What is a chief information security officer (CISO)?

What does a CISO do?

The CISO is accountable for protecting the organisation's information, systems and operations. The exact remit depends on the company, but most CISOs own these areas:

• Security strategy: deciding what to protect first and where to spend, based on the business and the threats it faces
• Cyber risk management: keeping a risk register, agreeing risk appetite with leadership and deciding which risks to fix, transfer or accept
• Governance and policy: writing security policies and standards and checking that people follow them
• Compliance and audits: meeting laws and standards such as NIS2, DORA, ISO 27001, SOC 2 and PCI DSS, and leading the audits
• Security operations and incident response: running or overseeing monitoring and vulnerability management, and leading the response to an incident
• Security architecture: making sure systems, cloud platforms and products are designed and built securely
• Third-party risk: assessing the suppliers and service providers that can reach company data
• Awareness: training staff and giving them a simple way to report problems
• Team and budget: hiring and leading the security team and managing its budget
• Board reporting: explaining cyber risk, incidents and progress to executives and the board in business terms

Who does the CISO report to?

There is no single answer, and the answer is changing. In Heidrick & Struggles' 2025 survey of 371 CISOs, 42% reported directly to the CEO, three times the share in the previous year's survey. The share reporting to a CIO or CTO fell from roughly half to 30%.

Reporting to the CIO is common where security grew out of IT. The drawback is a conflict of interest, because the person who runs IT also decides how much security IT gets. Companies that want more independence have the CISO report to the CEO, the chief risk officer or the general counsel, with direct access to the board or its risk or audit committee.

CISO vs CIO, CTO, CSO and DPO

• Chief information officer (CIO): runs the company's IT so the business can work. The CISO protects that IT and the data in it.
• Chief technology officer (CTO): leads the technology behind the product, often in software companies. The CISO makes sure the product is built and run securely.
• Chief security officer (CSO): often covers physical security as well as cyber security. Some companies use CSO and CISO for the same job.
• Data protection officer (DPO): a role under the EU GDPR that advises on data protection law and monitors compliance with it. The DPO looks after personal data rights, while the CISO protects all of the information and systems.

What qualifications does a CISO need?

No licence or degree is required. Most CISOs reach the role after years in security engineering, security operations, risk or audit, and the job asks for business judgement as much as technical depth. These certifications are common:

• CISSP from ISC2, which needs at least five years of cumulative, full-time experience in two or more of the eight CISSP domains
• CISM from ISACA, which needs at least five years of professional experience across three or more of the four CISM domains
• CCISO from EC-Council, a certification aimed at security executives

What to check beyond certifications

A certification shows knowledge and experience at a point in time. When you hire, also look at the person's record: the programmes they built, the audits they led, the incidents they handled and how clearly they explain risk to a board.

Laws that expect someone to own security

Few laws require the CISO title, but many require a named person or function to own security and report on it:

• New York's cybersecurity regulation (23 NYCRR Part 500) requires covered financial companies to designate a CISO, who must report in writing at least once a year to the board or other senior governing body
• The US SEC's cybersecurity disclosure rules (Item 106 of Regulation S-K) ask listed companies to say which management positions are responsible for cybersecurity risk and what expertise those people have
• The HIPAA Security Rule requires US healthcare organisations it covers, and their business associates, to name a security official responsible for their security policies and procedures
• The EU's NIS2 Directive makes management bodies approve and oversee cybersecurity risk-management measures, and lets them be held liable for failures
• DORA requires EU financial entities, other than microenterprises, to give the management and oversight of ICT risk to a control function with an appropriate level of independence

Full-time CISO or vCISO?

Every company needs someone accountable for security. Whether that person is a full-time CISO depends on size, risk and regulation.

A full-time CISO fits when security is a daily executive concern: a regulated bank, insurer or healthcare provider, a large organisation, or a software company whose customers send security questionnaires every week.

A virtual or fractional CISO (vCISO) works part time, often a few days a month. A vCISO suits a smaller company that needs a security strategy, policies, audit preparation or board reporting before it needs a full-time executive. Some vCISOs also cover the role while a company searches for a permanent CISO.

How to hire a CISO

• Decide what you need: a full-time CISO, a vCISO, or a specialist for one project such as ISO 27001 readiness or a penetration test
• Agree the reporting line, budget and authority before you advertise. Strong candidates will ask about all three.
• Write down what you expect in the first year, such as a risk assessment, a roadmap, a certification audit or a first board report
• Check the certifications and past roles each candidate claims
• Include the CEO and a board member in interviews, and ask candidates to walk through a real risk decision they made

How CISO Talents helps

CISO Talents is a verified network for hiring CISOs, vCISOs and security experts. At launch you can post a permanent CISO job, which always shows its salary range, or a scoped vCISO request through a guided brief. Verified experts see your request with the reason it matched them. A Verified Leader badge means our team reviewed the person's CISO, vCISO or head of security role, and every badge shows the date of the check.