A CIO is accountable for the technology the business runs on: systems, delivery, cost and reliability. A CISO is accountable for managing the cyber risk to those systems and the data in them. One builds and operates, the other assesses and protects. They work best with shared goals and written decision rights.
What does each role own?
The CIO typically owns infrastructure, applications, service delivery, vendors and the technology budget. Success looks like systems that are available, affordable and aligned to what the business wants.
The CISO typically owns security strategy, policy, risk assessment, security operations oversight, incident response leadership and reporting on cyber risk. Success looks like risk held within the level leadership agreed to, and a company that can recover from an incident.
Titles and scopes vary. In some firms the CISO reports to the CIO, in others to the chief executive, the chief risk officer or the board. Some CISOs own physical security or privacy, others do not. Look at the actual charter rather than the title.
Why does reporting line matter?
When the CISO reports to the CIO, security decisions sit under the same leader who is judged on delivery speed and cost. That can create a conflict: the person who accepts a risk to ship on time is also the person who reports on that risk.
Independence is the reason many organisations separate the roles or give the CISO a direct line to the board or an audit committee. NIST Cybersecurity Framework 2.0 supports the underlying point through its Govern function, which stresses clear roles, responsibilities and authorities for cybersecurity risk management and oversight by leadership. It does not mandate any one reporting structure.
Where do they overlap and clash?
Friction tends to appear in the same places.
- Speed against control. A release date meets a security review.
- Budget. Security work competes with features for the same funds.
- Shadow technology. Teams buy tools nobody approved, creating assets the CIO does not manage and the CISO cannot see.
- Vendor choice. Cheapest or best integrated versus strongest security terms.
- Patching. Uptime goals versus the need to fix known exploited flaws.
None of these are personality problems. They are different incentives pointed at the same systems, and they need rules, not goodwill.
How should they collaborate?
Agree shared measures. Two or three numbers both leaders report: time to patch known exploited vulnerabilities, restore time for critical systems, share of assets in inventory.
Write down decision rights. Who can accept a risk, up to what size, and who must be told. A CISO recommends, an accountable business owner accepts, and the record is kept.
Build security into delivery. Put checks into the pipeline and the design process, so security stops being a late gate. NIST SP 800-218 describes this as practices across the software lifecycle.
Share one inventory. Asset lists, owners and data classifications should be a single source both rely on.
Rehearse together. Joint incident exercises show where roles blur long before a real incident.
Hold a regular meeting. Fortnightly, with a standing agenda: risks, exceptions, upcoming launches, supplier changes.
A constructed example
A retailer plans to launch a loyalty app in six weeks. The CIO's team has picked a third party analytics vendor. The CISO's review finds the vendor would receive customer identifiers with no contractual limits on use. Under their decision rights, the CISO recommends a contract change and a data minimising design. The business owner accepts a one week delay to get them, records the decision, and both executives report the change at the next board meeting. Neither won, and the launch was better.
How to check or apply this
- Read both role charters and note overlaps.
- Confirm who each leader reports to and whether the CISO has board access.
- Write a one page risk acceptance rule with named approvers.
- Choose two or three shared metrics.
- Merge asset and software inventories into one source.
- Schedule a regular joint meeting and a yearly joint exercise.
Quick check
Should the CISO report to the CIO?
It depends on the organisation. Many prefer independence to avoid conflicts, but there is no single required structure. What matters is clear authority and a route to senior leadership.
Who accepts a security risk?
The accountable business owner, informed by the CISO's recommendation, with the decision recorded.
Sources
- NIST Cybersecurity Framework 2.0
- NIST SP 800-218: Secure Software Development Framework
- CISA: Secure by Design
Last reviewed: 18 October 2026.
