As security has moved from a technical function to a boardroom concern, one structural question keeps resurfacing and rarely gets a clean answer: where should the CSO sit on the org chart? The reporting line shapes far more than a title — it shapes how much influence, independence and budget the security function has, and whose incentives the CSO is competing against when security and business priorities pull in different directions.
There is no single right answer. Organisations of similar size and sector land in genuinely different places for defensible reasons. But the trade-offs of the common models are worth naming explicitly, because most organisations inherited their current structure rather than deliberately chose it.
Three models, three trade-offs
Model 1
Under the COO or CFO
This works well when security is about protecting people, sites and operations, and keeps decisions grounded in how the business runs. The structural risk is that efficiency, delivery speed and cost can conflict with security’s more cautious posture.
Model 2
Reporting directly to the CEO
This signals strategic priority, removes competing incentives and shortens the escalation path. The trade-off is that security can drift out of sync with operations and cyber without deliberate coordination.
Model 3
A dotted line to the board
Protected, direct access to the board or a committee gives an unfiltered channel when management’s and security’s interests diverge. It only works with clear protocols, otherwise it becomes a political end-run rather than a governance safeguard.
Many European organisations split security leadership in two: the CSO is typically responsible for risk, physical security, resilience and crisis management, while the CISO leads information and cyber security. The reporting question is often sharpest on the CISO side.
A reporting-line reality
Many CISOs in the UK and Europe report to the CIO or another technology executive — a structure that can make independence harder when security needs to challenge delivery and cost pressures.
DORA: independence is now a legal requirement in finance
For banks, insurers, investment firms and other EU financial entities, the Digital Operational Resilience Act (DORA), applying since 17 January 2025, requires the function controlling ICT risk to have an appropriate level of independence to avoid conflicts of interest. Supervisors note that a CISO can take on that role only where the organisational structure gives that independence.
Beyond finance, NIS2 makes management bodies in essential and important entities accountable for approving and overseeing cybersecurity risk measures, so boards need a clear line of sight to security.
Sources: Heidrick & Struggles, Global CISO Organization and Compensation Survey 2024; Regulation (EU) 2022/2554 (DORA), Art. 6(4); FMA Austria; Directive (EU) 2022/2555 (NIS2), Art. 20.
The right structure depends on an organisation’s risk profile, regulatory environment and security maturity — there is no universal template to copy. But whichever model a board chooses, there is one question worth asking regardless:
The question to ask
Does this structure let security-relevant information reach the board without being filtered solely through people whose own performance is judged on different criteria than security?
Whether an organisation gets there through a full board member, a special adviser or a well-designed dotted line for the CSO, the goal is the same: making sure the board’s view of risk is not entirely dependent on a reporting structure that was never designed with the board’s needs in mind.
At Percys, this is one of the first questions we encourage boards to revisit — because the right competence and line of sight matters across commercial challenges, geopolitics, cyber and physical threats.
RELATED READING
