Should the business information security officer (BISO) report to the CIO or CISO?

Team & Organizational DesignSecurity Strategy & Roadmap

CIO19%

CISO57%

Both the CIO and CISO18%

Neither (share your alternative in the comments)3%

Unsure1%

194 PARTICIPANTS
1.7k viewscircle icon1 Upvotecircle icon1 Comment
Sort by:
CISO in Software2 years ago

I would love to hear why BISOs should report to the CIO.

Content you might like

What are the fundamental leadership capabilities that are needed for an era of exponential technology and AI innovation?

Read More Comments

How are you currently managing SIEM costs? Have you found effective ways to actually reduce storage costs for your SIEM?

Read More Comments

When growing your IT team: what are your biggest concerns about hiring an IT Professional from a different country through a local, long-term placement company? Select all that apply.

Too expensive compared to local workforce18%

Security measures harder to control35%

Difficult to make that person feel part of the team29%

Less likely to keep the employee hired for a long period31%

Not enough control over the employee's compensation44%

Timezone out of sync14%

Language barriers12%

We have zero interest in hiring from other countries5%

We see no concerns about hiring from other countries4%

View Results

As part of our NYSE IPO prep, we’re debating how to communicate our system hardening efforts in regulatory disclosures (e.g., SEC Form 20-F, SFC).

Would you recommend sharing % compliance (e.g., “85% CIS Tier 2”) or sticking to qualitative descriptions of how we identify and mitigate risks? Also, do SFC/ISO 27001 expectations require full ISMS integration, or is a % model acceptable?

Is footprinting an effective way to do vulnerability management?

Very effective1%

Somewhat effective52%

Slightly effective31%

Slightly ineffective8%

Somewhat ineffective3%

Not at all effective

Not sure yet1%

View Results