Organizations tend to reach the CISO question through an external event — a customer's security schedule, a regulator's interest, a failed questionnaire, an incident. The instinct is to hire, the budget does not support it, and the compromise is to add the responsibility to someone who already has a job. That compromise is worth examining before it is made.
What the Role Is Actually Doing
Separate the role into two parts. One is judgement: deciding what risk the organization accepts, defending that decision to a board, a regulator or a customer, and setting the direction of the security programme. The other is presence: being in the building, in the meetings, close enough to the work to catch what a report would not surface.
The judgement part is senior, intermittent and expensive to buy full-time. The presence part is continuous and does not necessarily require the same seniority. Most organizations that struggle with the decision are trying to buy both in one person because that is how the role is conventionally packaged.
Reasonable Signals for Each Route
Hire when the presence is the constraint: a large internal security function, frequent operational decisions requiring authority, or a regulatory relationship that expects a named accountable individual on site.
Retain when the judgement is the constraint: a small team executing competently, obligations rising faster than headcount, and a board that needs a credible answer rather than daily supervision.
Do neither, deliberately, only if you can name who accepts risk: if that person cannot be named, the organization has not avoided the cost. It has deferred it.
“An unfilled CISO vacancy and an undefined CISO responsibility look identical from the outside, and only one of them is temporary.”
The Failure Mode to Avoid
The common failure is not choosing wrongly between the two. It is asking a capable engineering or IT manager to carry a board-facing accountability without the authority, the time or the mandate to discharge it — and then treating the resulting gaps as a performance issue. Whichever route is chosen, the useful test is the same: when a risk cannot be resolved, is there somebody whose job it is to decide, and does the organization know who that is?
