What Is a CISO? Role, Reporting Lines and SEC Rules
A CISO (Chief Information Security Officer) is the senior leader accountable for an organisation's information and cyber risk. There is no single legal definition: NIST's glossary defers to the federal “Senior Agency Information Security Officer” and notes that organisations may use the CISO title for similar positions.
For US public companies, the SEC's 2023 rules make the role visible: material incidents must be disclosed on Form 8-K within four business days of a materiality determination, and annual reports must describe board oversight and management's role and expertise. Define the job with the CISO role builder and the CISO mandate tool. General information, not legal advice.
Updated 3 November 2026
What a CISO does
Titles and duties vary by organisation, and we found no authoritative single list, so treat this as a working description rather than a standard. In practice the role covers:
- Setting the security strategy and policies, and tying them to a framework such as NIST CSF 2.0 (which has a dedicated Govern function).
- Owning risk reporting to executives and the board.
- Leading incident response and readiness, including regulatory notification decisions.
- Managing the security budget, programme and team.
NIST CSF 2.0 states that organisational leadership is responsible and accountable for cybersecurity risk (outcome GV.RR-01), so the CISO advises and runs the programme but accountability sits with leadership.
Reporting lines: questions to settle
No source we verified prescribes who a CISO reports to, so we give no statistics on common arrangements. Whatever the line, agree these in writing, which the CISO mandate tool helps with:
- Direct access to the board or its committee.
- Authority to stop or escalate a risky release or project.
- Budget ownership versus sharing it with IT.
- Independence from the teams whose controls the CISO assesses.
- Who decides on materiality and disclosure during an incident.
The SEC cybersecurity disclosure rules (US public companies)
| Requirement | What the SEC says |
|---|---|
| Adopted | 26 July 2023. |
| Form 8-K Item 1.05 | Disclose a cybersecurity incident determined to be material: the material aspects of nature, scope and timing, and the material impact or reasonably likely impact. Generally due within four business days of the materiality determination, which must be made without unreasonable delay after discovery. |
| National security delay | Possible if the US Attorney General determines immediate disclosure poses a substantial risk to national security or public safety and notifies the SEC in writing. |
| Regulation S-K Item 106 | Annual report (Form 10-K) must describe processes for assessing, identifying and managing material cyber risks, whether such risks have materially affected the company, board oversight, and management's role and expertise. |
| Foreign private issuers | Form 6-K for incidents; Form 20-F for periodic disclosure comparable to Item 106. |
| Compliance dates | Item 106: fiscal years ending on or after 15 Dec 2023. Item 1.05: later of 90 days after Federal Register publication or 18 Dec 2023; smaller reporting companies later (the later of 270 days from the effective date or 15 June 2024). |
The fact sheet does not mention the CISO title: the rules ask companies to describe who in management is responsible and their expertise. Whether an incident is material is a legal and judgement call; involve counsel. Walk through your obligations with the breach notification tool. Later SEC staff guidance exists that we did not fetch and therefore do not summarise.
Last reviewed 3 November 2026. US federal securities rules only; other jurisdictions differ. General information, not legal advice.
Frequently asked questions
What does CISO stand for?
Chief Information Security Officer: the senior executive accountable for how an organisation manages information and cyber risk. There is no single legal definition. NIST’s glossary has no standalone entry and points to “Senior Agency Information Security Officer”, an official who carries out the CIO’s responsibilities under FISMA and serves as the CIO’s primary liaison to authorizing officials, system owners and system security officers; it notes that organizations subordinate to federal agencies may use “Chief Information Security Officer” for positions with similar responsibilities.
Does the SEC require public companies to have a CISO?
The SEC’s fact sheet on its July 2023 rules does not use the title CISO or require the position. Regulation S-K Item 106 requires companies to describe board oversight of cybersecurity risk and management’s role and expertise in assessing and managing material cyber risks, which in practice means saying who is responsible and what their expertise is.
How quickly must public companies disclose a cyber incident?
Under Form 8-K Item 1.05, a company that determines a cybersecurity incident is material must generally file within four business days of that determination, and must make the materiality determination without unreasonable delay after discovery. Disclosure may be delayed if the US Attorney General determines immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing.
When did the SEC rules take effect?
The SEC adopted them on 26 July 2023. Item 106 disclosures began with annual reports for fiscal years ending on or after 15 December 2023. Form 8-K Item 1.05 compliance began on the later of 90 days after Federal Register publication or 18 December 2023, with smaller reporting companies getting additional time (the later of 270 days from the effective date or 15 June 2024).
Who should a CISO report to?
There is no rule that fixes it, and we found no primary-source statistics we could verify, so we give none. The NIST Cybersecurity Framework 2.0 says organizational leadership is responsible and accountable for cybersecurity risk (GV.RR-01) and has a Govern function for roles, responsibilities and authorities. Settle independence, access to the board and budget authority in writing.
What is the difference between a CISO and a CIO?
The two roles are separate in many organisations, and structures vary. NIST’s Senior Agency Information Security Officer definition shows the federal arrangement: the security officer carries out the CIO’s FISMA responsibilities and acts as liaison to system owners. Private-sector structures vary.
How do I become a CISO?
There is no single path. Our career guides cover certifications and building leadership evidence, and the role builder helps you define the job. We do not quote salary figures here because they vary by source; see the salary explorer, which cites BLS data.
Sources
- SEC press release 2023-139 (26 July 2023): SEC adopts rules on cybersecurity risk management, strategy, governance and incident disclosure, accessed 3 Nov 2026
- SEC fact sheet: Public Company Cybersecurity Disclosures; Final Rules (PDF), accessed 3 Nov 2026
- NIST CSRC glossary: Chief information security officer / Senior Agency Information Security Officer, accessed 3 Nov 2026
- NIST CSWP 29: The NIST Cybersecurity Framework (CSF) 2.0 (26 February 2024), GV.RR-01