This is the number one question I'm asked, far & away.
My answer is this: it depends.
It's not the cop-out you think. The organization and history of the enterprise impacts the decision.
My preference, in order:
Fundamentally, InfoSec should not report to an operational entity. The CIO is operational.
Ed and & talked about this on the PVC Security Podcast. What are your thoughts?