This argument might have had some relevance 20 years in the past, when security features have been primarily accountable for auditing IT operations.
However right this moment, it more and more displays an outdated understanding of each roles.
Trendy cybersecurity is deeply intertwined with know-how structure, cloud platforms, DevOps pipelines, digital transformation packages and operational resilience initiatives. Safety can’t be handled as an exterior oversight perform policing IT from a distance.
It should be embedded inside know-how technique itself. Any fashionable CIO ought to see it that manner.
In that atmosphere, shut collaboration between the CIO and the CISO isn’t solely fascinating — it’s important.
Framing the connection as a structural budgetary battle and a supply of friction is counterproductive and outdated. The true goal shouldn’t be to keep away from friction however to engineer alignment: Guaranteeing that know-how management and security management work collectively to assist the group’s strategic targets.
Transferring past the controversy
Finally, the persevering with debate in regards to the CISO reporting line distracts the security trade from extra necessary questions.
What issues way more is whether or not cybersecurity is built-in into company governance, supported by govt management and aligned with enterprise technique.
If organizations are nonetheless arguing about the place the CISO ought to sit in 2026, it could merely point out that they haven’t but absolutely accepted the strategic nature of cyber threat.
And till that adjustments, the controversy will probably proceed.
Not as a result of the reply is troublesome — however as a result of the underlying governance problem stays unresolved.
This text is printed as a part of the Foundry Professional Contributor Community.
Wish to be a part of?
