The security officer could report to any of the following except:

A.
CEO

B.
Chief information offi cer

C.
CFO

D.
Application development

Explanation:
D: The security officer must work with the application development managers to ensure that security is considered in the project cost during each phase of development (analysis, design, development, testing, implementation,and post implementation). To facilitate this best from an independence perspective, the security offi cer should not report to application development. Page 444.