Who Should the CISO Report To?

Is It a red flag if your Chief Information Security Officer (CISO) doesn’t report to the CEO? If you are a CISO or Head of Security, should you have a preference for reporting to the CEO or to the CTO/main R&D leader?

‍

Let's explore Pave's dataset to see how companies approach this by stage.

CISO Benchmarks from Pave

𝗘𝗮𝗿𝗹𝘆 𝘀𝘁𝗮𝗴𝗲: 𝗖𝗘𝗢. At early stage tech companies, the CISO/Head of Security reports to the CEO ~70% of the time.

‍

𝗟𝗮𝘁𝗲𝗿 𝘀𝘁𝗮𝗴𝗲: “𝗶𝘁 𝗱𝗲𝗽𝗲𝗻𝗱𝘀”. At later stage tech companies, the CISO/Head of Security reports to the CEO about a third of the time, to the CTO/equivalent about a third of the time, and to “Other Execs” about a third of the time.

Regardless of reporting structure, I agree that "it’s really about being in the room where it happens," a quote from Andy Ellis, operating partner at YL Ventures, a venture capital firm that specializes in cybersecurity investments.

‍

What are your thoughts or suggestions to set up your CISO/Head of Security up for success? Let me know on LinkedIn.

‍

Want to hear more from Pave? Subscribe to Pave's newsletter for the latest expert resources and insights directly to your inbox.

‍

‍