For effective governance, BCG’s Chief Information Security Officer reports directly to BCG’s Chief Risk Officer and Chief Information Officer, as well as to the audit and risk committee and the information security committee.