The Annual Board Briefing and a Reporting Line That Bends
Meridian Mutual, a 2,100-employee insurer, has a CISO who reports to the CIO; the CIO also owns infrastructure operations and the IT budget. Internal audit recently reported three high-severity findings open for more than 200 days, including unpatched internet-facing middleware. The board risk committee has asked for its first annual security briefing. The CIO has drafted the deck around a single metric: 96% of endpoints patched within SLA. Separately, the CISO learned that the claims division signed a three-year contract with a SaaS analytics vendor that ingests policyholder health data, with no security review. The security team is 6 FTE with three frozen requisitions.
1. The CISO has one 30-minute slot with the board risk committee. Should the briefing be built on the CIO's patching metric, and if not, what should replace it?
Read the worked answer
No. The patching number is an activity metric that happens to look good while three high findings sit open past 200 days; presenting it first would teach the committee to trust a number that contradicts the audit record, and the first follow-up question would expose the gap.
Replace it with a short set of risk-based statements:
- The top three risks to the business in plain language (e.g., internet-facing middleware exploitable to policyholder-data loss), each with the audit finding, the business consequence, and the residual risk after current controls.
- The trend on those items since last period, including items where the trend is worsening.
- The decisions the committee must make: accept the residual risk, fund remediation, or change the risk appetite.
The committee's job is oversight of risk, not inspection of operational hygiene. A CISO who presents the metric that flatters the IT organization loses credibility the moment audit or an incident contradicts it, and governance credibility is the CISO's only real lever here.
2. How should the CISO handle the reporting line to the CIO, given the CIO owns the functions being reported on?
Read the worked answer
A reorganisation is not within the CISO's authority and demanding one in the first board meeting reads as a personal grievance. The practical move is to create an independent channel without waiting for a new org chart:
- Ask the board risk committee, through its chair, to establish a standing reporting expectation - the CISO presents risk posture directly, at least annually and on material incidents.
- Route material risk acceptances and unresolved high findings to the enterprise risk committee, where the CIO is one voice among peers rather than the sole approver.
- Put the open findings, the frozen requisitions, and the resulting residual risk in writing to the CIO first, so escalation is a documented difference of view rather than an ambush.
The governing principle: oversight is compromised when the same executive both owns the control environment and adjudicates its adequacy. The CISO's obligation is to make that conflict visible to the body accountable for it, not to resolve it unilaterally.
3. What should the CISO do first about the unvetted SaaS vendor holding policyholder health data?
Read the worked answer
Do not order the division to stop using the service - the CISO has no authority over the contract, the data is already flowing, and a unilateral shutdown creates a business incident that will be blamed on security.
Sequence:
- Establish facts fast: what data fields, how many records, where stored, who at the vendor can access it, and whether a data-processing agreement with security terms exists.
- Contain the worst exposure with controls already available to the CISO: SSO enforcement, access review of the vendor's user list, logging, and DLP coverage of exports.
- Engage the business owner with the exposure in business terms, and route the vendor through third-party risk assessment - contract renewal leverage, not emergency termination, is the realistic path.
- Formalise it: a documented, time-bound exception with an owner and a remediation date, and escalate to the risk committee if the vendor cannot meet minimum terms.
If the data includes regulated health information and the vendor cannot meet baseline terms at all, that is a risk acceptance above the CISO's authority and belongs in front of the risk committee with a recommendation.