The chief security officer is a fairly new position. We first saw it emerge in larger corporations in the late 1990s; these days, it’s standard in most organizations. The CSO’s role varies, but typically it combines risk management, policy development and investment in security technologies.

So what is a CSO, really? And to whom should he or she report?

Fundamentally the CSO is responsible for evaluating the risk of different business choices, and then directing the mitigation strategy. In other words, the CSO is tantamount to a strategic-information risk manager.

Every business has to balance risk and reward continuously, to find a way to achieve the best returns and the least risk. For security professionals, this is the hardest part of the job: objectively analyzing risk in the context of business goals and possible ROI. It may seem counterintuitive, but the goal for the business as a whole is not to minimize risk — shutting down would be the best way to achieve that. Rather, that goal is to maximize the business’s risk to just below an acceptable level (its risk tolerance).

This means the CSO is not looking at ROI but at return on risk (ROR). In a way, the CSO is the counterpart of the CIO on the risk side. If the CIO is looking to maximize ROI, the CSO is looking to maximize ROR. The board of directors or CEO then is responsible for finding the right balance between ROI and ROR.

That brings us to an interesting conundrum: the potential for the CIO and CSO to have conflicting interests. In many organizations the CSO reports to the CIO, which is like having the fox guarding the henhouse. The CIO’s job is to maximize ROI — in other words, to invest in technologies that deliver the maximum bang for the buck. The CSO’s job is to minimize risk — in other words, to say no to practices (including, but not limited to, technology investments) that increase risk beyond an acceptable level. If the CIO can override the CSO’s decisions, the CSO’s ability to mitigate risk is compromised.

Ideally, the CSO should report to the CEO or board of directors. If that is not possible, the CSO should report to the head of auditing or risk management. That way, the CSO’s goals at least are directly in line with his boss.

If that is not possible, then the best solution is to have the CSO report to the head of audit or risk management. At least that way, the CSO’s goals are directly in line with those of the person he reports to. Otherwise, as noted, CIO is the fox guarding the henhouse -- except that overriding a valid risk concern does not lead to a good meal for the fox. It leads to indigestion for the firm.