CISO: role, responsibilities and tools

The CISO, or Chief Information Security Officer, is the person who defines and steers an organisation's cybersecurity. They assess risks, set security rules, check compliance with frameworks (ISO 27001, NIS 2, GDPR) and prepare the response to incidents. They advise senior management, which keeps the decision and the accountability.

In France, the role is called RSSI (responsable de la sécurité des systèmes d'information). This guide explains what a CISO actually does, where the role sits in the organisation, what it costs, when to share it and which rules make it essential in 2026.

The Chief Information Security Officer is responsible for information security across the organisation. In large groups you will also find a head of cybersecurity who oversees several CISOs for subsidiaries or business lines.

The role exists for a simple reason: information security cannot be a by-product of running IT. Someone has to look at the information system from the threat's point of view, measure what the organisation stands to lose and propose reasoned choices. That is how the French government defines the role for its own departments: in interministerial instruction no. 1337/SGDSN/ANSSI of 2022, the CISO "advises and supports" the head of digital in the operational implementation of security, drawing on technical expertise.

The key word is advice. The CISO does not own the risk: senior management accepts, reduces or rejects it. The CISO informs the decision, then makes sure it is applied and recorded.

Job descriptions vary, but six groups of responsibilities come up almost every time.

Governance and security policy

The CISO writes the information security policy and has it approved, then breaks it down into rules and procedures. They run security committees, report indicators to management and own the roadmap. In an ISO 27001 programme, they usually lead the information security management system (ISMS).

Risk analysis and treatment

They carry out risk analyses on sensitive scopes, often with ANSSI's EBIOS Risk Manager method or following ISO 27005, and follow up the resulting treatment plan. For new projects, they build security in from the design stage and, in the public sector, prepare security accreditation files.

Compliance and control

NIS 2, GDPR, DORA in finance, HDS in healthcare, customer requirements: the CISO turns these into measures, organises internal audits and answers external auditors. They also assess suppliers, as a large share of risk now flows through the third-party chain.

Awareness and training

Phishing simulations, onboarding sessions, briefings for executives: security depends on behaviour, and changing it is the CISO's job.

Detection, incidents and crisis management

The CISO organises detection (in-house or with a SOC), incident triage and notification to the authorities where required. During a major cyberattack, they act as the expert in the crisis unit and contribute to the business continuity and recovery plan.

Monitoring

Threats, vulnerabilities, regulatory changes: without monitoring, the security policy freezes. The CISO filters and passes on what really matters to the organisation.

The reporting line is debated in every organisation. It is not a matter of status: it determines the CISO's independence and their ability to escalate a risk that IT would rather play down.

In practice, reporting to the CIO remains the most common arrangement. A 2021 survey of its members by the French CISO club CESIN and OpinionWay found that 56% of CISOs reported to the CIO and 23% to general management. Each option has its strengths:

Whatever the choice, two safeguards matter more than the org chart: direct access to management when a serious risk arises, and a regular security committee where decisions are taken and recorded. NIS 2 points the same way by placing accountability for cybersecurity with management bodies.

These four roles work on neighbouring topics, which creates overlaps and sometimes blind spots. The comparison below sums up the question each one asks, its reference text and its deliverables.

One point deserves emphasis: combining the CISO and DPO roles. The GDPR requires the data protection officer to be free of conflicts of interest, and the European guidelines on DPOs list heads of IT among the roles likely to create one. In small organisations where combining roles is unavoidable, at least document how decisions are separated.

The CISO is rarely the best technician on the team, and that is not what is expected. They need to understand architectures, threats and controls well enough to challenge teams, but their effectiveness rests mainly on three qualities:

• Translating technical risk into business risk: a vulnerability means nothing to an executive committee, three days of halted production does.
• Negotiating with IT, business units and procurement without acting as a censor.
• Structuring: risk analysis methods, ISO 27000 standards, project management, change management.

Career paths vary: engineering degrees or specialised master's programmes (ANSSI certifies courses under the SecNumedu label), but also system administrators, auditors or consultants who moved into governance. The most sought-after certifications are ISO 27001 Lead Implementer or Lead Auditor, CISSP and CISM. ANSSI tracks the profession in its cybersecurity jobs observatory, whose 2025 edition includes a dedicated focus on CISOs.

Figures found online often come from job boards with no published method. The most reliable reference in France is the survey carried out by CESIN with OpinionWay. According to its latest edition, reported by Le Monde Informatique in September 2024:

• the median salary of responding CISOs is €90,000 gross per year, up from €89,200 in 2020;
• average fixed pay rises from €82,000 in companies under 1,000 employees to €135,000 in those with over 50,000;
• 71% received variable pay in 2023;
• pay rises with seniority, from €71,000 (under five years) to €118,000 (over twenty years).

These figures describe CESIN members, who mostly work in large companies. A CISO at an SME, a local authority or a hospital usually earns less, and public-sector pay scales apply to civil servants.

Not every organisation has the workload or budget for a full-time CISO. A fractional CISO (also called a virtual CISO or vCISO) works a few days a month for several clients. French local authorities often share one through an IT syndicate or a purchasing group, and hospitals in the same regional hospital group can share a CISO.

A fractional CISO only works if their output stays in the organisation when they are not there. Without a shared framework, a shared action plan and a record of decisions, every visit starts from scratch. This is one of the cases where a governance, risk and compliance platform makes the difference.

There is no general legal requirement in France to appoint a CISO. Several frameworks nevertheless make the role all but essential.

NIS 2

Directive (EU) 2022/2555 does not mention the CISO, but its Article 20 requires management bodies to approve cybersecurity risk-management measures, oversee their implementation and undergo training. Article 21 lists the expected measures, starting with policies on risk analysis and information system security. Steering all this without an identified security function is not realistic. In France, the bill transposing the directive was still awaiting debate in the National Assembly in early October 2026, after yet another postponement; our compliance campaigns module shows how to track its requirements.

French ministries and state public bodies

Instruction no. 1337/SGDSN/ANSSI, part of the French state's digital security governance framework, requires each ministry's head of digital to appoint one or more CISOs. State public bodies must name a digital security contact, set up a dedicated organisation and assess their security level every year.

Healthcare facilities

To access funding under the French CaRE programme, the national digital health agency (ANS) requires facilities to show, among the prerequisites, "the existence of a security officer" and a security policy, with an org chart showing the CISO (Domain 1 bis webinar, February 2026).

ISO 27001

The standard does not require a specific job title, but it requires top management to assign and communicate information security responsibilities. In practice, almost all certified organisations appoint a CISO.

Technical tools (firewalls, EDR, SIEM, vulnerability management) usually belong to operations teams. The CISO's own tools are steering tools: requirement frameworks, risk analyses, assessment questionnaires, action plans and dashboards.

Many CISOs start with spreadsheets. That works for one scope and one auditor. It breaks down as soon as you need to consolidate several sites, chase dozens of action owners, track suppliers or show the history of a decision. That is what a GRC platform is for: linking requirements, risks, measures and evidence so that indicators are calculated from up-to-date data.

Phinasoft was built for this work. The platform brings together five modules that share the same data: risk analysis, with an EBIOS RM module certified by ANSSI; frameworks and security policies versioned in the policies editor; compliance campaigns by site or subsidiary; vendor risk management on a dedicated portal; and GDPR. Business contributors are guided, so the CISO does not have to explain everything themselves. To see how it works on your own scopes, you can request a demo.