The Three Characteristics of a Defensible Security Program

… clear owner accountability for protecting information resources, and provides a mandate for the CISO to establish and maintain the security program.
read source