Here we go, then..
First of all, yes, you?re right, there shouldn?t be one single JUNIOR officer, but it happens. So from the top, here goes?.
1. Why does he have sole responsibility for approval? Who gave him that remit? Is it in writing? Does it contravene any of the company policies? Does he have his own budget? (Here, he would technically be unable to have singular approval if not a budget holder)
2. Can he justify his disapproval? Do you get this in writing? Is it technically correct? (you can check this just by doing a bit of research, or asking on the Tech Q & A board)
3. Has it been explained to him (in words of one syllable) that he?s affecting operations? If so, what was his reply?
4. What gives him the right to police all IT work? Has this been delegated to him? Ask for proof again.
As for reporting directly to the CEO ? well, in certain (well justified) circumstances, that is feasible, but surely he should be reporting to at least his line manager as well (unless he?s related in some way to the CEO 
It has happened!
If he?s a junior member of staff, I?m very concerned that he will not be totally in tune with the legal side of what he?s doing, or may only have a brief overview. Here in the UK the laws are extremely strict on what you may or may not do as regards monitoring, and to collect evidence, you DEFINITELY have to know what you?re up against so as not to be thrown out of Court.
I?d definitely say your first stop is policies and procedures, because if he?s contravening any of those (i.e. Acting Up Procedure) you can successfully shoot him down in flames at the first hurdle. 
If he?s the best worker in the IT department, I have to ask if by doing this he thinks he?s making himself indispensable??.
Comments, nosense?
GG
What to do with an IS Officer who always says NO?
Here is the dilemma: When everybody in an IT department is taken hostage by a single (!) junior (!) Information Security Officer (already a bad practice but let's admit it exists in many companies) decides to go wild and act as the sole responsible for approval (in fact disapproval) of each IT decision, interferes with the IT services and operations, starts policing all IT work, and knows only "NO" word, what do you do, what are your options? He indeed does his work "well" compared to the "poor performances" of his colleagues from the IT department! Furthermore, he reports directly to the company CEO!
Let's see who will take this challenge. Some good references are also welcome.
This conversation is currently closed to new comments.