Ask an Information Security Officer what they spend their time on and the answer is often a long list. Writing policies. Answering supplier questionnaires. Chasing patches. Approving firewall changes. Running awareness campaigns. Preparing audit evidence. Explaining to managers why a risk matters. Following up actions that managers agreed to but never carried out.
Many ISOs are busy, committed and quietly overloaded. And in many organisations, despite all that effort, risk is not well managed. The two facts are related.
A familiar situation
During a risk assessment, the ISO identifies that a business application with sensitive client data still uses shared accounts for administrators. The ISO writes it up, rates it as high and raises it with the IT manager. The IT manager agrees but says there is no budget this year. The application owner in the business has never heard of the issue.
Three months later, the ISO asks again. Nothing has changed. The ISO raises it at a management meeting, where it is noted. Six months later, an auditor finds the same issue and asks who accepted the risk. Nobody did. The finding is recorded against the ISO's area.
The ISO did the right analysis. What went wrong is that the risk never reached the person who should have decided about it.
Why ISOs end up owning everything
The pattern usually develops gradually and with good intentions:
- The ISO is the person who understands the risk best, so it seems efficient for them to handle it.
- Managers see security as technical and specialist, and assume it belongs to the security team.
- The ISO's role description is vague, so there is no clear line between advising and doing.
- There is no agreed route for escalation, so the ISO has to rely on persistence and personal relationships.
- When things go wrong, the security function is held accountable, which encourages the ISO to take more control.
The result is a role that is responsible for everything and in charge of very little. It is not sustainable, and it does not produce better security, because the people who control budgets, processes and priorities are not making the decisions.
The Three Lines Model
The Three Lines Model, published by the Institute of Internal Auditors, is a useful way to clarify roles. It distinguishes:
- First line roles: management that runs the business and owns its risks. They decide on priorities, implement controls and accept residual risk within the risk appetite.
- Second line roles: specialist functions such as information security, privacy and risk management. They provide expertise, set frameworks, monitor and challenge the first line.
- Third line: internal audit, which provides independent assurance to the governing body about whether the whole arrangement works.
In this model, the ISO is a second line role. Their job is to make sure risks are identified, understood and decided upon by the right people. It is not their job to own the risks or to carry out every control.
The 2020 update of the model emphasises that the lines must cooperate and that second line roles may also support the first line with expertise. That is helpful in practice, but it does not change the basic principle: the person who controls the activity owns its risk.
Advise, challenge, escalate
A practical way to describe the ISO's role is in three verbs.
Advise
Explain the risk in terms the owner understands: what could happen, how likely it is, what it would cost and what the options are. Good advice includes a recommendation and an honest view of the trade-offs, not only a list of requirements.
Challenge
Question decisions that seem inconsistent with the risk appetite or the facts. "You have rated this as low impact, but this system holds the data of all our clients. Can you explain the reasoning?" Challenging is not the same as overruling. The owner can still decide, but must do so knowingly.
Escalate
When a risk exceeds what the owner is allowed to accept, or when an agreed action is not carried out, the ISO raises it to the next level. This should follow an agreed route, so that escalation is a normal part of governance and not a personal conflict.
What makes this work
This role only works if the organisation has put a few things in place:
- A written mandate that states what the ISO may do: access to information, the right to be consulted on changes, the right to escalate directly to a named board member.
- Named risk owners for each significant information system or process, at a level where they can actually decide on resources.
- A risk appetite that states which risks managers may accept themselves and which must go higher.
- A regular moment for decisions, such as a quarterly risk review where owners report on their risks and the ISO adds an independent view.
Without these, the ISO has to choose between doing everything themselves and watching things go wrong.
When the ISO has to say no
Advising and challenging does not mean the ISO never stops anything. There are situations where an immediate intervention is justified: an active incident, a change that would clearly break a legal requirement, or a risk far beyond anything the organisation has agreed to accept. The mandate should say explicitly in which cases the ISO may block or pause an activity, and to whom they report when they do so.
Outside those cases, the better approach is usually to make the decision visible rather than to make it. A short written note to the risk owner stating the risk, the recommendation and the request for a decision often achieves more than months of informal pressure. If the owner accepts the risk, that is a legitimate outcome, provided it is within their mandate and recorded. If it is not within their mandate, the note becomes the basis for escalation.
What this asks of the ISO
Moving from doing to advising requires different skills. The ISO needs to explain risk in business language, negotiate priorities with managers who have other concerns, and stay calm when a decision goes against their advice. They also need to accept that some risks will be accepted that they would not have accepted themselves. That is uncomfortable, but it is how governance is supposed to work. The ISO's responsibility is to make sure the decision is informed, not to make every decision.
Three things to do this quarter
- Take the five highest risks on the register and check who the named owner is. If it is the ISO or "IT", find the business owner and transfer it formally.
- Write down the escalation route for risks above the agreed appetite, including whom the ISO reports to and within what period.
- Review the ISO's role description and remove tasks that belong to the first line. Agree with management who will carry them out instead.
Conclusion
An effective ISO is not the person who solves every security problem. It is the person who makes sure every significant security problem is understood and decided on by the person responsible for it. That requires a clear mandate, real risk owners and an accepted route for escalation. With those in place, the ISO can focus on advice and challenge, which is where their expertise adds most value.
Clarifying roles, mandates and escalation is part of Security Governance. For security and privacy professionals who want to strengthen their advisory and challenge skills, FLODISQ offers team development and professional training that works with these situations directly.