What are the advantages of being both CIO and CISO of an organization?

Security Strategy & Roadmap Team & Organizational Design IT Strategy & Roadmap

1.4k views29 Comments

CIO in Telecommunication, 1,001 - 5,000 employees

Being both the CIO and CISO gives you a full picture of the IT infrastructure as well as the services and solutions that you provide. It can be tougher because it's a much larger role, but having it centralized instead of being split between two people makes it easier to have a comprehensive understanding of your end-to-end organizational IT services. There's no separation there because I have both roles, so there's nothing that can be missed.

Director of IT in Manufacturing, 5,001 - 10,000 employees

Manage budget , implementation IT Program & manage skill & competency IT Team

Senior Director Enterprise Applications in Software, 1,001 - 5,000 employees

I prefer a separation of duties so that the judge has a different role than the prosecutor because it can create a conflict of interest if not done correctly. The advantages are that the dual role individual can align budget spend to maximize the value to the organization and eliminate duplicate efforts and overlapping tool sets. Another advantage is that audit findings tend to always get remediated where as the alternative split roles tend to deprioritize those functions which can increase risk.

Global CIO in Telecommunication, 5,001 - 10,000 employees

Critical for compliance, as well as maker and checker role. CISO requires deep hands on expertise as SME while CIO is a balance of business Techno commercial person.

CTO in Services (non-Government), 51 - 200 employees

The straightforward answer is that every decision made as a CIO has security in mind as that responsibility hasn't been delegated. If the roles are split decisions made by the CIO will always have security as a secondary consideration. The benefits of splitting are, of course, having someone dedicated to ensuring the cyber security of the organisation is their top priority, and chasing down any issues. This level of focus can't be employed by the CIO who has numerous other considerations.

Director - IT, Enterprise Services and Value Management in Software, 10,001+ employees

I see that there are both, pros and cons. A singular role certainly helps as the understanding of the estate, common priority and alignment of various teams within helps fast-pace outcome. At the same time, depending upon the size of the organization, it me just be an overstretch for it being a single role. And then there are elements of shadow IT which brings in added challange.

CIO in Services (non-Government), 5,001 - 10,000 employees

I believe improved alignment and decision making is a benefit. While huge strides have. Been made to partner IT and Security. There still remains challenges which could create obstacles to progress

Secure Facilities Information Technology Manager in Manufacturing, Self-employed

Sems like being CiO & CISO could be just as disastrous as advantageous. Depends on how you treat the responsibilities, which should be separate.

VP, Technology Manager in Education, 10,001+ employees

I believe that a dual role provides for greater accountability on technical vulnerabilities. While a CIO role can be focused on meeting business demands primarily, a CISO role must have greater focus on the technological risk of all solutions. By combining these roles into one the individual leader must balance these two important priorities.

Sr. Managing Director in Finance (non-banking), 5,001 - 10,000 employees

Advantages of same person being CIO and CISO:
- Easy to prioritize budget, one budget
- no duplicate tool set or conflict of priorities
- security is at the heart of any CIO conversation, discussion, decision
But quite a few disadvantages:
- too much to handle
- no one to check on you
- security may be compromised in a desire to deliver fast or deliver more
The middle road depending on the size of the organization may be that CISO reports to CIO.