The security manager currently reports to the CIO, who also runs IT operations and has repeatedly delayed security findings that would affect operational targets. The board is reviewing where the security role should report. What is the MOST important consideration?
Select an answer to reveal the explanation.
Short Explanation
If the person you're reporting problems about is also your boss, you've got a conflict built into the org chart. What matters is that the security role has the clout and independence to raise issues without them getting buried. The trap is choosing speed or neatness over independence.
Full Explanation
The reporting line of the information security function determines whether security issues reach decision makers without filtering. When the person the security manager reports to is responsible for operations that security findings affect, a conflict of interest exists, and the scenario shows its consequence: findings are delayed to protect operational targets. The board's most important consideration is therefore to place the role where it has sufficient authority to influence the organization and sufficient independence to report risk objectively, which may mean reporting to the chief executive, a chief risk officer or another senior executive outside IT operations. Keeping the role close to IT for implementation speed preserves the conflict that caused the problem; collaboration with IT can be maintained without a reporting dependency. Keeping the chief executive's span of control small is a legitimate organizational concern but secondary to effective governance of security risk. Matching peer organizations may be informative, but each organization's structure should reflect its own risks and culture. Exam caveat: CISM does not mandate a single correct reporting line; the principle is independence and authority. Operational check: confirm the role has a direct escalation path to the board or a board committee for unresolved risk issues.