Question: who does ciso report to?
Answer: For compliance-focused companies, the CISO may report to a compliance function, or even be the compliance function. This can manifest as the CISO reporting to the CFO or General Counsel. In large financial institutions where effective security is required, typically the CISO reports to the CIO.