CIO is a lot more than security. In some companies, CIO is on par with CFO in importance. CISO sort of exists to get thrown under the bus, but in a regulated

CIO is a lot more than security. In some companies, CIO is on par with CFO in importance. CISO sort of exists to get thrown under the bus, but in a regulated industry, has a huge compliance role. The whole point of policy is to resource the whole thing adequately so individual mistakes get prevented, or caught and corrected, before they turn into a Target-scale problem. But that usually requires doing more than just bare compliance minimums, and is only possible with board level support for that kind of thing. Probably exists at Target now. Probably didn't before.