It is difficult to understand why, in 2026, we are still debating the reporting line of the chief information security officer (CISO).

It is one of the first topics I wrote about in 2015, and after more than two decades of high-profile cyber incidents, sustained regulatory pressure, massive technology investments and the steady elevation of cybersecurity to boardroom agendas, one might reasonably expect that this issue would have been settled long ago.

Yet the question persists. And articles like this It’s time to rethink CISO reporting lines show that the debate is still raw.

The fact that the debate continues tells us something important. It reveals that many organizations still struggle with a more fundamental question: What exactly is the role of the CISO within the enterprise?

The reporting line matters — but it was never the real question

Let me be clear. The reporting line matters. It matters because it defines the authority, visibility and influence of the security function across the organization. It signals internally how seriously cybersecurity is taken and determines how effectively the CISO can engage with the executive leadership team.

But the reporting line was never the real question.

The real question is whether the CISO has the organizational standing necessary to influence decisions across multiple silos: IT, operations, legal, compliance, HR, procurement, third-party suppliers and increasingly a complex ecosystem of partners and digital platforms.

Cybersecurity is one of the very few corporate functions that touch virtually every part of the enterprise. It is therefore inherently cross-functional. Without sufficient authority and visibility, the CISO cannot hope to influence behaviour across the organization, let alone drive meaningful change.

If we are still debating the reporting line in 2026, it is largely because many organizations still treat cybersecurity as a technical issue rather than a leadership issue.

The governance gap behind the debate

The persistence of this debate reflects a broader governance gap.

Historically, information security emerged as a technical discipline embedded within IT departments. Early security teams focused primarily on protecting infrastructure: Firewalls, access controls, network monitoring and vulnerability management. In that environment, it was natural for the security function to sit within the IT organization.

But the nature of cyber risk has evolved dramatically.

Cybersecurity today is not merely about protecting technology infrastructure. It is about protecting digital business models, customer trust, intellectual property, operational resilience and in some sectors even national security interests.

In other words, cybersecurity has become a strategic business issue.

And yet, in many organizations, the governance structures surrounding cybersecurity have not evolved at the same pace.

The continuing debate about the CISO reporting line is therefore less about organizational design and more about whether companies have fully internalised the strategic nature of cyber risk.

There is no universal reporting line

Another recurring misconception is the search for a universal answer.

Every year, surveys attempt to determine the “correct” reporting line for the CISO. Some conclude that the CISO should report to the CEO. Others recommend the CRO or the COO. Some insist that independence from IT is essential.

In reality, there is no universal model. The reporting line remains a means to an end.

Organizations differ widely in their structure, culture, maturity and regulatory environment. What works in one organization may not work in another.

In many organizations, the CIO remains the most natural reporting line for the CISO, particularly where technology transformation and digital innovation are core strategic priorities. In others, the COO or the CEO may be better placed to support the operational changes required to embed security across business processes.

What matters is not the job title of the executive above the CISO.

What matters is whether that individual has the authority, credibility, organizational reach and personal willingness to support the security agenda.

Authority matters — and quite a lot of that is forged in the first 100 days

When a new CISO joins an organization, their immediate priority is rarely technical. Instead, it is organizational: Understanding the business, mapping stakeholders, assessing governance structures and identifying the cultural barriers that may hinder security improvements.

During those first months, the CISO must build credibility quickly across multiple constituencies. They must engage with senior executives, operational leaders, technology teams and sometimes regulators or external partners.

None of this can be done effectively if the CISO lacks organizational authority.

A reporting line that leaves the CISO buried several layers below executive leadership severely limits their ability to build the relationships required to succeed. Conversely, a reporting line that provides direct access to senior decision-makers can dramatically accelerate the process.

The reporting line, therefore, matters not because it determines technical decisions, but because it determines access, influence and credibility.

The illusion of structural solutions

At the same time, we should be careful not to overstate the importance of organizational charts.

A common mistake is to assume that moving the CISO reporting line will automatically solve cybersecurity challenges.

It will not.

Cybersecurity failures rarely occur because the organizational chart was incorrect. They occur because of poor governance, weak leadership, unclear accountability or cultural resistance to change.

The most effective CISOs succeed not because of perfect reporting structures but because they build trust, credibility and influence across the organization.

Which brings us to perhaps the most important factor of all: The relationship between the CISO and their direct superior.

Trust matters more than structure

In practice, the success of the CISO depends heavily on the quality of the relationship with the executive to whom they report.

That relationship must be built on trust, alignment and shared understanding of the organization’s risk appetite and strategic priorities.

If the executive above the CISO understands the importance of cybersecurity and is willing to champion the security agenda at the board level and across the firm, the reporting structure can work extremely well.

If that support is absent because the business at large does not see the strategic importance of cybersecurity, no reporting line will magically solve the problem.

The myth of the CIO–CISO conflict

One final argument frequently raised in these discussions is the supposed “conflict of interest” between the CIO and the CISO.

According to this theory, the CISO should not report to the CIO because the CIO is responsible for delivering technology projects and operational performance, while the CISO is responsible for enforcing security controls that may slow things down.

This argument may have had some relevance 20 years ago, when security functions were primarily responsible for auditing IT operations.

But today, it increasingly reflects an outdated understanding of both roles.

Modern cybersecurity is deeply intertwined with technology architecture, cloud platforms, DevOps pipelines, digital transformation programs and operational resilience initiatives. Security cannot be treated as an external oversight function policing IT from a distance.

It must be embedded within technology strategy itself. Any modern CIO should see it that way.

In that environment, close collaboration between the CIO and the CISO is not only desirable — it is essential.

Framing the relationship as a structural budgetary conflict and a source of friction is counterproductive and outdated. The real objective should not be to avoid friction but to engineer alignment: Ensuring that technology leadership and security leadership work together to support the organization’s strategic goals.

Moving beyond the debate

Ultimately, the continuing debate about the CISO reporting line distracts the security industry from more important questions.

What matters far more is whether cybersecurity is integrated into corporate governance, supported by executive leadership and aligned with business strategy.

If organizations are still arguing about where the CISO should sit in 2026, it may simply indicate that they have not yet fully accepted the strategic nature of cyber risk.

And until that changes, the debate will likely continue.

Not because the answer is difficult — but because the underlying governance challenge remains unresolved.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?