The Great CISO Resignation

There is a perception that CISOs face heightened liability for cyber intrusions and the response to cyber events. One extraordinary example is the recent conviction of Uber’s former security officer, which represents the first time a security executive has faced federal crime prosecution over a data security response. In this case the finding was that he obstructed justice by concealing information about a breach, destroying data, and covering up the incident.

CISOs are often in the hot seat when it comes to cyber-intrusions and how they are handled. The Board of Directors (possibly including named corporate officers) in most cases are protected by being diligent about the Business Judgement Rule (BJR). Heavily adopted in Delaware case law and since adopted in various forms in many states, this “rule” stipulates that proper oversight includes demonstrating the duty of loyalty (no conflicting interests) and duty of care (make informed decisions) to be protected from liability. There are few cases (although Enron being one) where liability was found but it was for illegalities and poor business judgment.

Since CISOs are not named corporate officers in most cases, BJR does not provide comfort. Similarly, liability insurance which covers legal defense fees and cash judgments often covers only directors and named corporate officers unless the CISO has been specifically included in the policy.

Regulations at the state and federal level are increasing and expectations have changed about what and when cyber incidents need to be reported – to the public, the government, customers, partners, and suppliers. How organizations respond to cyber-attacks, especially in the timing and forthrightness of disclosure, has been all over the map, ranging from immediate and open disclosure to outright coverups. This can create a dilemma for the CISO who usually has front-line knowledge about an incident and what data, identities, customers, and other stakeholders are affected but who may be at cross-purposes with those above them.

Another dilemma the CISO faces is deciding what to do when critical issues are ill-communicated or not fully appreciated among higher-level executives and board members especially during times of tight budgets or budget cuts. Becoming a whistleblower is an option but doing so has its own set of ramifications.