FFIEC IT Examination Handbook MGT-I.A.2(c): I.A.2(c) Chief Information Security Officer (Management)

The CISO oversees and reports on the management and mitigation of information security risk across the institution as an enterprise-wide risk manager, is accountable for that oversight, reports directly to the board, a board committee or senior management and not to IT operations so that security decisions and funding are not unduly driven by operational ease or budget, holds the authority the role needs free of conflicts of interest, implements the board-approved security strategy and objectives including monitoring of current and emerging risks, engages with business lines on new initiatives and their inherent security risk, and carries out the further responsibilities the booklet lists.