Inside the CISO-CIO Power Shift After a Year of Board-Level Breach Scrutiny
Reporting lines are being redrawn as boards demand direct visibility into security posture, independent of the broader IT org.
A year of intense board-level scrutiny of cyber breaches has reshaped the relationship between CIOs and CISOs. In many organisations, the CISO no longer reports into the CIO, and the balance of influence between the two roles has shifted noticeably.
Why reporting lines changed
New disclosure requirements and personal accountability expectations have put security leaders directly in front of boards and regulators. Directors increasingly want to hear about cyber risk without it being filtered through the technology function responsible for the systems being assessed.
“The board wanted an independent view of risk. That meant the CISO couldn't sit two layers below the person whose systems were being judged.”
New tensions
Separation brings clarity, but also friction. Security priorities can collide with delivery deadlines, and disputes that were once resolved inside the IT organisation now escalate to the executive committee.
- Release schedules challenged by security review requirements
- Budget debates between modernisation and security controls
- Different views on acceptable risk for legacy systems
Partnerships that work
The pairs that function best share a few habits: a joint risk register, shared metrics, and regular meetings before board sessions so that disagreements are resolved before they reach directors.
What it means for CIOs
For CIOs, the change is less a loss of power than a change of role. Security outcomes still depend on the platforms, architecture and operational discipline the CIO controls. The most effective technology leaders are treating the CISO as a peer and ally — because in the boardroom, they will be judged together.