Programs are typically sponsored by C-suite executives, while the CISO is often tasked with execution, according to Gartner.