Most banks have a full-time chief information security officer. However, more than a quarter of executives surveyed say their bank does not have a CISO, including 17% of banks with more than $10 billion in assets.