> CISO needs to report to either chief risk officer (edit: who reports to the board) or the board directly imho. I mean, this is all company bylaws, you can't

> CISO needs to report to either chief risk officer (edit: who reports to the board) or the board directly imho. I mean, this is all company bylaws, you can't seriously legislate this. But in any case, C-execs do have skin in the game (particularly if investigated by the SEC). They're usually insulated, but if non-compliant (or grossly negligent), directors can be personally liable.