Overview

Organizations of all sizes are experiencing an increase in cyberattacks and theft of data.

Chief Information Security Officers (CISOs) are being held personally liable (personally accountable) for the cyber integrity of their companies. In July 2023, the Securities and Exchange Commission (SEC) adopted laws that require publicly traded companies to disclose “material cybersecurity incidents” within four days of an incident. This has increased the stakes for CISOs.

CISOs are now seeking their own personal insurance coverage in the event their employers’ bylaws do not allow for indemnification or the company directors and officers (D&O) policy does not respond to their need for legal assistance and defense from an outside source. With this new regulatory stance, CISOs are now in the spotlight and being called on to validate the actions they took in order to prevent breaches and the steps they took after a breach was discovered.

This newfound liability is opening up CISOs and their personal assets to potential exposure, particularly where there is a question of how and if their employer responds to their legal quandary.