At NovaTech Systems, ambiguity in the Chief Information Security Officer (CISO) reporting structure hindered oversight. What is the most direct governance improvement?

### Why this is right NovaTech's profile identifies ambiguity in the cybersecurity leader's reporting structure as a barrier to oversight and response clarity. Clarifying the reporting line and responsibilities directly addresses that problem. ### The concept Accountability identifies who directs work, who carries it out, and who checks results. A clear reporting structure helps security concerns reach the appropriate decision-makers. It does not mean that one person performs every security task; departments still need to carry out their assigned responsibilities. ### The other options - **B. Allow each department to assume that another department owns cybersecurity**: assumptions create ownership gaps rather than resolve them. - **C. Reduce communication between the cybersecurity leader and senior management**: this would make oversight and escalation harder. - **D. Replace written responsibilities with informal conversations**: informal communication may help, but it does not provide clear, dependable accountability. ### Terms - **Chief Information Security Officer (CISO)**: A senior leader responsible for directing an organization's information security function. - **Reporting line**: The formal path through which a role communicates and is accountable to organizational leadership. ### Remember Clear accountability answers who owns a decision, who acts, and where concerns are reported.