Should Cybersecurity Report to the CIO or Directly to the CEO?

Cybersecurity is increasingly a strategic business risk management issue, rather than solely a technological one. In this context, should the CISO report to the CIO or directly to the CEO? While reporting to the CIO facilitates coordination with Technology, reporting directly to the CEO strengthens the independence and visibility of the security function. This raises the question of whether a model in which the CISO works closely with the CIO while having direct access to the CEO to escalate critical risks and incidents offers the best balance.