Everyone argues about where the CISO should report. That’s the wrong argument. The real fix is a written mandate around the budget you’ll have to challenge, and it doesn’t require a new box on the org chart.
I reported to five different executives in one CISO role. The chain ran CIO, then general counsel, then COO, then compliance officer, then CTO. Same job. Same accountability. Nothing structural changed, not once.
Some people think it’s simple: just fix the reporting line. Move the CISO to the CEO or the board, and the conflict of interest disappears. I don’t think so. Five different bosses for the same job proves it doesn’t.
The actual porblem isn’t the org chart
Security conferences will run this debate forever. CISO to the CEO. CISO to the board. CISO anywhere but IT. There’s a whole track dedicated to it. It feels productive because you can draw a line on a chart and point to it in an offer letter.
The actual mechanism is who signs off on the spend you’re trying to slow down, not which box holds your title. If that person sits above you on the chart, the org design didn’t create the conflict. The budget did. Moving your box to a different branch doesn’t move the money.
Follow the budget, not the box
Authority gets tested when security flags a vendor. The vendor’s champion is a VP with a signed contract and a go-live date on the calendar. Security escalates.
If that escalation has to pass through someone who approved the budget for that vendor, or who reports to the person who did, it dies there. It doesn’t matter what the title says. A different box just changes who gets copied on the email announcing the decision that was already made.
I’ve watched a CISO reporting directly to the CEO get overruled on exactly this, because the CEO was the one who wanted the platform. The reporting line was clean. The conflict was still there, one level up.
It’s sharper in a community bank
This gets more concrete in a shop your size. At a $2B bank, the board or the CEO personally approves anything over a modest threshold. There’s no VP layer to absorb the conflict, so the person who wants the vendor and the person who can overrule your risk finding are often the same two or three names in the building.
That’s not a reason to quit. It’s a reason to write it down. A large enterprise can bury an independent escalation path inside layers of management that happen to work most of the time. A community bank has no layer to hide behind. You write it down or it doesn’t exist.
What actually needs to be in writing
None of this requires a reorg, and a reorg is usually the wrong ask anyway. A new executive pillar is a hard sell to a board that already has a headcount plan for the year. A written mandate is a far easier yes, and it does the same job. None of this requires a reorg. A new executive pillar is a hard sell to a board that already has a headcount plan for the year. A written mandate is a far easier yes, and it does the same job.
Ask for direct, standing board access, separate from where you sit on the chart. Fifteen minutes, unfiltered, on a fixed cadence. That’s a governance decision, not an org chart change, and boards grant it more easily than they’ll admit up front.
Get the charter to name where security’s escalation goes when a budget owner overrules a risk finding, and make sure that path doesn’t terminate at the same owner. If the only escalation option is the person you disagreed with, you don’t have an escalation path. You have a suggestion box.
Put in writing who can accept risk on the organization’s behalf, and require that person to sign it under their own name. If the acceptance only carries a security signature, security owns the outcome no matter who caused it.
Stop mapping the chart
The org chart tells you who someone’s manager is. It doesn’t tell you who has to say yes before a risk gets funded, and that’s the only question that matters here.
Find the name of the person whose budget you’ll be challenging on your hardest day. Build the access route around that name, not around a box. The title and the dotted line are just furniture.
If you want to map the actual authority gaps in your program instead of arguing about where the box should sit, book a call.
