Who should a CISO report to?

In most Canadian companies under 500 people the CISO or vCISO should report to the CEO, with a standing line to the board or audit committee. Reporting into engineering is the arrangement that causes the most trouble later.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

Report the security lead to the CEO, with a written right to address the board or audit committee at least once a quarter. That is the arrangement that survives an audit, an insurance renewal and a bad quarter. The common alternatives all have a specific failure mode: reporting into the CTO means the builder approves the assurance, reporting into the CIO buries security inside an IT budget it has to compete with, and reporting into legal turns every technical decision into a document review.

The four reporting lines, and what each one breaks

Why the board line matters more than the solid line

Directors owe a duty of care that they can only discharge on information they received. If the only path from the security lead to the board runs through the executive whose budget or ship date is being questioned, that information is filtered by exactly the person with a reason to filter it. The fix is small and cheap: a written statement that the security lead presents to the board or audit committee quarterly and may request time between meetings.

For a vCISO this is more important than for an employee, because a contractor has less standing to insist. Write it into the engagement. What goes into that quarterly paper is set out on reporting security to a board, and the section-by-section template is on the board report template.

Where a vCISO sits

A vCISO is not on the org chart, so the question gets skipped. Answer it explicitly instead. The engagement letter is the only place the answer can live.

1. Name the executive sponsor. One person, by name, who the vCISO escalates to and who can unblock budget.
2. Write the board access down. Quarterly presentation, plus the right to request time.
3. Say who approves a risk acceptance. The vCISO recommends. Someone employed by the company signs, and the signature is in the risk register.
4. Say what happens on disagreement. If engineering overrules a recommendation, the recommendation and the override both get recorded rather than the disagreement evaporating in a call.

The fourth item is the one that gets left out and the one that matters during an incident review. The rest of what belongs in the agreement is on the vCISO contract checklist.

Regulated and public company differences

Federally regulated financial institutions in Canada work under OSFI Guideline B-13, which expects clear accountability for technology and cyber risk at senior management level and appropriate board oversight. In practice that pushes the reporting line towards a risk function rather than towards engineering. The detail is on vCISO work for OSFI regulated institutions.

Companies listed in the United States disclose their cybersecurity governance under Regulation S-K Item 106, including which board committee oversees cyber risk and the relevant expertise of the management people responsible. A reporting line that reads badly in a filing reads badly because it is bad. That disclosure is covered on SEC cyber disclosure for Canadian companies.

Under about 60 people there is no reporting line to design. What matters is that accountability sits with a named person, and that risk acceptances are not signed only by the person who benefits from shipping. Who owns security when there is no CISO works through the small company version, including the awkward case where the engineering lead already has the job and it is not working.

Common questions