Introduction
A breach doesn't automatically put an executive on the hook. But it does invite questions. Regulators, shareholders, customers, and courts will ask what leaders knew, what they decided, what they disclosed, and what they wrote down.
In this article, personal liability means individual exposure in the US:
- Regulatory action
- Shareholder or derivative claims
- Direct orders or civil penalties
- Professional consequences
- Criminal charges in exceptional cases
Below, we cover how exposure arises, how it differs by role, why delegation doesn't end oversight, and how to build a record of informed governance. This is general information, not legal advice. Work with qualified counsel on your specific facts.
Key Takeaways
- Company liability and personal liability are separate questions that turn on conduct, authority, and knowledge.
- Risk rises with ignored warnings, misleading statements, inaccurate certifications, and missed escalations.
- Outsourcing to a CISO, MSP, or cloud provider doesn't transfer ultimate governance responsibility.
- Documented decisions, reliable reporting, and tested response plans are the strongest protection.
What Personal Liability Means for C-Suite Executives
A company can answer for a breach without every executive answering personally. The standard is generally reasonable, informed, and documented oversight, not a guarantee against attack.
SEC Enforcement Director Grewal acknowledged in 2023 that breaches happen even with strong hygiene, policies, and training. That was a staff speech, not a safe harbor.
Main forms of individual exposure
- Regulatory action: inaccurate certifications, deceptive statements, reporting failures, or breaches of sector-specific duties.
- Civil claims: shareholder, derivative, consumer, contractual, or employment claims alleging weak oversight, misrepresentation, or breach of fiduciary duty.
- Professional consequences: lost board eligibility, employment fallout, regulatory bars, and harder paths to future leadership roles.
Individual outcomes vary widely. Consider three examples:
- Joe Sullivan (Uber): the former security chief received three years' probation and a $50,000 fine for obstruction and concealment, not for being breached.
- James Cory Rellas (Drizly): a 2023 FTC order imposes information-security duties on the CEO for 10 years, including at qualifying future businesses.
- Timothy Brown (SolarWinds): the SEC sought an officer and director bar, then dismissed its case with prejudice in November 2025.
What influences exposure
- Formal duties and actual decision-making authority
- Access to information
- Awareness of unresolved risks
- Response to internal warnings
- Actions after an incident
Where Personal Exposure Can Arise Under US Cybersecurity Duties
Fiduciary oversight
Delaware's Caremark doctrine targets an utter failure to build reporting systems, or a conscious failure to monitor them. In Marchand v. Barnhill (2019), the Delaware Supreme Court reversed a dismissal where allegations suggested no board-level monitoring of mission-critical food safety. Marchand addressed food safety, not cybersecurity.
Cyber-specific derivative suits have mostly failed. Courts dismissed the SolarWinds oversight claim (2022) and the Marriott claim (2021) because negligence and corporate calamity don't establish bad faith. Delaware has also recognized that officers owe oversight duties within their areas of responsibility.
SEC disclosure duties
The SEC's 2023 final rule requires two things from public companies:
- Form 8-K Item 1.05: generally file within four business days after determining an incident is material, not after discovery.
- Regulation S-K Item 106: describe cyber risk management, strategy, and governance annually in the Form 10-K.
Materiality means a substantial likelihood that a reasonable investor would consider the information important. Ransomware payment or insurance reimbursement alone doesn't settle the question, per June 2024 staff guidance.
The October 2024 SEC settlements with Unisys, Avaya, Check Point, and Mimecast involved hypothetical risk language despite known intrusions or omitted details. Blackbaud (2023) and Pearson (2021) failed to get breach facts to disclosure decision-makers. These were corporate settlements, not findings against individual executives.
FTC, state, and sector rules
Don't treat one statute as universal. Examples:
- FTC Safeguards Rule: applies to covered financial institutions; a Qualified Individual reports to the board at least annually. Notice is due within 30 days of discovering an event affecting 500 or more consumers.
- NYDFS Part 500: the April 15 certification is signed by the highest-ranking executive and the CISO.
- HIPAA: criminal exposure attaches to knowingly obtaining or disclosing protected health information unlawfully.
- False Claims Act: in 2023, Jelly Bean Communications and its manager settled for $293,771 over alleged false cybersecurity representations, without an adjudication of liability.
Aggravating conduct
External messaging that contradicts internal records is a recurring problem. Other conduct can turn a security failure into a personal one:
- Concealing or destroying evidence
- Retaliating against internal reporters
- Delaying action without justification
- Making knowingly false statements
- Failing to act on credible warnings
In the Uber case, former CISO Joe Sullivan withheld information from lawyers and misrepresented the theft to the CEO. SEC Rule 21F-17 also bars impeding employees from contacting the SEC.
Rules, deadlines, and enforcement priorities change. Confirm current requirements with counsel before relying on any of this.
How Liability Differs Across Executive Roles and Third Parties
Role-by-role scrutiny
These are tendencies, not rigid rules:
- CEOs and COOs: enterprise risk priorities, resourcing, escalation practices, and action on material information.
- CFOs: financial impact assessments, disclosures, internal controls, and SOX certifications.
- General Counsel and compliance: notification decisions, privilege, evidence preservation, regulator communications, and escalation design.
- CISOs, CIOs, CTOs: actual authority, reporting lines, representations to leadership, and escalation of known control failures.
A security title doesn't automatically create personal liability. The Brown dismissal did not hold that every CISO is liable for insecure systems.
Vendors don't carry your oversight
Vendors perform tasks. They don't own your decisions. Duties differ by regime, but the themes repeat:
- Due diligence before selection
- Contract security requirements and audit rights
- Access controls and performance monitoring
- Incident notification terms
- Exit planning
The FTC Safeguards Rule requires service-provider selection and monitoring, and NYDFS 500.11 requires written third-party policies.
Verizon's 2026 DBIR reports third-party involvement in 48% of breaches, up from 30%, though it is a global dataset.
Insurance
D&O and cyber policies do different jobs. D&O addresses covered management, disclosure, and fiduciary claims; cyber policies address specified incident losses.
Exclusions for intentional conduct, fines, and contractual liability can limit both, and the specific policy wording controls coverage. Review coverage with insurance and legal professionals.
How Executives Can Build Defensible Cyber Oversight
Defensible means you can show your work. Start here:
- Write down decision rights. Name who owns cyber risk decisions, who can accept or defer risk, when the board is notified, and who leads materiality and notification assessments.
- Report in plain English. Show business impact, trend, open exceptions, owners, target dates, third-party exposure, and what changed since last time. Skip technical dashboards that don't support decisions.
- Document risk decisions. Capture facts, options, rationale, compensating controls, owner, timeline, and triggers for reconsideration. Give risk acceptances and exceptions expiry dates.
- Build the evidence trail. Keep substantive minutes, follow-ups, policy approvals, audit findings, remediation updates, training records, vendor reviews, and the questions asked and answered.
- Test it. Run tabletop exercises with executives, legal, communications, technology, privacy, insurance, and key vendors. Cover materiality, notification, customer messaging, continuity, and evidence preservation.
Tabletops are becoming standard. An EY analysis in the NACD handbook found 58% of Fortune 100 companies disclosed simulations or tests, versus 3% in 2019. That measures disclosure, not a legal threshold.
Outside support
Tyson Martin works with boards and executive teams as a board advisor or interim CISO. The work centers on clarifying decision rights, building reporting you can inspect, setting escalation thresholds, and delivering a measurable 90-day plan with owners. It works alongside qualified legal counsel and isn't a substitute for it.
What to Do Before, During, and After a Cyber Incident
Before
- Keep an accurate inventory of critical systems and sensitive data
- Assign current incident-response roles
- Test communication channels
- Line up outside counsel and forensic contacts
- Document insurer notification steps
- Approve a process for assessing materiality and regulatory obligations
If leaders can't describe the first two hours of a response, there isn't a working plan yet.
During
- Avoid speculation; label what is known, suspected, and unknown
- Preserve evidence and chain of custody
- Activate the response structure and involve legal and technical advisers
- Document key decisions and open uncertainties
- Keep messages consistent across regulators, customers, employees, investors, and partners
Privilege isn't automatic. In the 2020 Capital One ruling, hiring the forensic firm through counsel didn't alone protect its report, because the work would have happened anyway.
After
Require a documented lessons-learned review covering:
- Root causes and control improvements
- Unresolved risks, owners, and deadlines
- Notification follow-up and insurance issues
- How the board will verify that remediation actually happened
Findings without owners and proof of closure tend to resurface months later.
Frequently Asked Questions
What does personal liability for cybersecurity failures mean for C-suite executives?
An executive may face individual regulatory, civil, fiduciary, professional, or, in exceptional cases, criminal consequences. It depends on role, conduct, knowledge, and applicable law. A breach alone doesn't establish it.
Can a CEO be personally liable for a data breach?
Exposure can arise if a CEO ignores known risks, approves misleading statements, signs an inaccurate certification, fails to set up reasonable oversight, or obstructs a response. The facts and governing law control.
Can a CISO be held personally liable for a cyberattack?
Not merely because an attack occurred. Analysis looks at the CISO's actual authority, reporting structure, representations, knowledge of unresolved risks, and handling of escalation.
Are private companies protected from executive cyber liability?
No. Private companies still face privacy, data security, contractual, licensing, consumer-protection, and fiduciary obligations. Examples include the Drizly FTC order and the Jelly Bean settlement. SEC rules apply only to public companies.
Does outsourcing cybersecurity eliminate executive liability?
No. Vendors can do technical work, but the organization still needs due diligence, contract controls, monitoring, escalation, and executive oversight.
Does D&O insurance protect executives after a cyber incident?
It may respond to certain claims or investigations, but wording, exclusions, insured-person definitions, retentions, and interplay with cyber coverage all matter. Review it with qualified advisers.
