organisation's behalf, and where is that decision recorded?
  4. Is our cyber risk appetite written down, and has it ever changed a decision?
  5. Has a project ever been paused or changed on security grounds, and what happened next?
  6. How many security exceptions are open, and how many are past their expiry date?
  7. Does the CISO have the budget and authority to match what they are accountable for?
  8. Do business leaders see cyber risk in their areas as theirs?
  9. When something goes wrong, do we look for causes or culprits?
  10. Who gives the board independent assurance that the CISO's own work is effective?

07Where to start

  1. Map the real structure. Draw the reporting lines, decision rights and escalation routes as they actually work, not as the organisation chart shows them, and test them against the five conditions in Section 4.
  2. Fix the route to the board first. A standing CISO slot at the risk or audit committee costs little and changes behaviour quickly.
  3. Assign ownership and decision rights. Name business owners for important systems and data, and write down who can accept which risks.
  4. Then choose the reporting line. With the safeguards in place, pick the line that fits your size, sector and regulators.
  5. Test it. Ask internal audit to review how the structure works in practice after a year.

How Nownet Security helps

We work with boards, CIOs and CISOs to get the structure right, and then to make it work:

  • Consultant and interim CISO. A security strategy and operating model with clear roles, responsibilities and a roadmap, and board reporting with honest status rather than everything marked green.
  • Board cyber briefing. A session for directors on the government's Cyber Governance Code of Practice.

Sources

General information only, not legal or professional advice. No reliance may be placed on it. Regulatory references are correct as at 9 November 2026. See our terms of use.