Who Should Own Security When You Don't Have a CISO

A 90-person company loses a vendor deal because a prospect's security questionnaire asks who is accountable for information security, and the answer takes three days to assemble. The CEO assumed the IT manager owns it. The IT manager assumed the managed service provider covers it. The provider assumed the company's leadership sets the risk tolerance. Everyone was partly right, and nobody was actually responsible.

This is the most common security gap at companies between 25 and 200 employees, and it has little to do with tools. The firewall is running. The endpoint software is installed. What is missing is a named person who decides what the company will and will not accept, and who answers for the result.

Why "Everyone" Ends Up Meaning "No One"

Security work at a growing company is spread across people who each hold a slice of it. The office manager buys the laptops. The IT manager or an outside provider configures them. HR runs onboarding. Finance approves the software subscriptions. The CEO signs the customer contracts that contain security commitments. Each person touches security, and none of them is measured on it.

The National Cybersecurity Alliance's 2026 Small Business Cybersecurity Awareness & Practices Survey, run in partnership with CISA, shows what that looks like in the data. The survey polled 1,000 small and midsize business leaders. 86.3% rated their confidence in managing cyber risk as medium to very high. Yet 56.1% could not confidently say their organization had kept a clean security record over the past twelve months.

The control-level numbers point the same direction. 86.8% of surveyed organizations have multi-factor authentication somewhere in their environment, but only 51.1% require it across all key business accounts. Someone bought the control and turned it on. Nobody owned the question of where it must apply, so the rollout stopped when attention moved elsewhere.

That pattern is an ownership failure, not a budget failure. Spending more on tools does not fix a company where nobody is assigned to decide how the tools get used.

Ownership Is Three Different Jobs

A CISO at a large company holds three jobs at once. At a 90-person company, those jobs usually get split across different people, or left unassigned. Naming them separately is the first step toward assigning them.

The accountable executive decides how much risk the company will carry and signs for it. This is a CEO, COO, or CFO decision, and it cannot be delegated to a vendor. Whether to accept a known gap because the fix costs six figures is a business decision with security consequences. Someone with budget authority has to make it and write it down.

The operational owner translates that risk tolerance into standards, priorities, and a plan. This person decides which controls are mandatory, in what order they roll out, and how compliance gets checked. At most growing companies this role is empty. The IT manager is busy resolving tickets, and the provider executes what it is asked to execute.

The execution layer configures, patches, monitors, and responds. This is where your managed service provider, internal IT staff, and security tooling operate. It is where most of a company's security spending lands, and it works well when the first two jobs are filled.

The failure mode is expecting the execution layer to perform the other two jobs. A provider can enforce a policy. It cannot decide what the policy should be for your company, because that depends on your clients, your contracts, and your tolerance for disruption. Nor should it be expected to. Elevaire's position is that your managed service provider keeps the lights on, and someone has to make sure the lights are pointed in the right direction. That someone is the operational owner.

What the Frameworks Say About Accountability

Two vendor-neutral frameworks now treat ownership as a core part of security, not a side note.

NIST Cybersecurity Framework 2.0, released in 2024, added a sixth function called Govern. It covers organizational context, risk management strategy, roles and responsibilities, policy, and oversight. NIST's Small Business Quick Start Guide is aimed at businesses with modest or no cybersecurity plans. The addition of Govern reflects a plain observation: controls fail when nobody is accountable for them.

CISA's Cross-Sector Cybersecurity Performance Goals, updated to version 2.0 in December 2025, align to CSF 2.0 and carry the same Govern emphasis. They call for leadership engagement in oversight, a clear assignment of cybersecurity roles and responsibilities, and integration with broader business risk. An auditor, insurer, or enterprise customer reviewing your program increasingly expects to see this in writing.

Neither framework requires a CISO title. Both require that the responsibility exists and belongs to a named role.

The Cost Argument Against the Obvious Fix

The instinctive answer is to hire. The U.S. Bureau of Labor Statistics reports a median annual wage of $124,910 for information security analysts as of May 2024, with employment projected to grow 29% from 2024 to 2034, far faster than the 3% average for all occupations. That is the wage for an analyst, before benefits, tooling, and recruiting costs. An analyst also executes work. A security executive who owns risk decisions, speaks to the board, and answers customer questionnaires is a more expensive and harder hire, and a poor fit for a company that does not yet have a full-time security workload.

For a company with $25 million in revenue, a six-figure hire to cover a part-time accountability role is hard to justify. A smaller version of the same logic applies to the alternative many companies choose by default: assigning security to the IT manager as an extra duty. That works until a ticket backlog, an outage, or a migration pushes the extra duty to the bottom of the list.

What Poor Ownership Costs

IBM's 2025 Cost of a Data Breach Report puts the global average breach cost at $4.44 million, with a record U.S. average of $10.22 million. Mid-market companies rarely face the average, but the report's governance findings apply at any size. Among organizations that reported an AI-related security incident, 63% had no AI governance policy in place, and organizations with high levels of unsanctioned AI use paid about $670,000 more per breach.

Those numbers describe a specific kind of failure: a new risk arrived, nobody was assigned to decide how to handle it, and the company found out after an incident. Verizon's 2025 Data Breach Investigations Report found that roughly 60% of breaches involved a human element, and that third-party involvement doubled to 30%, up from 15% the year before. Both categories are ownership problems. Staff behavior depends on training and policy that someone must maintain. Vendor risk depends on someone reviewing vendors before they are connected to company data.

Which Decisions Need a Named Owner

Rather than debating titles, list the decisions that recur and assign each one. The table below shows a workable starting split for a company without a CISO.

Decision	Who decides	Who prepares it	Review cadence
Accept or fix a known risk	CEO, COO, or CFO	Operational owner	Quarterly
Approve security policies	CEO or COO	Operational owner	Annual
Approve a new vendor with data access	Operational owner	IT lead or provider	Per vendor
Grant a policy exception	Operational owner	Requesting manager	Per request
Declare and run an incident	Operational owner	IT lead or provider	Per incident
Review who has access to what	Department heads	IT lead or provider	Quarterly

A few notes on how to use it. The accountable executive appears only where money or business risk is at stake. The operational owner carries most of the load, which is why that role needs real time allocated to it. And the execution layer prepares and enforces but does not decide. If your provider is currently making decisions in the "who decides" column, that is a gap in your governance, not a flaw in the provider.

Who Can Fill the Operational Owner Role

The operational owner needs three things: authority to set standards, enough technical judgment to evaluate tradeoffs, and enough standing to push back on a department head. There are four realistic options for a company in the 25-to-200-employee range.

1. The IT manager, with protected time. This works when the IT manager has the seniority and the capacity. It fails when security gets squeezed out by daily support.
2. A senior operations leader, supported by IT. This works when the person has authority but needs technical input to make good calls.
3. A fractional CIO. Fractional IT leadership places an experienced technology executive in the role for a defined number of hours each month. The model covers standards, vendor review, risk reporting to the executive team, and accountability for the plan, without the cost of a full-time executive.
4. A full-time security hire. This makes sense later, when the workload is large enough to keep one person busy and the company has outgrown a part-time model.

Whichever option you choose, the same person should not both set the standard and be the only one who checks it. A fractional CIO working alongside your provider and internal IT gives you separation: the provider executes, the IT team operates, and the fractional CIO reviews.

A 30-Day Plan to Assign Ownership

Most companies can fix this in a month. None of it requires new tools.

1. Week one: write down who owns what today. List the six decisions in the table above and note who actually makes each one now. Expect surprises, such as the provider approving vendor access by default.
2. Week one: name the accountable executive. One person on the leadership team accepts risk on behalf of the company. Put it in writing.
3. Week two: name the operational owner. Decide who fills the role, and block the calendar time it needs. A role with no hours attached does not get done.
4. Week two: confirm the provider's scope. Ask your managed service provider to document what it enforces and what it expects the company to decide.
5. Week three: build a one-page ownership document. It should list roles, named people, backup people, and the decisions each can make. Share it with the leadership team.
6. Week three: set a quarterly review. The accountable executive and operational owner meet for an hour each quarter to review open risks, exceptions, and vendor changes.
7. Week four: test it. Run a tabletop exercise on one scenario, such as a compromised email account, and see whether the named people know what they are expected to do.

The test in week four matters most. A document that nobody has practiced will not hold up on the day it is needed.

Frequently Asked Questions

Do we need a CISO to be compliant with SOC 2, HIPAA, or cyber insurance requirements?

Generally no. These frameworks and insurers expect that security responsibility is assigned to a named role and documented, not that the role carries a CISO title. An auditor or underwriter wants to see who is accountable, what authority they hold, and evidence that they act on it. Check the specific language in your policy or audit scope.

How much does it cost to assign security ownership without hiring a CISO?

The cost depends on the option. Assigning the role to an existing leader costs their time, which should be budgeted explicitly. A fractional CIO costs a fraction of a full-time executive because you pay for hours rather than a salary. For reference, the median wage for a single information security analyst was $124,910 in May 2024, before benefits and tooling.

How does this work alongside our existing MSP or IT team?

It sits on top of them. Your provider and IT team keep running devices, networks, and support. The operational owner sets standards, reviews vendors, and reports risk to leadership, while the provider enforces what has been decided. Most companies find that their provider performs better once the company is clear about what it wants enforced.

Can our IT manager be the security owner?

Sometimes. It works when the IT manager has authority beyond the IT department, protected time for security work, and a leadership sponsor who accepts risk decisions. It tends to fail when security is added to a full ticket queue with no reduction in other duties. If you choose this route, review it after one quarter and ask whether the work is actually getting done.

How do we get started?

Write down who currently makes each of the six decisions in the table above, then name an accountable executive and an operational owner. Block time on the operational owner's calendar and document the arrangement on one page. Most companies can complete this in a few weeks, and it gives you a clear answer the next time a customer or insurer asks who is accountable for security.