The CISO Role, Rewritten
How the CISO mandate is changing under DORA, NIS 2, the EU AI Act and SMCR.
The CISO mandate is being rewritten by four converging forces: DORA, NIS 2, the EU AI Act and SMCR. This paper sets out the new job description, the new accountability boundary, the new reporting line, and the credentials a board should now require.
02Use this paper when
Scenarios where this paper earns its place on the desk.
- 01Hiring or replacing a CISO
- 02Reviewing the CISO job description and reporting line
- 03Defining CISO accountability under SMCR or board minutes
- 04Setting CISO remuneration against new regulatory exposure
03What you'll find inside
Artefacts and templates included with the paper.
- ARTEFACTCISO job description template
- ARTEFACTRACI for security accountability
- ARTEFACTBoard reporting cadence
- ARTEFACTSuccession planning checklist
AUTHOR
Paul Jolliffe
FOUNDER · INFOSECAI · MBA · CISSP · ISO 27001:2022 LA / LI / IA · PRINCE2 Practitioner
Twenty years of senior security leadership across financial services, healthcare, government, telecoms and technology. Independent UK practice founded 2025. Author of the InfoSecAI insights library.
Get The Brief: practitioner notes on what is changing.
Weekly. No tracking pixels, no marketing automation. Unsubscribe in one click.