CISO role — independence, authority, Board access
Primary statement
CISO role per SEBI GV.3 (independence from operational IT, direct Board IT Committee access), RBI CSF (cyber security policy ownership), IRDAI (sector-specific), MeitY CSP, NCIIPC. The CISO is the operational anchor for cyber programme. Independence + Board access form the binary structural qualifier.
Audit-fatigue payoff
A documented CISO appointment with reporting line outside operational IT + Board IT Committee charter + CISO authority documentation satisfies CISO requirements across all 5 contributing frameworks.
Strictness matrix
Scope
Scope: CISO authority covers cybersecurity policy, incident response, third-party cyber risk, compliance reporting, awareness, technical controls.
Ceiling source: sebi_cscrf:CSCRF.GV.6
Rationale: SEBI CSCRF GV.6 specifies broadest CISO authority scope.
Threshold
Threshold: appropriate seniority + reporting line OUTSIDE operational IT + direct access to Board IT Committee. Three binary conditions.
Ceiling source: sebi_cscrf:CSCRF.GV.6
Rationale: SEBI CSCRF GV.6 binary qualifiers are uniquely strict.
Method
Method: written appointment with documented authority + reporting line + Board IT Committee charter + CISO presence in IT Committee meetings + integration with RACI matrix.
Ceiling source: sebi_cscrf:CSCRF.GV.6
Rationale: SEBI CSCRF GV.6 method anchors the role specification.
Frequency
CISO charter review: annual. Board IT Committee presence: per meeting (quarterly). Authority refresh on material change.
Ceiling source: sebi_cscrf:CSCRF.GV.6
Rationale: Annual charter + quarterly Board presence is the cadence.
Evidence
Evidence: CISO appointment letter + reporting line documentation + Board IT Committee charter + CISO meeting minutes + RACI matrix linkage.
Ceiling source: sebi_cscrf:CSCRF.GV.6
Rationale: SEBI CSCRF GV.6 evidence with appointment letter is comprehensive.
Auditor test pattern
Step 1: Inspect CISO appointment letter. Step 2: Verify reporting line outside operational IT. Step 3: Inspect Board IT Committee charter. Step 4: Verify CISO presence at IT Committee meetings. Step 5: Inspect RACI integration.
Common findings
Common findings: (1) CISO reports through CTO/CIO (operational IT) — fails independence; (2) CISO not present at Board IT Committee; (3) CISO authority undocumented; (4) Role fractional with operational IT responsibilities.