It’s time to rethink CISO reporting lines
It’s time to rethink CISO reporting lines
https://www.csoonline.com/article/4136293/its-time-to-rethink-ciso-reporting-lines.html
Publish Date: 2026-02-24 02:12:00
Source Domain: www.csoonline.com
“Org charts matter far less than influence,” he adds. “Whether the CISO reports to the CIO, the CEO, or someone else, the real question is this: Are they brought in early, listened to, and empowered to shape how the business operates? When that’s true, the structure works. When it’s not, no reporting line will save it.”
Sanchit Vir Gogia, chief analyst at Greyhound Research, argues that the trend to have CISOs report to an IT executive “is one of the most structurally damaging legacy habits still entrenched in enterprise security governance.”
“On paper, it may seem like a clean alignment,” he says. “In practice, it’s a governance anti-pattern that quietly erodes the CISO’s ability to surface truth, escalate risk, and hold the organization accountable. Keeping security under IT may seem convenient, but in today’s threat landscape, it is a structural vulnerability disguised as tradition.”
