CISO Chief Information Security Officer.

What a CISO actually owns

The CISO is the executive accountable for the information-security strategy, and the emphasis is on accountable. As the shortDefinition puts it, the job is governance, not implementation. A CISO does not configure firewalls or write detection rules; they decide where the organisation spends its limited security budget, which risks it treats and which it accepts, and how it answers when something fails. The day-to-day artefacts of the role are a risk register, a programme roadmap, an incident-response plan, and a set of board-level reports, not a terminal.

That distinction matters because security leadership is frequently misunderstood as a senior engineering role. It is not. The CISO sits at the boundary between the technical teams who run controls and the executives who fund them and carry the consequences. The hardest part of the job, as the shortDefinition notes, is the boardroom translation: turning a sprawling technical reality into a small number of decisions a board can actually make. A CISO who cannot explain residual risk in business terms cannot do the job, however deep their technical background.

Accountability under NIS 2 and DORA

For years the CISO role carried responsibility without much formal accountability. That has changed. The shortDefinition is explicit that under NIS 2 and DORA the accountability is now personal. NIS 2, the European directive on network and information security, pushes cybersecurity oversight up to the management body of in-scope entities and makes that body responsible for approving and supervising security risk-management measures. DORA, the Digital Operational Resilience Act, does the equivalent for the EU financial sector, placing operational-resilience accountability firmly with the management body. The practical effect is that "the security function does its best" is no longer a defensible posture; named leadership has to own the risk decisions in writing.

This is why a modern CISO spends so much time on documentation and reporting cadence. Signing off on residual risk, briefing the board on the threat landscape, and evidencing that risk-management measures were approved at the right level are no longer good-practice extras. They are how the organisation demonstrates it met its legal obligations. The role has shifted from "run the security team" toward "make the governance defensible."

How the CISO differs from neighbouring roles

The CISO is often confused with the people and functions around them. A security manager or a CISM-certified programme owner runs the security programme and may report to the CISO; the CISO sets the strategy and carries the executive accountability for it. A SOC lead owns detection and response operations; the CISO owns the decision about how much detection capability the organisation will fund and what it will do when the SOC escalates a major incident. And where the organisation runs an ISO 27001 ISMS, the CISO is typically the executive sponsor of that management system rather than its day-to-day operator.

One pairing worth separating cleanly is the CISO and the Data Protection Officer. They overlap on incidents involving personal data, but they are different jobs. The DPO is a compliance and oversight role with a legally protected independence; the CISO is an executive who owns and is measured against the security strategy. In many organisations they collaborate constantly and report through different lines, precisely because the DPO is meant to be able to challenge the business, including the security function.

For practitioners on a path toward the seat, the honest framing is that the CISO role rewards judgement and communication more than tooling. The technical foundation is assumed; what gets people hired and keeps them effective is the ability to own risk, brief a board, and make accountability defensible under frameworks like NIS 2 and DORA.