Re: CISO or CSO reporting

[Rodney Petersen <rpetersen () EDUCAUSE EDU>]

There was a similar discussion under the subject heading "Reporting
Structure" in April 2004 and "CISO?" in January 2004.  Please review or
search the listserv archives
(http://listserv.educause.edu/archives/security.html) for more details.

The EDUCAUSE Center for Applied Research's Security Study
(http://www.educause.edu/asp/doclib/abstract.asp?ID=ERS0305), conducted
in April 2003 and issued in October 2003, revealed that 95 percent of
the IT security officers report to a senior administrator in the IT
office, including 50 percent who report to the CIO.

We are in the process of finalizing results from the November 2005
security survey and expect to have new results to report this summer.

Rodney Petersen

-------------------------------------------------- 
Rodney J. Petersen
Policy Analyst & Security Task Force Coordinator

EDUCAUSE 
1150 18th Street, N.W., Suite 1010
Washington, D.C.  20036
(202) 331-5368 / (202) 872-4200 
(202) 872-4318 (FAX) 
EDUCAUSE/Internet2 Security Task Force
www.educause.edu/security 
-------------------------------------------------- 

-----Original Message-----
From: Chad McDonald [mailto:chad.mcdonald () GCSU EDU] 
Sent: Monday, March 20, 2006 12:52 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] CISO or CSO reporting

For those of you that have a Chief Security Officer, or Chief
Information Security Officer, what is your reporting structure for this
position?  Does it report to the Chief Information Officer, the
President, etc?

Thanks, 

Chad McDonald, CISSP
Chief Information Security Officer
Georgia College & State University
Office   478.445.4473
Cell     478.454.8250
Fax      478.445.1202