Giving cybersecurity leadership a seat at the table

Cybersecurity was already recognised as important within the institution. A CISO role had been created, technical controls were in place, and the organisation understood the need to strengthen its resilience. Yet the operating model had not fully evolved with that ambition.

The institution had already initiated this transformation by moving the CISO organisationally from IT to Risk. This was an important signal: cybersecurity was no longer intended to sit purely within technology delivery. However, the move had not yet been translated into a fully defined mandate, operating model or set of governance forums. As a result, the CISO’s ability to influence priorities across the organisation remained constrained.

This created a second-stage challenge. The reporting line had changed, but the decision-making architecture still needed to catch up. Cybersecurity risk was still often discussed through a technical lens, rather than as a business and governance issue requiring executive attention. Decisions on investment, risk acceptance and accountability did not always have a dedicated forum where the right stakeholders could challenge, prioritise and act.

The situation was not unique. Across the market, CISO roles are often created in response to legal, regulatory and audit obligations rather than as part of a broader strategic shift. PwC Luxembourg’s CISO & DPO Survey 2026 shows that 71% of CISOs cite these obligations as the primary reason behind the creation of the role. In this case, that wider pattern helped explain why the CISO function had been established, but not yet fully empowered as a governance and leadership function. 

In that context, the challenge was not to move the CISO again, deploy another tool or run another assessment, but to define the governance model behind the organisational change. The key question became how cybersecurity leadership could be given the mandate, visibility and authority needed to protect the organisation and support executive decision-making.

Our first step was to establish a clear baseline. Through a cybersecurity maturity assessment, the institution identified strengths, gaps and priority areas for improvement across its control environment. More importantly, the assessment helped surface the governance questions behind the organisational move already made: where accountability should sit, how risks should be escalated, which forums should support decision-making, and how independent oversight could be strengthened in practice.

Many of the questions around the positioning and independence of the CISO benefited from an external perspective. Our cyber specialists benchmarked the institution against similar organisations to understand how peers with comparable mandates, scale and complexity structured cybersecurity governance, where the CISO reported, and how they separated operational delivery from independent oversight.

In parallel, we worked closely with the CISO through workshops and one-to-one sessions. These conversations translated the target role into practical design choices: responsibilities, interaction with IT, reporting to senior management, governance forums, budget ownership, and the cybersecurity strategy for the next three to five years. Expertise from PwC network helped combine local knowledge with broader international experience and context-appropriate practices.

The work also extended beyond the CISO. Discussions with stakeholders across the institution helped address concerns, clarify interfaces with IT and risk functions, and build a shared understanding of why cybersecurity needed both operational proximity and independent governance.

The engagement helped translate the organisational move from IT to Risk into a proposed future-state governance model. The recommendations under discussion focus on four areas: reporting and escalation, budget governance, Line 1 / Line 2 responsibilities, and decision-making forums.

First, the existing move of the CISO outside the IT function would be reinforced through a clearer route into executive and Board-level discussions, via the risk governance structure. This would give cybersecurity a stronger voice in risk governance and help ensure that cyber matters are discussed as business risks, not only as technical issues.

Second, cybersecurity budget governance would be separated from the IT envelope. The two budgets would remain complementary, but would no longer be treated as part of the same decision chain. This would help protect the independence of cybersecurity oversight while maintaining alignment with technology delivery priorities.

Third, the boundary between the First and Second lines of defence would be clarified rather than redrawn. Operational security activities, such as the Security Operations Centre and vulnerability management, would remain in Line 1. The CISO would provide formal oversight from Line 2, giving the role visibility over operational security without disrupting day-to-day delivery. 

Fourth, an executive cybersecurity council would anchor the proposed governance model. It would replace two overlapping forums with a single body operating at two cadences: a quarterly strategic session and a monthly oversight and coordination session. The RACI between the CISO, the CIO, the Chief Risk Officer and the relevant committees would be formalised, giving each role a clear scope and reducing the friction that had previously slowed decisions on security investment and risk acceptance.

As the institution prepared to discuss the recommendations with its management committee, the proposed model offered a clearer way to escalate, challenge and act on cybersecurity risk. Giving the CISO a seat at the table would not mean separating cybersecurity from IT delivery. It would mean giving cybersecurity leadership the mandate, visibility and authority to help the organisation make better decisions.