Business continuity is where that ownership question lands hardest, because it’s the function actually accountable for keeping the business running once an attack succeeds.
Many organizations are resolving the ambiguity by pushing that accountability onto their CISOs, expecting them to own business continuity and disaster recovery alongside incident response.
The expansion is happening, and boards are right to expect more from security leaders than incident response.
The mandate is better spent building a detailed picture of business impact and pushing the organization toward shared visibility and defined decision rights across functions.
That shift becomes obvious in the first hour of an incident, when a board wants answers about business impact, financial exposure, and key priorities.