CISO vs. CSO vs. chief trust officer: what the title means in practice

What these four announcements can and cannot show

This guide uses four appointment announcements: three for Chief Security Officers (CSOs) and one for a chief trust & security officer (CTSO). A press release shows how a company chose to describe a job. It does not show the internal org chart, the charter or the budget. None of the four documents describes an EVP-level CSO, so this guide has nothing to say about that rank. Four cases also cannot show how common any pattern is. What follows is a close reading of what each company wrote, and where it wrote nothing.

Scope: where the CSO title is spelled out

Citizens Financial Group gives the most detailed picture of a CSO remit. Its announcement says Goode joins from Commonwealth Bank of Australia, where he served as Chief Security Officer for the Group Security organization. The release describes that job as joining several disciplines.

The release gives the outgoing Citizens CSO a similar remit. It says Holly Ridgeway had been responsible for cybersecurity, physical security and business resilience. In this one bank, then, the CSO title covers cyber work plus physical security and resilience. The announcement also lists fraud in Goode's prior role.

Cyberhaven's announcement is less specific. Its subheading says Bates will oversee the company's security strategy. The release does not break that strategy into parts.

Commvault's announcement does not state what O'Connell will oversee. It does include a quote from the CEO naming the skills he brings. A reader can see which disciplines the CEO connects to the hire, but the release does not define a boundary for the job.

Scope: where "trust" enters the title

Axonius is the only company in the set that uses a trust title. Its announcement states the internal remit first. The release then adds an outward-facing duty to the same job.

Jones's own quote ties the title to customers. In this announcement, "trust" means customer-facing duties alongside the internal security program. The release does not say the title adds physical security or fraud, which the Citizens release names for the CSO.

Axonius also still has a CISO function in its description. The "field CISO program" is a customer-facing advisory activity that Jones leads, not a separate title above or below him. The release does not say whether Axonius has a separate internal CISO.

Background: who gets these jobs

The five people named in these documents all come from security leadership, but the routes differ.

Goode's career runs through financial services and government. The Citizens release says he was previously the CISO for UK & Ireland at Deutsche Bank. It also places him in federal service before banking. The outgoing CSO, Ridgeway, also held a CISO title earlier.

O'Connell's background is in product and application security at large companies. Commvault's release says he has nearly 20 years in the field, with prior leadership roles at Roche and ADP. At ADP, the release says, his remit was broad across software and products.

Bates's background is at a security vendor. Cyberhaven's release says he was on the executive team at SentinelOne. It also ties him to an earlier CISO-office role at Nike.

Jones's background is in deputy-CISO and compliance work. The Axonius release says his most recent job was deputy CISO at Cisco. Of the five people named, Goode, Ridgeway and Jones had held CISO or deputy CISO titles. In these cases, the CSO and CTSO roles were not a different career track from the CISO one. Several of the people moved into them from CISO-titled jobs.

Reporting lines: only one document says

Only the Citizens release states who the CSO reports to. That release names the CIO, not the CEO, as his manager. It also shows the CSO title does not by itself mean a direct line to the chief executive. The release does not explain why the bank set up the reporting this way, and this guide does not guess.

The other three releases do not state a reporting line. Commvault's CEO does place the new hire on the executive bench. Being on a leadership team is not the same as reporting to the CEO, and the release does not say which applies. The Cyberhaven and Axonius releases include CEO quotes, but neither names a manager for the new executive.

What the documents support

Taken together, the four documents support a few limited observations.

• Scope is spelled out at Citizens and Axonius and left open at Commvault and Cyberhaven.
• At Citizens the CSO remit is broader than information security, covering physical security, fraud and business resilience.
• At Axonius the trust title adds a customer-facing role to the enterprise security strategy.
• Previous CISO or deputy CISO experience appears in the careers of three of the five people named.
• Reporting is documented for only one of the four appointments, and there it runs to a CIO.

A title alone, then, does not settle scope or reporting. The documents show that CSO and CTSO announcements can carry different scope statements, and that some give none. They do not show a standard definition of these titles, and this guide does not supply one.