Chief Information Officer: the role, the pay, the board view

The chief information officer is no longer the person who keeps the lights on in the server room. The GOV.UK Chief Digital and Information Officer capability framework describes the most senior technology leader as the executive accountable for the information, data and systems an organisation runs on, a definition that has migrated steadily into the private sector. For a board, the CIO is best understood from the outside in: not as the head of IT, but as the executive who owns the enterprise information estate and the operating spine beneath it. In the Gulf the question is sharper still, because group holdings, sovereign platforms and giga-projects are creating the seat where it did not exist a decade ago.

What the chief information officer actually owns now

The CIO began as the head of information technology, the executive who kept core systems running. That definition has not held. The modern chief information officer owns the enterprise information estate: the data, the applications, the infrastructure and the integration layer that the rest of the business depends on to operate. The distinction matters to a board because it changes what the seat is accountable for. A head of IT is measured on uptime and cost. A CIO is measured on whether the company's information and systems are an asset or a constraint on what the business is trying to do.

In most large organisations the CIO will oversee core systems, enterprise applications, data governance, cyber resilience, vendor and budget control, and the technology operating model. The reporting line is the clearest single signal of altitude. A CIO who reports to the chief financial officer is usually still running a cost centre; a CIO who reports to the chief executive and sits on the executive committee is being treated as an owner of business outcomes. Boards should read that line carefully, because it reveals how current management actually regards the function, regardless of the title on the door.

The phrase digital transformation has been worn thin, but the underlying shift is real. As more of a company's operations, customer relationships and decision-making run through software and data, the CIO becomes the custodian of the operating spine rather than a support function bolted to the side of it. That is why the CIO role has pulled away from the rest of the information technologies layer. Claire Maslen, the senior technology and payments leader and a guest on JOH's podcast in episode 15 of The Leadership Blueprint, has described the modern information leader as someone who has to be fluent in the commercial logic of the business first and the technology second. Boards that still scope the seat as a technical appointment tend to hire for the wrong half of it.

CIO, CTO and CDO: who owns what

The most common confusion a board encounters is the overlap between the CIO, the chief technology officer and the chief digital officer. The three titles are used loosely, not every company carries all three, and the boundaries move from business to business. The centre of each role, however, is distinct.

Figure 01FIG-01

Three seats, three remits

Seat	Owns	Measured on
Chief information officer (CIO)	Enterprise information, core systems, data and cyber governance, the internal operating spine	Whether the information estate is an asset or a constraint on the business
Chief technology officer (CTO)	Product technology, engineering and emerging technology	Whether the product and its underlying technology win in the market
Chief digital officer (CDO)	Data as a strategic asset and the digital strategy	Whether digital and data create new revenue and customer value

The hierarchy question, whether a CIO is higher than a CTO, has no fixed answer; it is decided by the company's centre of gravity. In an operations-led or information-intensive group the CIO typically sits senior, because the value at risk lives in the systems and data the CIO owns. In a product or engineering-led business the chief technology officer leads, because the product is the company. Both usually report to the chief executive. A board that asks which title ranks higher is asking the wrong question; the right one is which seat owns the value-critical agenda. JOH's Technology and Digital practice sees the same pattern across mandates: remit and reporting line settle the seniority, not the org chart.

The security dimension sits slightly apart. The chief information security officer is a distinct role focused on cyber and information security risk, and in larger or more regulated organisations it is increasingly a board-level concern in its own right rather than a function nested quietly under the CIO. For most companies, information security still reports into the CIO, but a board governing material cyber exposure should know where that accountability actually lands. The chief data officer, where it exists, owns data as a strategic asset, which can overlap with both the CIO and the chief digital officer; the test is whether the company has enough data ambition to justify a dedicated seat rather than folding the agenda into the CIO role.

What the seat is worth

Compensation is where the separation of the CIO from the IT-director role becomes financially legible. A UK CIO salary sits firmly into six figures, and the spread is wide: a CIO running a mid-market business and a group CIO at a large listed company are not in the same pay bracket, even though they share a title. The variables that move the number are scale, sector and listing status, in roughly that order. The more of the company's value that runs through the information estate, the more the seat commands.

JOH does not publish a salary guide, and the published salary surveys that dominate the search results for CIO pay tend to flatten this variation into a single average that is of little use to a board pricing a specific seat. The directional observation from JOH mandate work is that CIO pay is better understood as a function of accountability than of title. The seat that owns a value-critical agenda is priced accordingly, and total package, including bonus and any long-term incentive, is where the real difference between a cost-centre CIO and a business-outcome CIO shows. Base salary on its own understates it, sometimes badly.

In the Gulf the packaging differs in shape, not only in number. Tax treatment, housing and schooling allowances, and the relocation premium required to attract a group CIO into a regional platform all sit inside the package in a way they do not in the UK. A board comparing a London figure with a Gulf figure on base salary alone is comparing the wrong numbers. The relevant comparison is the total cost of the seat against the value it is being hired to protect or create.

A board that prices the CIO against the cost of running IT will hire a head of IT. The seat is worth what the information estate is worth to the business, and in most large companies that is now a great deal.

The Gulf dimension: where the CIO sits in a group

The Gulf is where the CIO question is newest and most live. In a group-holdings structure the question is not simply whether to hire one, but at what level: a group CIO setting architecture, standards and governance across multiple operating companies, a CIO embedded in each entity, or both. The operating-spine logic is amplified in a group, because a shared information and systems backbone across entities is precisely the kind of value a holding company exists to capture. Get the seat right and the group runs on one spine; get it wrong and it runs on several that do not talk to each other.

The sovereign platforms and giga-projects reshaping the region have created the seat where it did not previously exist. A new sovereign-backed platform building national infrastructure, a tourism or industrial giga-project, or a sovereign investor professionalising its portfolio all need a CIO from close to inception, because they are building the information estate and the operating model at the same time as the business itself. That is a different brief from inheriting a mature IT function. It is a build, not a turnaround, and it calls for a CIO who has stood up an enterprise information capability rather than only run one that already existed.

For a board governing across multiple entities, the harder problem is visibility: knowing whether the executive layer beneath the group, the CIO included, is actually performing against the standard the centre expects. The continuous executive-layer visibility that platforms like Board Pulse are built to give boards across entities is part of how a group chair keeps sight of a function that is, by design, distributed.

The regional demand for senior technology leadership is not theoretical. JOH placed a chief technology officer into a tier-one GCC universal bank running a core-banking modernisation, a mandate where the information and systems agenda was the centre of the institution's strategy rather than a support line beneath it. The same dynamic, where the technology seat owns the value-critical agenda, is what is now generating CIO mandates across the region's banks, holdings and sovereign platforms.

When a board should create the seat

The board decision is not about the job description; it is about threshold and calibre. A company should create or elevate the CIO seat when scale, complexity, regulatory exposure or information-governance risk passes the point where the technology function can no longer be governed from inside another executive's remit. The signals are usually concrete: multiple operating entities on incompatible systems, a cyber or data exposure the board cannot currently see clearly, an acquisition strategy that depends on integration the business cannot execute, or a digital agenda that keeps stalling because no single executive owns it end to end.

The screening question is then whether the candidate is a genuine CIO or an IT director with an inflated title. The distinguishing marks are commercial. A real CIO can hold a board-level conversation about business risk and value, not only about systems; has owned a budget and a vendor estate at scale; and has led through at least one substantial change in how the business operates, not merely a single technology migration. Leadership skills and business acumen separate the seat from the function far more reliably than any technical qualification does.

For executives on the path to becoming a CIO, the implication runs the other way. The route to the seat now passes through commercial credibility and enterprise leadership, not only through deeper technical specialism. The qualification is assumed; what carries an executive into the seat is the demonstrated ability to own business outcomes. A board screening for that is also, in effect, defining what good looks like for the next generation of CIOs.

The cost of getting the appointment wrong is high and slow to surface. A CIO who is really a head of IT will keep the systems running and quietly cap the company's ambition; the failure shows up not as a crisis but as a business that cannot do what its strategy requires. The same pattern of a C-suite seat whose remit the organisation has not fully defined is the subject of AI on the C-suite, and it applies directly here. As with the private equity CFO, the CIO seat is defined by the accountability it carries, not the title printed on the door.

The cost of hiring a head of IT and calling them a CIO is not a failed system. It is a company that quietly cannot do what its strategy requires, and a board that finds out late.

---

Key takeaways

• The chief information officer is now an enterprise-information and operating-spine role, not an IT-management one; the reporting line is the clearest signal of how a company actually regards it.
• The CIO is distinct from the chief technology officer, who owns product and emerging technology, and the chief data officer, who owns data and digital strategy; the centre of each role holds even where the lines blur.
• UK CIO pay sits firmly in six figures and widens sharply with scale, sector and listing status; total package, not base salary, is where accountability is priced.
• In the Gulf the seat is being created new inside group holdings, sovereign platforms and giga-projects, often as a build rather than an inherited function.
• The board decision is about threshold and calibre, not job description: create the seat when complexity and information risk outgrow another executive's remit, and screen for commercial leadership over technical qualification.

---

JOH Partners is an executive search and senior executive recruitment firm advising boards, group holdings and sovereign platforms on CIO, chief technology officer and senior technology leadership mandates across the GCC, the UK and Singapore. For a confidential conversation about creating or filling the CIO seat, engage a partner. Boards governing the executive layer across multiple entities can also see how Board Pulse gives continuous visibility of senior leadership performance.