Editor's note — September 12, 2026: Replaced the universal prohibition on security reporting through technology with a context-specific governance recommendation. Removed unsupported organizational-trend superlatives.
The take
Security governance needs clear executive accountability, capable delivery and independent challenge. A reporting line by itself does not prove any of those conditions.
Larger organizations may need specialist security leaders across business units. Smaller organizations may combine technology and security responsibilities. The design should reflect complexity, resources and applicable obligations.
Safeguards I would look for
- A named executive accountable for the security program.
- A documented route to escalate material risks to the CEO and board.
- Independent assurance or challenge of control effectiveness.
- Transparent decisions about delivery pressure, risk acceptance and resources.
Combined CTO/CISO responsibilities make those safeguards especially important. My recommendation is to assess the independence of challenge and the quality of decisions, rather than prescribe one hierarchy for every organization.
Source and further reading: Primary reference. Framework guidance is not a statement that a particular law applies to every organization.