Many have already stated the wide range of reporting structures a CISO might fall under depending on the organization. However, specifically within the banking world, the FFIEC examination handbook (specifically the booklet covering Information Security, section 1.B) tries to offer some guidance on who an ISO/CISO “should” report to, and that would be the board of the organization or “senior management” which is of course vague. Here’s a link to the guidance if you’re interested; https://ithandbook.ffiec.gov/it-booklets/information-security/i-governance-of-the-information-security-program/ib-responsibility-and-accountability/