3 MIN READ
The first edition of the CISO handbook sold a specific idea. The CISO could sit as a peer to the CIO, in the same room, with the same level of authority, with the same direct line to the chief executive. The second edition quietly walks that back. The role has shifted. The board has shifted. The threat has shifted. The playbook that worked in 2020 does not work in 2026.
The 2026 CISO is closer to a chief risk officer than to a chief information security officer. The technical craft still matters, but the centre of gravity has moved upstream. Most of the new job is translation. Take the technical risk, render it into the language the board speaks, make the case for the budget, survive the breach when it comes, then do it all again. Three shifts are worth noticing.
What changed about the role
Reporting line first. The CISO used to report to the CIO, which meant the security budget competed with every other IT project. Most large enterprises have now moved the CISO out from under the CIO, with the role reporting to the chief executive, the chief operating officer, or the general counsel instead. Looks administrative on paper. In practice it is the most consequential change to the job in a decade, because the security conversation is no longer filtered through the IT prioritisation fight.
Then the regulatory pressure. The SEC cybersecurity disclosure rules, the EU NIS2 directive, the DORA regulation in financial services, and a dozen sector specific rules now hold the CISO personally accountable for the accuracy of the breach disclosure. The legal exposure has changed the risk profile of the role. Plenty of experienced CISOs have started asking their general counsel to sign off on every external statement, which is the kind of behaviour change that tells you the risk has genuinely moved.
Finally the talent market. Average CISO tenure in the Fortune 500 has dropped below three years. The role has become a high turnover position, which means institutional knowledge evaporates, which means the playbook has to be portable, not personal. A CISO who builds a security programme that depends on their own presence is building a programme that resets every time they leave.
What the board expects now
The board stopped reading dashboards in 2024. They want a clear answer to one question: what is the residual risk we are carrying, and is it sitting at an acceptable level. The dashboard is the evidence. The answer is not the dashboard. A good CISO walks into the board meeting with the single number, the trend, and the three risks that need the board’s attention. A bad CISO walks in with thirty slides, most of which the board will not read. The difference is preparation, not tenure.
How to actually do the job
Three moves that the CISO who keeps the job past year two tends to make.
Pick the battles. Trying to fix every finding on every audit burns out in eighteen months. Pick the three risks that could put the company on the front page of the Wall Street Journal and get those right. Defending a small set of priorities out loud, in front of the board, is what holds the job. Defending everything in writing is what loses the room.
Build the metrics that matter. Mean time to detect, mean time to respond, the percentage of crown jewels covered by MFA, the percentage of third parties that have completed the security review. Four numbers, well chosen, tell the board more than any dashboard. Anything more than four is a story the board will not read.
Stop apologising for the basics. Patch management, asset inventory, identity hygiene, backup verification. Defending the basics out loud, in front of the board, is how the CISO earns the credibility to ask for the harder things later. The basics are not the warm up. They are the job.
The bottom line
The CISO role in 2026 sits upstream of the technical craft, downstream of the board. Pick three battles, win them, and earn the credibility to ask for the next three. Defend the basics out loud, translate the rest into the language the board already speaks, and survive the breaches that come. The CISO who works the playbook that way holds the job long enough to matter. The one who tries to fix everything does not.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
