But are external regulations or audits really dependable alternatives to an independent, internal CSO? Capital IQ’s Murphy doesn’t think so. "Sarbanes-Oxley isn’t going to help you make a decision when a powerful executive comes to you and says we can get important new functionality that a client is demanding up and running tomorrow if you install this untested software patch right now," he says. Capital IQ’s Pfeil agrees. "By using regulations or auditors, all you’re doing is shifting accountability," he adds. "But it will come back full circle no matter what you do. The ones who have to implement the day-to-day security operations are still going to be on the hook. If you centralize the responsibilities for security and make one person responsible, then you’ve got one neck to choke."

Make a Strong Security Policy

If it’s not possible to move information security out of IT, then an ironclad security policy should ensure that even if the person in charge of security is IT-based, he at least has the ability to report to someone senior to the CIO, say security advocates. "If nothing else, the CSO must have real access to the other C-level people," says George Campbell, a security consultant and former CSO at Fidelity Investments. "As long as the CEO and board back a strong policy around corporate protection, that’s an internal legal system that the CSO can use to manage the function."

But Campbell and others stress that unless the policy is clear and detailed-for example, all breaches must be reported immediately to the COO and immediately recorded in a report-it won’t be much of a tool. "Unless it’s grounded in a strong policy infrastructure that gives good guidance to employees and functions in the organization on the how-tos of corporate protection, it won’t happen because people won’t know what to do," says Campbell. CIOs should try to get advice from companies that are bound by law to secure and protect, like health-care and financial services companies. "You can’t find a financial services company that isn’t concerned about how it protects customer information or continuity, and that is founded on a good policy," he says.

And the conflict of interest that lies at the heart of the CSO-to-CIO reporting relationship can erode the best policy, says Siemens’ Pomeroy. "It has to be like an independent internal auditor function within IT if it’s going to work," he says. "An organization can think it has a good information security review process, but because the CIO has the final say, you’re going to have problems potentially."