> Give the COO/CTO the last say, not the CISO. The problem with this is that when the COO/CTO doesn't understand or respect the CISO or their job, you end up w

> Give the COO/CTO the last say, not the CISO. The problem with this is that when the COO/CTO doesn't understand or respect the CISO or their job, you end up with easily-preventable security breaches. There need to be places where security is paramount. There need to be places where user access/experience is paramount. There are no hard and fast rules as to where these are. Human judgement is required, however messy that ends up being.