The Chief Security Officer

Tony Ridley, MSc, CSyP, FSyI, SRMCP. October 2026.

A terms of reference states the mandate of an office: what it exists to do, the authority it holds, the decisions it owns, the decisions it informs, and the people and bodies to whom it answers. It is the instrument a Board or executive uses to say, in advance and in writing, who is accountable for what.

Most security terms of reference fail before the first incident. They describe activities rather than accountability. They list the committees the security leader may attend and the information the security leader may request, then say nothing about what the security leader may decide, refuse, certify or disclose. An office described that way has access and no authority. Its holder can be blamed for an outcome they were never empowered to prevent.

This guidebook takes the opposite approach. It starts from accountability and works back to the authority, competence and evidence that accountability requires.

What is inside

• Part A, Foundations: what a terms of reference is, a controlled vocabulary, and why security management is not reducible to risk management.
• Part B, Mandate and authority: the accountable officer, certification and the protective ledger, the advocate duty, and the Board interface.
• Part C, Operating the mandate: the protector as a source of harm, funding protection, and the regulatory envelope in Australia, the United Kingdom and the United States.
• Part D, Competence: the failure modes of the role and the qualification threshold.
• Part E, Model instruments, ready to adapt.

This is a member guidebook. The Member Edition runs to 40 pages across twelve chapters, with four model instruments ready to adapt: model terms of reference for the CSO, an accountability matrix, a power-base audit, and twelve questions a Board should ask its CSO. Members download it from Member Downloads. Become a member to read it in full.

Already a member? Get the guidebook.