Which of the following has the responsibility of information technology (IT) governance?

The CIO is responsible for IT management and strategy execution, not governance itself; the CIO reports upward to governance bodies rather than owning the governance function.

Senior IT Management handles operational and tactical IT decisions and implements governance directives, but they do not own the governance responsibility that resides at the board level.

The Board of Directors holds ultimate responsibility for IT governance because governance is a strategic, enterprise-wide function concerned with accountability, oversight, and alignment of IT with business goals. Frameworks like COBIT and ISO 38500 explicitly assign IT governance responsibility to the board or executive leadership, not operational or managerial roles. This distinguishes governance (board-level oversight) from IT management (day-to-day execution).

The CISO is responsible for information security strategy and risk management within IT, which is a subset of governance, not the governance function itself.