Who should the security manager or CISO report to?

Solid line to the IT director in a department this size, and a dotted line to an executive outside IT — a chief operating officer, a finance director or a risk committee. Security exists partly to constrain IT, and a lead with no route around their own manager can be quietly overruled on exactly the findings that matter most.

How do you structure an IT department?

Four lines under the IT director: infrastructure and operations to keep it running, applications to build and change it, a service desk to support it, and security. Add a project office or data function as it grows. Below about eight people the four collapse into two — infrastructure-and-support, and everything else.

How do you show first, second and third-line support on an org chart?

As one service desk team under one manager, with the tier in each person's title. The tiers describe an escalation path for tickets, not a chain of command, and drawing them as three layers invents a hierarchy that makes the desk slower rather than clearer.

Where do contractors and the managed service provider go?

On the chart, under the manager who directs their work, marked as contractors. A provider running your out-of-hours desk is part of how the department functions, and leaving them off produces a chart that cannot explain how twenty people cover a thousand users.

IT department org chart example

A twenty-person IT department inside a mid-sized company, drawn around the split that actually organises the work: the people who keep it running, the people who build what's next, the people who answer the phone, and the one function that has to be able to say no to all three.

Build one like this Download as a spreadsheet

Calder Group — IT department · 21 people · an invented organisation, drawn by the layout engine. Infrastructure, applications and the service desk under the IT director, with security beside them. The dotted line is the security manager's route to the chief operating officer, so a finding the department would rather not hear still gets heard.

How an IT department is usually structured

An IT department reports somewhere, and where it reports tells you what the company thinks IT is for: under a chief executive or chief operating officer it is a capability, under the finance director it is a cost. Whichever it is, put that person on the chart. It is the single most informative card on an IT org chart, and it is nearly always the one missing.

Below the IT director the work divides into run and build. Infrastructure and operations keeps the estate alive — networks, servers, cloud, backups — and is measured on uptime. Applications owns the systems the business actually uses: the ERP, the integrations, the internal tools, and the analysts who translate a department's request into a change. The service desk is the department's face, tiered from first line through escalation, and it holds most of the headcount and all of the reputation.

Security is the fourth line and the argument. A security manager reporting to the IT director reports to the person whose uptime and budget their findings threaten. Small departments live with it; larger ones give the security lead a second, dotted line to an executive outside IT — a chief operating officer, a finance director, a risk committee — so an unwelcome finding has somewhere to go. Draw that line even when it is informal, because it is the control that makes the rest of the structure trustworthy.

What's particular here

Run and build want different people
Operations rewards caution and rota discipline; project work rewards appetite for change. Separate lines under the director are what stop every project being interrupted by an outage, and every outage being blamed on a project.
Tiers are not layers
First, second and third line describe how a ticket escalates, not who manages whom. Draw the service desk as one team under its manager and let the titles carry the tier, or you invent three levels of hierarchy the department does not have.
The contractors are half the estate
A managed service provider, a specialist consultant, a long-term contractor filling a gap: mark them as contractors and leave them on. A twelve-person department supporting two thousand seats does it with help, and hiding the help makes the team look either heroic or overspent.
Business analysts face outward
They sit in applications and spend their days with finance, operations or HR. If the chart includes the departments they serve, draw the dotted lines; if it does not, put the department in their title.

Typical titles by level

The vocabulary these charts use, from the top down. Titles vary by country and by company; the levels don't.

Level	Titles you'll see
Leadership	CIO, IT Director, Head of IT, Head of Technology; CISO or Head of Information Security
Managers	Infrastructure & Operations Manager, Applications Manager, Service Desk or Service Delivery Manager, Security Manager, PMO Lead, Data & Analytics Manager
Engineers and analysts	Systems Administrator, Network Engineer, Cloud or DevOps Engineer, Database Administrator, ERP or Applications Analyst, Software Developer, Security Analyst, Business Analyst, Project Manager
Service and support	Service Desk Analyst (first line), Second-Line Analyst, Field or Desktop Technician, IT Asset & Procurement Coordinator, managed service provider engineers (as contractors)

Where these charts go wrong

The recurring mistakes: security buried under the person it constrains, with no route around them; the service desk drawn as three stacked layers; the managed service provider left off, so the department looks impossibly efficient; shadow IT — the developer sitting inside the finance team — appearing nowhere; and an IT director with nine direct reports because every specialism was made a peer.

Questions people ask

Who should the security manager or CISO report to?: Solid line to the IT director in a department this size, and a dotted line to an executive outside IT — a chief operating officer, a finance director or a risk committee. Security exists partly to constrain IT, and a lead with no route around their own manager can be quietly overruled on exactly the findings that matter most.
How do you structure an IT department?: Four lines under the IT director: infrastructure and operations to keep it running, applications to build and change it, a service desk to support it, and security. Add a project office or data function as it grows. Below about eight people the four collapse into two — infrastructure-and-support, and everything else.
How do you show first, second and third-line support on an org chart?: As one service desk team under one manager, with the tier in each person's title. The tiers describe an escalation path for tickets, not a chain of command, and drawing them as three layers invents a hierarchy that makes the desk slower rather than clearer.
Where do contractors and the managed service provider go?: On the chart, under the manager who directs their work, marked as contractors. A provider running your out-of-hours desk is part of how the department functions, and leaving them off produces a chart that cannot explain how twenty people cover a thousand users.

Other industries

Or start from a structure — functional, divisional, matrix or flat — or from your own spreadsheet. The guides cover a reorg, a merger, an assistant's chart and a consultant's deliverable.

Make it yours

Download the spreadsheet, replace the names, import it — the chart redraws itself. Or start empty and drag people until it's true. Building is free at any size.

Start a chart, free Download the spreadsheet