Personal liability of the CISO
The personal civil, regulatory and sometimes criminal exposure of the chief information security officer, revealed by US prosecutions since 2022; it raises the question of coverage under directors and officers insurance.
For a long time, the chief information security officer was a technical manager, rarely held personally liable after an attack. Two US cases changed perceptions. In 2022, the former security chief of a ride-hailing platform was criminally convicted for concealing a 2016 data breach from the authorities, passing it off as a bug bounty payment. In 2023, the US securities regulator sued a software company and its security chief for presenting investors with stronger security than it had, before the attack that compromised its update chain; most of the charges were dismissed by the court in 2024. Other texts have increased exposure: New York financial regulation requires a signed annual compliance certification, and the NIS2 directive places cybersecurity responsibility on management bodies. For insurance, the question is practical: is the security chief an insured under the directors and officers policy? Not always, if the CISO is neither a corporate officer nor a de facto director, and companies now extend the definition of insureds to include the role. Cover concerns defense costs, criminal fines remaining uninsurable.
On May 4, 2023, Joseph Sullivan, Uber's former chief security officer, was sentenced to three years of probation and a 50,000 dollar fine for concealing the 2016 breach, which affected 57 million riders and drivers. The hackers had been paid 100,000 dollars presented as a bug bounty.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.