Which of the following roles is BEST able to influence the security culture within an organization?

The CISO is responsible for implementing security programs but often lacks the ultimate authority to set overarching organizational priorities or directly influence all business units at the highest level.

The CIO manages IT operations and often security implementation, but their influence on overall organizational culture is typically less direct and pervasive than that of the CEO.

The COO focuses on day-to-day operational efficiency and, while important for process integration, typically does not possess the same level of cultural influence as the CEO.

The Chief Executive Officer (CEO) holds the highest authority and responsibility within an organization, and their visible commitment to information security directly influences all employees, demonstrating that security is a top organizational priority and fostering a culture of compliance and shared responsibility. Their messaging and resource allocation decisions cascade down, effectively shaping the entire company's security mindset and behavior.