Chief Information Security Officer: Who Tells the Board the Truth

The chief information security officer is the one senior appointment where a Gulf regulator has already described the job, and where boards still tend to hire for a different one. Saudi Arabia's National Cybersecurity Authority sets out in its Essential Cybersecurity Controls that the security function must be independent of IT, with its head reporting to the head of the organisation or a delegate. In practice, JOH Partners sees many Gulf groups appoint a capable technologist and then place that person under the executive whose systems they are meant to test. This piece sets out why that arrangement fails at the one moment it matters, and what a board can do before that moment arrives.

A chief information security officer the regulator has already described

The National Cybersecurity Authority's guidance on organisational structure is blunt on one point. The cybersecurity function should be independent of the information technology function, and the person who leads it should report to the head of the organisation or a delegate, with real say over the main security decisions. The guidance ties this to control 1-2-1 of the Essential Cybersecurity Controls. It reads like a technical standard. It is really a statement about who is allowed to bring bad news.

The Saudi controls apply to the organisations the authority covers, but the logic travels. Groups in the UAE, Qatar and elsewhere in the region answer to their own central banks and market regulators, and any board can ask itself the same question: should the person who protects the systems also be the person who owns them? The reason to say no is simple. A security head who reports to the chief information officer is asked, every quarter, to grade the work of their own manager.

The boundaries between the neighbouring jobs are worth stating plainly, because boards blur them. The chief information officer runs the systems and decides how they are built. The chief risk officer owns the group's risk register, where cyber is one category among many. The chief compliance officer owns the group's duty to meet its rules. The chief information security officer owns the security programme itself, and owns the facts about how well it is working. That last part is the one boards forget. How a board or audit committee tests a candidate for it is set out in the chief information security officer interview guide.

Most boards cannot judge a security programme

Few directors have run a security team. Most cannot tell whether a patching programme is good, or whether a testing result is a comfortable one. They are shown a dashboard of green, amber and red, with a percentage here and a trend line there, and they are asked to be reassured.

The dashboard is not the problem. The problem is that the board has no independent way to check it, so the dashboard is only as honest as the person who prepared it. That is why the choice of the person matters more than the choice of the tools.

Most boards cannot judge a security programme. What they can judge is whether the person in front of them will tell them the truth.

JOH's research on the control layer beneath the Gulf chief executive looked at how legal, risk and audit sit in Gulf governance. In JOH's experience boards have learned to ask who holds those functions and how they report. They have been slower to ask the same of security, because it looked like an IT matter for most of the last decade. It stopped being one when a security failure became a board-level event: a halted payments system, a leaked client file, a regulator asking for an account of what the board knew and when.

The reporting line decides what the board hears

When a security head reports into the chief information officer, a particular thing happens, and it is rarely dishonest. A finding that would embarrass the technology team is discussed with the technology team first. It is reworded. A fix is promised. By the time it reaches the board, it is a smaller problem than it was, or a solved one, or one that has been folded into a longer programme.

Nobody lied. Each step was reasonable. But the board has received a version of the truth that was shaped by the person with most to lose from it.

The reverse arrangement has its own risk. A security head who reports straight to the chief executive, with no working relationship with the technology team, can become an outside critic who is told nothing until it is too late. The best arrangements JOH has seen keep the line independent and the working relationship close: the security head sits apart on paper and sits beside the chief information officer in practice. That takes a particular kind of person, someone who can disagree with a colleague on Monday and rely on them on Tuesday.

JOH's research on who answers for technology on the Gulf board is the companion read on how boards are assigning their technology questions, artificial intelligence included. In JOH's experience many of those questions end up on the security head's desk, whether or not the appointment was given the standing to answer them.

What the first bad day reveals

A composite shows how this plays out. Its details are changed and combined, and it is not an account of one client.

A regional bank has a capable security head who reports to the chief information officer. For two years the quarterly report to the audit committee is steady and unremarkable. Then an outside testing firm finds that a set of administrator accounts in a core system has far more access than anyone intended. The security head knows within a day. The finding goes to the chief information officer, who asks for a week to fix it before it reaches the committee. The week becomes three. When the committee finally hears about it, the first question is not about the accounts. It is why nobody said anything for three weeks.

The fix was good. The delay is what damaged trust. And the delay was a consequence of the reporting line, not of anyone's character.

JOH's work placing a chief technology officer into a tier-one GCC universal bank is a useful reference for how technology leadership around a multi-year modernisation programme is scoped, which is the question a security appointment has to be set against. When that boundary is drawn before the appointment is made, the later arguments about who tells the board what are much shorter.

Testing the person across the table

A board cannot read a security programme, but it can interview the person who runs it, and that interview is worth more than most boards realise. The useful questions are plain ones. When did you last tell a chief executive something they did not want to hear, and what happened to you afterwards? Who in your last role could change your report before it left your hands? If your budget were cut in half tomorrow, what would you stop first, and what would you tell the board you had stopped?

A security head who answers those in specifics, with names and dates, can be trusted with the board's attention. One who answers in general terms about collaboration and alignment is telling the board something too, though not what they meant to say.

Boards that want a standing view between audit cycles, rather than a quarterly paper, increasingly use platforms such as Board Pulse to track how the senior control appointments are performing against their brief. For a wider view of how trust is built and tested inside senior technology teams, Claire Maslen's conversation on trust in multicultural teams and 30 years of digital payments leadership is a useful companion listen.

A security head is only useful if the board will hear bad news early. If the thing everyone remembers is a delay, the reporting line was wrong long before the incident.

What a board should settle before the next appointment

The reporting line comes first. Decide whether the security head reports to the chief executive, to another executive, or to the audit committee chair for assurance purposes, and write down why. For the organisations the Saudi authority covers, the regulator has answered the question. Everywhere else the board has to answer it for itself.

Access matters as much as the line on paper. The security head should be able to put a report in front of the audit committee without it passing through anyone whose own work it describes. Boards that hold a closed session with the security head once or twice a year, without management present, find out more in an hour than they do from four written papers.

Scope is the last piece, and the one most often left vague. Does the appointment include physical security, data protection, privacy, or the response to artificial intelligence risk? A role scoped loosely is a role no one can succeed in, and no one can be held to.

For a group in the financial sector, where central banks and market regulators already set expectations, the financial services sector page sets out how JOH approaches senior control appointments in that setting.

---

Key takeaways

---

JOH Partners is an executive search and senior executive recruitment firm advising boards, family groups and sovereign-adjacent platforms on chief information security officer and wider control appointments across the GCC, the UK and Singapore. Where the security head should sit is best settled before a search begins, and a board can engage a partner to talk it through in confidence. Boards wanting continuing sight of how their security and control appointments are performing can also request a Board Pulse demo.