Some organizations have the CISO report to the CIO while others have the CISO report to the CFO. Some others have the CISO report directly to the CEO.
If you were in charge of an organization how would you structure the organizational chart to place the CISO and why?