{"schema":"https://ver.cy/schemas/card/1.0.0","id":"vr.tr.chief-information-security-officer","code":"thing-q1072318","url":"https://ver.cy/models/thing/q1072318/","name":"chief information security officer","alternateNames":["CISOBw"],"kind":"thing","status":"published","version":"0.1.0-research.1","language":"en","classifiers":{"family":"Thing Registry","category":"Society, people and institutions","entryKind":"thing","plane":"SOC","domain":["SOC.PER"],"industry":[],"navPath":"","tags":[],"facets":{}},"whatItIs":"A chief information security officer (CISO) is a senior organizational role responsible for leading the information security program and advising leadership on risks to information and supporting systems, with authority and accountability determined by the organization's governance arrangements.","purpose":"Enable an AI agent to recognise a chief information security officer role, assess its mandate and capacity, and determine which security decisions it may make or escalate.","scope":{"in":["Information security leadership mandate and organisational coverage","Reporting relationships, independence and access to governing bodies","Security decision rights, delegated authority and escalation duties","Role-specific competence, qualification and appointment requirements","Accountability for security strategy, programme oversight and assurance","Employment or service arrangement, continuity and role coverage"],"out":["The identity, biography and personal credentials of an individual role holder","The organisation's complete governance and operating model","Detailed security controls, technical configurations and asset inventories","Individual incident records and operational response procedures","Privacy officer, chief information officer and physical security roles except at their interfaces","Job advertisements, recruitment campaigns and employment contracts as documents"],"boundaries":[]},"distinguishingFeatures":["An organisational mandate assigns leadership accountability for information security across an explicitly bounded enterprise, business unit or equivalent remit; the title alone is insufficient.","The role directs or oversees a security programme rather than being defined solely by administering tools, investigating incidents or testing systems.","Information security accountability is distinguishable from responsibility for delivering and operating information technology, even where one person holds both roles.","Security advice, executive reporting and escalation responsibilities can be identified separately from authority to accept business risk.","The role remains identifiable through vacancies, outsourcing or changes of incumbent because its mandate belongs to the organisation."],"structure":{"bundles":[{"id":"security-mandate","name":"Security mandate","description":"Defines why the CISO role exists and the information security territory it covers.","layers":[{"id":"role-recognition","name":"Role recognition","description":"Establishes the role independently of its title and incumbent.","findings":[{"id":"information-security-leadership-accountability","name":"Information security leadership accountability","description":"Record the mandate assigning leadership of information security and the evidence establishing that assignment.","questions":[{"text":"What leadership accountability makes this a CISO role rather than a security specialist or an IT executive role?","id":"information-security-leadership-accountability-q01","kind":"definition"},{"text":"Which approved charter, appointment instrument or equivalent evidence establishes this mandate?","id":"information-security-leadership-accountability-q02","kind":"provenance"}]}]},{"id":"remit-boundaries","name":"Remit boundaries","description":"Locates security coverage across entities, information environments and adjacent responsibilities.","findings":[{"id":"covered-entities-and-security-domains","name":"Covered entities and security domains","description":"Record the covered organisational units and security domains, with explicit exclusions and shared responsibilities.","questions":[{"text":"Which legal entities, business units and information environments fall within this CISO's remit?","id":"covered-entities-and-security-domains-q01","kind":"boundary"},{"text":"Where do responsibilities meet those of privacy, IT operations, product security, operational technology and physical security leaders?","id":"covered-entities-and-security-domains-q02","kind":"boundary"}]}]}]},{"id":"authority-and-governance","name":"Authority and governance","description":"Defines how the CISO exercises authority, reports concerns and handles disputed security decisions.","layers":[{"id":"reporting-and-independence","name":"Reporting and independence","description":"Captures management relationships and routes for raising security concerns.","findings":[{"id":"oversight-access-and-conflicts","name":"Oversight access and conflicts","description":"Record administrative and functional reporting, governing-body access and arrangements for conflicts involving the reporting chain.","questions":[{"text":"To whom does the CISO report administratively and functionally, and what direct access to governing bodies is documented?","id":"oversight-access-and-conflicts-q01","kind":"provenance"},{"text":"How may the CISO escalate a material concern when the normal reporting manager owns the disputed decision?","id":"oversight-access-and-conflicts-q02","kind":"action"}]}]},{"id":"security-decision-rights","name":"Security decision rights","description":"Separates advice, approval, intervention and risk ownership.","findings":[{"id":"delegations-and-risk-acceptance","name":"Delegations and risk acceptance","description":"Record authority by decision type, including limits, conditions and the party accountable for accepting residual risk.","questions":[{"text":"Which policies, exceptions, expenditures or service restrictions may the CISO approve, and under what delegation?","id":"delegations-and-risk-acceptance-q01","kind":"action"},{"text":"Which residual risks may the CISO accept, if any, and which require a business owner or governing body?","id":"delegations-and-risk-acceptance-q02","kind":"boundary"}]}]}]},{"id":"security-programme-accountability","name":"Security programme accountability","description":"Describes the security outcomes and oversight work assigned to the role.","layers":[{"id":"strategy-and-resourcing","name":"Strategy and resourcing","description":"Connects the security remit to priorities, programme plans and available resources.","findings":[{"id":"programme-direction-and-capacity","name":"Programme direction and capacity","description":"Record responsibility for security strategy, prioritisation and resource proposals, together with constraints on delivery.","questions":[{"text":"Which security outcomes and programme commitments is the CISO accountable for directing or overseeing?","id":"programme-direction-and-capacity-q01","kind":"definition"},{"text":"What budget, staffing and leadership time are available for the remit, and which resource decisions belong elsewhere?","id":"programme-direction-and-capacity-q02","kind":"measurement"}]}]},{"id":"assurance-and-crisis-leadership","name":"Assurance and crisis leadership","description":"Defines oversight of security effectiveness and the executive interface during incidents.","findings":[{"id":"assurance-reporting","name":"Assurance reporting","description":"Record the evidence and reporting obligations used to communicate security exposure, control effectiveness and unresolved weaknesses.","questions":[{"text":"Which indicators and assurance evidence must the CISO review, and at what reporting cadence?","id":"assurance-reporting-q01","kind":"measurement"},{"text":"How are unresolved findings, overdue remediation and uncertainty communicated to accountable leaders?","id":"assurance-reporting-q02","kind":"action"}]},{"id":"incident-leadership-interface","name":"Incident leadership interface","description":"Record the CISO's incident responsibilities without assuming the role commands every response or approves every notification.","questions":[{"text":"During a serious security incident, does the CISO command the response, advise the crisis team or perform another defined function?","id":"incident-leadership-interface-q01","kind":"boundary"},{"text":"Who authorises containment, restoration, external communications and any required notifications?","id":"incident-leadership-interface-q02","kind":"action"}]}]}]},{"id":"competence-and-eligibility","name":"Competence and eligibility","description":"Captures capabilities and appointment conditions appropriate to the specific CISO remit.","layers":[{"id":"leadership-and-security-capabilities","name":"Leadership and security capabilities","description":"Defines the capabilities needed to discharge the assigned security leadership responsibilities.","findings":[{"id":"required-capability-profile","name":"Required capability profile","description":"Record expectations for security judgement, risk communication, programme leadership and relevant technical or sector understanding.","questions":[{"text":"Which security, executive communication and organisational leadership capabilities does this remit require?","id":"required-capability-profile-q01","kind":"definition"},{"text":"What evidence and assessment criteria establish that a linked candidate or incumbent meets each requirement?","id":"required-capability-profile-q02","kind":"measurement"}]}]},{"id":"appointment-conditions","name":"Appointment conditions","description":"Separates verified external conditions from employer preferences and occupational classifications.","findings":[{"id":"qualifications-and-applicable-requirements","name":"Qualifications and applicable requirements","description":"Record credentials, experience and any applicable licensing, approval or fitness requirements with their source, scope and effective date.","questions":[{"text":"Which qualifications are organisational preferences, and which are mandatory under a verified rule applicable to this appointment?","id":"qualifications-and-applicable-requirements-q01","kind":"boundary"},{"text":"What authoritative source establishes each mandatory condition and any applicable ISCO, SOC or ESCO classification?","id":"qualifications-and-applicable-requirements-q02","kind":"provenance"}]}]}]},{"id":"appointment-and-continuity","name":"Appointment and continuity","description":"Connects the persistent role to its current staffing arrangement and continuity provisions.","layers":[{"id":"role-holder-arrangement","name":"Role holder arrangement","description":"Records how a person or service arrangement supplies the CISO function.","findings":[{"id":"appointment-and-availability","name":"Appointment and availability","description":"Link the role to its incumbent and any service provider, recording appointment scope, term, availability and concurrent roles.","questions":[{"text":"Who currently holds the role, under which appointment or service arrangement, and for what term?","id":"appointment-and-availability-q01","kind":"provenance"},{"text":"What routine and emergency availability is committed, including limits arising from shared or fractional coverage?","id":"appointment-and-availability-q02","kind":"measurement"}]}]},{"id":"delegation-and-handover","name":"Delegation and handover","description":"Defines how security leadership continues during absence, vacancy or transition.","findings":[{"id":"continuity-of-security-authority","name":"Continuity of security authority","description":"Record acting coverage, delegated powers and handover obligations for outstanding security decisions and commitments.","questions":[{"text":"Who exercises each essential CISO responsibility during absence or vacancy, and what delegation makes that valid?","id":"continuity-of-security-authority-q01","kind":"action"},{"text":"Which unresolved risks, exceptions, incidents and programme obligations must be transferred when the role holder changes?","id":"continuity-of-security-authority-q02","kind":"action"}]}]}]},{"id":"evidence-and-external-alignment","name":"Evidence and external alignment","description":"What the world already says about this thing, gathered so the model can be checked against it.","layers":[{"id":"reported-evidence","name":"Reported evidence","description":"Findings from the breadth pass, kept separate from the structural claims.","findings":[{"id":"evidence-confidence-notes","name":"Check these first","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these check these first hold for the sense of chief information security officer this model covers, and on what evidence?","id":"evidence-confidence-notes-q01","kind":"provenance"}]},{"id":"evidence-kinds","name":"Kinds and varieties","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these kinds and varieties hold for the sense of chief information security officer this model covers, and on what evidence?","id":"evidence-kinds-q01","kind":"provenance"}]},{"id":"evidence-identifiers","name":"Identifiers and schemes","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these identifiers and schemes hold for the sense of chief information security officer this model covers, and on what evidence?","id":"evidence-identifiers-q01","kind":"provenance"}]},{"id":"evidence-standards-and-regulation","name":"Standards and regulation","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these standards and regulation hold for the sense of chief information security officer this model covers, and on what evidence?","id":"evidence-standards-and-regulation-q01","kind":"provenance"}]},{"id":"evidence-real-world-use","name":"Real-world use","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these real-world use hold for the sense of chief information security officer this model covers, and on what evidence?","id":"evidence-real-world-use-q01","kind":"provenance"}]},{"id":"evidence-failure-modes-and-hazards","name":"Failure modes and hazards","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these failure modes and hazards hold for the sense of chief information security officer this model covers, and on what evidence?","id":"evidence-failure-modes-and-hazards-q01","kind":"provenance"}]},{"id":"evidence-regional-variation","name":"Regional variation","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these regional variation hold for the sense of chief information security officer this model covers, and on what evidence?","id":"evidence-regional-variation-q01","kind":"provenance"}]},{"id":"evidence-neighbours","name":"Neighbouring kinds and how to tell them apart","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these neighbouring kinds and how to tell them apart hold for the sense of chief information security officer this model covers, and on what evidence?","id":"evidence-neighbours-q01","kind":"provenance"}]}]}]}]},"agentConduct":{"may":["Explain the role, duties and typical reporting lines of a chief information security officer.","Prepare security reports and risk summaries for a CISO in an organization that authorizes it.","Escalate security incidents to the CISO under the organization's procedures."],"mustNot":["Impersonate a CISO to request credentials, payments or access.","Hide security incidents or vulnerabilities from the CISO or regulators.","Use security monitoring powers to spy on staff beyond the lawful, stated purpose.","Change security controls under a CISO's name without their actual approval."],"requiresHuman":["Declaring a breach, notifying regulators or informing affected people.","Accepting a significant security risk on the organization's behalf."]},"ethics":{"considerations":["CISOs balance protecting people's data against business pressure; concealment harms those whose data leaks.","Workplace monitoring must respect staff privacy."],"affectedParties":["Customers whose data is held","Employees","The organization and its partners"]},"owners":{"steward":"The organization that appoints the CISO; the board holds ultimate accountability.","roles":[],"masterSystems":[]},"relations":[{"target":"Q1072363","type":"parent","note":"registry parent class"}],"interaction":{"identity":{"applicability":"required","items":["Vercy registry: vr.tr.chief-information-security-officer","Wikidata: Q1072318 (https://www.wikidata.org/wiki/Q1072318)"]},"properties":{"applicability":"not-applicable","items":["Mandated security remit: Information security domains and expressly included or excluded responsibilities","Organisational coverage: Covered legal entities, business units, locations and shared services","Reporting and escalation relationships: Administrative manager, functional oversight body and direct escalation recipients","Delegated decision rights: Advise, propose, approve, require remediation, restrict operations or escalate, qualified by decision type and conditions","Appointment arrangement: Employee, interim, contracted, fractional or other documented arrangement","Role coverage state: Filled, acting, vacant, shared or coverage unverified","Competence and eligibility requirements: Required capabilities, experience, credentials and any verified jurisdictional or sector-specific conditions","Security leadership capacity: Allocated hours per week or full-time equivalent, with period and organisational scope"]},"recognition":{"applicability":"not-applicable","items":[]},"capabilities":{"applicability":"required","items":["Determine whether a proposed security decision falls within the CISO's remit and delegated authority.","Route security risks, exceptions and unresolved disagreements to the appropriate accountable decision-maker.","Compare required capabilities with linked evidence about a candidate or incumbent.","Assess whether reporting access, staffing and availability support the assigned security responsibilities.","Identify conflicts, uncovered responsibilities and dependencies on neighbouring executive roles.","Prepare an appointment, delegation or handover checklist grounded in the organisation's mandate."]},"hazards":{"applicability":"required","items":["A CISO without real authority or budget leaves risks unmanaged.","Impersonation of senior officers is common in fraud and phishing."]},"interfaces":{"applicability":"required","items":["ISO/IEC 27001, Information security management systems - Requirements, ISO and IEC.","Cybersecurity Framework, National Institute of Standards and Technology (United States)."]},"context":{"applicability":"required","items":["This role is found in organizations that need senior leadership for information security governance and risk management.","Its mandate is used to assign responsibility for security strategy, incident oversight and escalation to organizational leadership."]}},"sources":[{"title":"Wikidata item Q1072318: chief information security officer","url":"https://www.wikidata.org/wiki/Q1072318","note":"identity and sense of the item"},{"title":"Wikipedia: Chief information security officer","url":"https://en.wikipedia.org/wiki/Chief_information_security_officer","note":"general description of the item"}],"openQuestions":["Does an existing Vercy world model already cover this role, requiring a registry link instead of a separate publication?","What authoritative occupational classifications map to chief information security officer, and how do mappings vary with actual duties and classification version?","Which jurisdictions or sectors impose appointment, qualification, independence or reporting requirements specifically applicable to this role?","What minimum documented accountability distinguishes a CISO appointment from a senior security manager using the title?","How should group, subsidiary and outsourced CISO arrangements allocate overlapping accountability and resolve conflicting instructions?"],"resources":{"spec":"/models/things/publications/thing-q1072318/spec.json"},"provenance":{"origin":"thing registry research (pass 2)","builtFrom":["models/things/publications/thing-q1072318/spec.json"],"providers":["Codex"],"researchStatus":"unreviewed","generatedAt":"2026-09-12T08:36:45Z","builder":"tools/build_cards.py@1.0.0"},"completeness":{"sections":{"classifiers":"filled","whatItIs":"filled","purpose":"filled","distinguishingFeatures":"filled","structure":"filled","agentConduct":"filled","ethics":"filled","owners":"filled","relations":"filled","interaction.identity":"filled","interaction.properties":"not-applicable","interaction.recognition":"not-applicable","interaction.capabilities":"filled","interaction.hazards":"filled","interaction.interfaces":"filled","interaction.context":"filled","sources":"filled"},"notes":{"_gate":"Published through the thing publication gate 1.0 on 2026-10-07T10:10:25+00:00: completeness 1.00; sense: Wikidata description; 2 live sources; review by codex: pass","interaction.properties":"Plane SOC: no invented physical properties.","interaction.recognition":"Professional authority cannot be identified from appearance and must be established through organizational records and delegated responsibilities."},"score":1.0}}