Many CSOs and CISOs are starting to report to the chief risk officer rather than the CIO. The shift has not been without some controversy, with the main objection being that no matter how they spin it, technology is still at the heart of the job. The goal is to manage security in a more effective way, said Steven Grossman, vice president of strategy and enablement at Bay Dynamics. Having a CISO with a technical background who is able to translate technology into risk allows for the CRO to have an impact on the perceptions of the board.”]