Accountability Overall responsibility: Chief Information Security Officer Day-to-day management: Regional data protection officers; lines of business The Chief Information Security Officer reports to the Board or a committee thereof at least twice per year.