Chief information security officers don’t have full command over their domains but they’re still held to account when things ...