The position of the Chief Information Security Officer (CISO) has been debated for years. Historically, the position has belonged within IT security, as the CISO needs many of ITs skills to install and monitor complex security products. Most of the IT pros believe security is no longer simply a subset of IT but it is a business concern that touches every aspect of a company. Most CISOs report to the CIO, but the vast majority would prefer not to do so.”]
Source: https://informationsecuritybuzz.com/articles/where-does-the-ciso-belong-in-the-corporate-world/