Skip to content
CISO Spotlights

Glossary

Security leadership titles: CISO, CSO, VP of security, head of security and BISO

Security leadership titles name the people who lead security: CISO, CSO, VP of security, head of security, BISO. What each signals and how this site maps them.

Term: Security leadership titles · also security executive titles, CISO equivalent titles

By the CISO Spotlights Desk · Published · 5 sources

Security leadership titles are the job titles organizations give the people who lead security work, among them chief information security officer (CISO), chief security officer (CSO), vice president (VP) of security, head of security and business information security officer (BISO). The same work can carry different titles and the same title can carry different scope, so cisospotlights.com records each title as its source states it.

What the main titles usually signal

CISO. The one title with a regulatory definition here. New York's 23 NYCRR Part 500 defines the CISO as "a qualified individual responsible for overseeing and implementing a covered entity’s cybersecurity program and enforcing its cybersecurity policy."

CSO. Often a wider remit that can cover people, sites and information as well as cyber risk. The ASIS International standard ANSI/ASIS CSO.1-2013 treats CSO as a description of a function, not a recommended job title, and scopes it to threats against tangible and intangible assets.

VP of security and head of security. Rank and team titles rather than defined remits. Either can be the top security job at a company with no C-level post, or a role one level below a CISO.

BISO. On this site, a security leader assigned to a business unit who works with that unit's leadership. The site treats it as a step below the top seat unless a source shows otherwise.

Federal titles. US agencies use a statutory title. Under 44 U.S.C. 3554, each agency designates a senior agency information security officer whose primary duty is information security and who must hold the professional qualifications the job requires.

Why titles alone mislead

The federal workforce framework says outright that its work roles are not job titles, as the NICE Framework published through CISA puts it. Disclosure rules avoid titles too: Item 106 of Regulation S-K asks public companies which management positions are responsible for cyber risk, whatever those positions are called.

How this site maps them

Each profile keeps the title verbatim, including combined titles that join security with technology, privacy, trust or strategy. The path tags then apply one test. A person counts as a repeat CISO if they held a CISO or equivalent top security title somewhere else first, and as a deputy if they held a deputy or number-two security role just before the top job. A CSO, VP or head of security therefore counts as the seat when the source shows it was the organization's top security role. The site ranks no title above another.

Where it appears on cisospotlights.com

Related terms

Chief security officer (CSO), head of security, fractional CISO and interim CISO.

Sources

  1. 1.
    New York State Department of Financial Services, 23 NYCRR Part 500 (Second Amendment)dfs.ny.gov · published 1 November 2023 · tier A
  2. 2.
    ASIS International, ANSI/ASIS CSO.1-2013 Chief Security Officer: An Organizational Model (preview)webstore.ansi.org · published 8 November 2013 · tier A
  3. 3.
    U.S. Code, 44 U.S.C. 3554, Federal agency responsibilities (GovInfo)govinfo.gov · published 19 October 2026 · tier A
  4. 4.
    CISA NICCS, NICE Workforce Framework for Cybersecurity (components v2.2.0)niccs.cisa.gov · published 14 July 2026 · tier A
  5. 5.
    U.S. Securities and Exchange Commission, Regulation S-K Item 106 (eCFR)ecfr.gov · published 4 August 2023 · tier A

Tier A: the organization itself, a regulator or a government page. Tier B: established trade or business press.

Cite this definition as “CISO Spotlights glossary” with a link to this page. See an error? Request a correction.