Introduction
Cybersecurity now sits on the board agenda, not just the IT roadmap. After a breach, regulators, prosecutors, and plaintiffs ask who knew what, when, and what they did about it.
A breach or outage does not automatically make a director or officer criminally liable. Exposure depends on individual conduct, authority, knowledge, intent, and the specific U.S. statute involved.
This guide covers the criminal triggers, how criminal, civil, and regulatory exposure differ, role-based accountability, governance practices, and insurance limits. It is general information, not legal advice. Talk to qualified counsel about your facts.
Key Takeaways
- Personal criminal exposure usually turns on concealment, obstruction, false statements, or evidence destruction, not the incident itself.
- Boards oversee with informed questions; management and security leaders execute within their authority.
- Accurate escalation, documentation, and evidence preservation shape how prosecutors and regulators judge leadership.
- D&O and cyber policies may fund defense costs, but exclusions and public policy can limit coverage for fines and wrongdoing.
When Can a Director or Officer Face Criminal Liability for Cyber Risks?
What separates a cybersecurity failure from criminal conduct?
Prosecutors must prove every element of a specific offense: the act or omission, the required knowledge or intent, and the link to the event. Weak controls or poor judgment are not enough. Deliberate or knowing conduct is.
Several federal statutes can reach cyber-related conduct, each with its own mental state:
| Statute | Core conduct |
|---|---|
| 18 USC 1519 | Knowingly destroying, altering, or falsifying records to impede a federal matter (up to 20 years) |
| 18 USC 1505 | Corruptly obstructing a pending agency proceeding (up to 5 years) |
| 18 USC 1001 | Knowingly and willfully making materially false statements to federal authorities (up to 5 years) |
| 18 USC 1343 | Wire fraud schemes (up to 20 years) |
| 18 USC 4 | Affirmatively concealing a known federal felony and failing to report it (up to 3 years) |
Statutory maximums are ceilings, not sentencing benchmarks.
Conduct that can increase personal criminal exposure
Risk rises with specific acts:
- Concealing a known incident
- Misleading investigators or regulators
- Destroying or altering evidence
- Directing employees to give false information
- Knowingly delaying a required disclosure
Securities offenses are a separate path. An executive who trades while aware of material, nonpublic information about an incident can face insider-trading charges.
A former Equifax manager and a former Equifax CIO of its U.S. Information Solutions business were both prosecuted by DOJ. One received 4 months in prison; the other, 8 months of home confinement. Not every pre-disclosure transaction is unlawful, and neither person was a director or enterprise-wide officer.
Certifications and filings matter too. Under Sarbanes-Oxley, knowingly certifying a noncompliant financial report carries up to $1 million and 10 years; willful certification, up to $5 million and 20 years. An intentional misstatement about cybersecurity posture is different from a good-faith judgment that a regulator later disputes.
Case studies, kept in proportion
Joseph Sullivan (criminal). Uber's former security chief concealed a 2016 breach during an FTC investigation, including a $100,000 payment routed through the bug-bounty program and NDAs describing the activity as research. He was convicted of obstruction and misprision in 2022 and received three years' probation and a $50,000 fine.
The Ninth Circuit affirmed, and the Supreme Court declined review in June 2026. The case turned on affirmative concealment. It does not show that every CISO faces prosecution.
Drizly (administrative). The FTC's final order in January 2023 named CEO James Cory Rellas individually and carried security-program obligations to future businesses. It was a consent order, not a conviction.
SolarWinds (civil). The SEC sued the company and its CISO, Timothy Brown, in 2023. A court dismissed most claims in 2024, and the SEC dismissed the case with prejudice in November 2025. Allegations are not findings of liability.
Why jurisdiction and industry matter
Federal law, state law, and sector rules create different exposure. Public companies face SEC disclosure duties. Healthcare entities face HIPAA, which has its own criminal provision for knowing wrongful disclosure of health information. Financial institutions face GLBA and, in New York, NYDFS Part 500 certifications.
State breach laws vary. Michigan, for example, treats a knowing notification failure as a civil fine but intentionally issuing a false breach notice as a misdemeanor. Verify current requirements with counsel before relying on any summary.
How Criminal, Civil, and Regulatory Exposure Differ
Civil and fiduciary liability
Shareholders, customers, employees, and others may sue for negligence, mismanagement, breach of fiduciary duty, or failure of oversight. Delaware's Caremark line of cases centers on good-faith board-level monitoring. Outcomes vary. Derivative suits over the Target and Wyndham breaches were dismissed, as was the SolarWinds derivative case.
Regulatory and administrative exposure
Agencies use investigations, subpoenas, consent orders, civil penalties, and individual orders. Regulatory accountability does not equal criminal liability. SEC settlements with Unisys, Avaya, Check Point, and Mimecast in October 2024 named companies, not individually charged officers.
Criminal exposure
Criminal guilt requires proof beyond a reasonable doubt. Civil and administrative matters use lower standards, and pleading-stage rulings are not merits findings. Consequences differ too: prison and fines versus money and prospective obligations.
One incident can trigger parallel tracks:
- Technical investigation
- Regulatory inquiry
- Shareholder litigation
- Insurance claims
- Possible criminal investigation
Coordinate leadership communications with counsel. A casual statement in one track can become evidence in another.
Who May Be Held Accountable After a Cyber Incident?
Directors and board committees
Directors oversee. They understand material cyber risks, demand reliable reports, challenge unsupported assurances, fund readiness, and monitor remediation. They do not run technical operations, but they cannot delegate accountability for oversight itself.
Records that show informed oversight include:
- Board materials and committee minutes
- Risk acceptances and remediation deadlines
- Questions asked and management responses
- Follow-up actions
CEOs, COOs, and other executives
Exposure can arise when executives act within their authority on cyber risk. Common triggers include:
- Approving risk decisions or ignoring known deficiencies
- Signing certifications and approving disclosures
- Directing incident communications
- Setting escalation thresholds
CISOs, CIOs, CTOs, and security leaders
Title alone does not decide liability. Courts and agencies look at actual authority, access to information, reporting lines, ability to escalate, and involvement in incident decisions. Candid reporting matters, as do clear escalation paths when management delays or underfunds remediation.
In 2023, the SEC's Sanjay Grewal said the agency does not second-guess good-faith compliance judgments made after reasonable inquiry. That statement was not a CISO immunity announcement.
General counsel and compliance leaders
Legal and compliance staff contribute to notification analysis, evidence preservation, privilege decisions, regulatory communications, and disclosure review. Legal advice is distinct from operational cybersecurity responsibility.
Vendors, MSPs, and cloud providers
Outsourcing can create contractual and regulatory liability for the provider. It does not remove the company's duty to:
- Perform due diligence
- Set security requirements
- Monitor performance
- Escalate failures
The FTC Safeguards Rule, for example, expects service-provider security terms in contracts, monitoring, and periodic reassessment. A shared-responsibility model does not transfer the company's accountability, so allocate responsibility by facts, not assumption.
How Boards and Executives Can Reduce Criminal Liability Risk
Set decision rights and escalation thresholds before an incident
Write down who decides materiality, who contacts counsel and law enforcement, who approves disclosures, who preserves evidence, and when the board or audit committee must be told. Under SEC Item 1.05, the four-business-day filing clock runs from the materiality determination, not discovery, so that decision cannot be improvised.
Tie escalation criteria to business impact, affected data, operational disruption, legal obligations, suspected misconduct, and uncertainty, not technical severity alone.
Build reporting leaders can inspect and challenge
Good board reporting is plain English. It states current posture, what changed since the last briefing, material gaps, overdue remediation, accepted risks, owners, deadlines, and trends.
This is the approach Tyson Martin takes with boards: a stable dashboard that shows trend rather than trivia, with clear decisions for directors and delegation for management. Board advisory or fractional executive support is an optional governance resource, not legal representation.
Maintain defensible pre-incident governance
Scale these to the organization:
- Risk assessments and asset inventories
- Access governance, patching, and vulnerability management
- Logging and vendor oversight
- Incident-response planning and employee awareness
- Review of critical dependencies
Boards can use NIST CSF 2.0, which added a Govern function in 2024, to monitor outcomes without managing technical detail. It is a governance framework, not a safe harbor.
Respond accurately and preserve evidence
Issue legal holds early. Preserve logs and communications, control access to sensitive facts, and keep statements to employees, customers, regulators, investors, and law enforcement accurate.
Never delete, alter, conceal, or selectively present records. Each of those acts can create separate obstruction or false-statement exposure under statutes like 1519 and 1001, even if the underlying incident was not a crime.
Document risk acceptance and remediation
For any deferred fix, record:
- The known risk and business rationale
- Compensating controls
- The responsible owner and target date
- The approval authority
- Conditions for revisiting the decision
Have executives join tabletop exercises and post-incident reviews, with documented lessons, assigned actions, and confirmation that fixes were completed.
Does D&O Insurance Protect Against Cyber-Related Liability?
D&O insurance can respond to some cyber-related management liability claims, but coverage is narrow, wording-dependent, and often unavailable for criminal fines, penalties, or intentional wrongdoing.
What D&O insurance may address
D&O policies may respond to shareholder or derivative suits, mismanagement and breach-of-duty claims, and some regulatory investigations, depending on wording and allegations. Side A covers individuals' non-indemnified loss, including defense costs. Side B reimburses the company for indemnification.
Defense costs are one thing. Settlements, judgments, fines, penalties, and restitution may be uninsurable under the policy or applicable law.
Coverage limitations that require close review
Review these items closely:
- Cyber exclusions and conduct or criminal-act exclusions
- Final-adjudication language
- Insured-person definitions, including whether CISOs qualify
- Severability and allocation
- Regulatory-investigation triggers and sublimits
- Prior-knowledge provisions and notice requirements
Many policies fund defense before final adjudication but exclude amounts tied to established fraud or intentional wrongdoing. In RSUI v. Murdock, the Delaware Supreme Court held that public policy did not categorically bar the disputed fraud coverage, and that the policy's exclusion required a final, nonappealable adjudication. That is one state's ruling on specific wording, so get jurisdiction-specific advice.
D&O and cyber liability insurance are complementary
Cyber policies commonly address incident response, forensics, notification, restoration, business interruption, and some third-party claims. D&O addresses management-liability allegations. Terms vary by policy.
Review the full program together:
- Indemnification agreements and Side A protection
- Cyber wording and D&O exclusions
- Retentions, limits, and claims-made reporting
- Coordination among policies
Insurance does not cover reputation damage or customer attrition, and it should not be treated as a substitute for governance.
Frequently Asked Questions
Are directors and officers personally liable?
It depends on facts and jurisdiction. Ordinary oversight failures usually lead to civil exposure, while intentional misconduct, concealment, false statements, or obstruction can create criminal liability.
What does directors and officers liability cover?
It may cover certain claims and defense costs from management decisions. Exclusions, definitions, allegations, final adjudications, and applicable law control the outcome.
Is cyber liability insurance coverage a type of liability insurance?
Yes, it is a specialized product that can include first-party and third-party coverage. It generally complements D&O insurance rather than replacing it.
Who is responsible for cyber security in a company?
Responsibility is shared by role. The board oversees, executives govern and resource, security and technology teams execute, and vendors deliver contracted services under oversight.
Can a cyber breach alone lead to criminal charges for a director or officer?
Not by itself. Charges require evidence of conduct meeting a specific offense, such as intentional concealment, obstruction, false statements, or fraud.
What should a board document after a cyber incident?
Document key decisions, facts known at the time, questions asked, management responses, legal and regulatory analysis, escalation decisions, evidence-preservation steps, remediation owners, and follow-up dates.
