Security News > 2016 > September > Chief Information Security Officers Should be Reporting to Chief Risk Officers (SecurityWeek)