But Murphy says he also felt ethically compromised-not to mention overworked-by hanging on to security. He specifically requested that the new CSO report to a managing principal, not him. "I said, ’I don’t think the CSO should report to me because I have competing motivations,’" he recalls. "As a CTO you have these constant internal pressures to get functionality out and keep performance high and all these other typical IT issues. And it’s too easy to push security to the side. I felt like Dr. Jekyll and Mr. Hyde, constantly trying to do in-the-moment risk analysis on things" from the typical performance issues on the one hand and security on the other. "I felt like I needed a church and state separation," he adds. "Security and IT should be like the Supreme Court and the executive branch. You want them to work together, but you want that independent oversight into what you’re doing so that you don’t make bad decisions. I just don’t believe that putting that much power in one person’s hands is the right thing for shareholders." Murphy says the new setup is effective.

Siemens, the German manufacturing, IT and services giant, had this epiphany eight years ago, according to Harald Hoefler, CIO of Siemens Canada. Information security has reported to the CFO’s office ever since. "If the CSO reported to the CIO, security would not be strong enough," says Hoefler. The CSO has two primary roles at Siemens: To secure the systems and to audit them for adequate security. The CSO can do neither well without independence from the CIO, Hoefler argues. "Say I have problems with the network and I haven’t done my work correctly," he says. "If I have this information security officer in my area, he’d point it out, but I’d try to fix the problem in a way that it doesn’t get [revealed to the other top executives]. What you want is to have all the top executives aware of the problems and working together to fix them." Hoefler says that kind of disclosure and cooperation can occur only when security reports to an executive with broad managerial responsibilities for the company as a whole, like the CEO, CFO or COO. "The CFO is in a position to influence all the C-level managers and get the budget to do [information security]," adds John Pomeroy, CSO for Siemens Canada. Though different divisions of Siemens handle the specific security role differently, increasingly the divisions are combining information and traditional corporate security under a CSO, like Pomeroy, who reports to the CFO.