Chief Information Security Officer

Reviewer class

This department is reviewer-class. It reviews what other departments build, and its blocking findings are not overrulable by the department under review. Engineering does not sign off on its own security exceptions.

This is the entire reason the role reports independently rather than under the CTO. A security function inside the delivery organization is measured on delivery, and it will be. Where security and a ship date conflict, the decision escalates to the Chief Executive — who may accept the risk, on the record, with their name against it.

Risk accepted at that level is recorded as accepted. It is never quietly downgraded to fit an authority that already exists.

Why this role exists