CISO) is a high-level executive responsible for establishing and maintaining an organization’s information security strategy, policy, and compliance .