That may seem a strange question from an ex-CISO like me so let me be clear. The enterprise almost undoubtedly needs a CISO.  But, it is my proposal that the CISO may be more effective reporting into another functional area.   It depends on what type of CIO you are, and what your organization needs from its information security program. Continue reading →