CISO Personal Liability: Legal Exposure and Protection

Security leaders can now be named personally when a breach is concealed or when public statements about security do not match what they knew internally. Two US cases changed how CISOs think about their own exposure: the criminal conviction of Uber's former chief security officer, and the SEC's fraud action against SolarWinds and its CISO, which was later dismissed. In Europe, NIS2 and DORA place accountability on management bodies, and in the UK the Cyber Governance Code of Practice sets out what boards are expected to own. This guide explains where personal exposure actually comes from, what the cases did and did not establish, how indemnification and D&O insurance work in general terms, and the habits that protect a security leader. It is written for CISOs, deputy CISOs, vCISOs and the general counsel and board members who work with them, and it is not legal advice.

Key takeaways

Concealment, not compromise, created criminal liability. The Uber case turned on hiding a breach from a regulator and paying attackers for non-disclosure agreements, not on the breach itself.
Your words in public documents are the main civil exposure. The SEC's SolarWinds complaint relied on the gap between public security statements and the CISO's own internal presentations.
The SolarWinds case ended without a finding against the CISO. A court dismissed most claims in 2024 and the SEC dismissed the rest with prejudice in November 2025, but the risk of investigation and legal cost remains real.
European law targets management bodies. NIS2 and DORA make the management body accountable for cyber risk; a CISO who is not on that body is exposed mainly through role, reporting lines and employment terms.
Protection is built before the incident. Written escalation, documented risk acceptance, accurate disclosure review, and confirmed indemnity and D&O cover matter far more than anything arranged after a breach.

Where personal exposure comes from

Personal liability for a security leader rarely comes from a control failing. It comes from what the person said, signed, hid or failed to escalate. The table sets out the main routes, with the legal basis where a primary source confirms it.

Route	What triggers it	Example or basis	Who is usually exposed
Criminal obstruction or concealment	Hiding a breach from a regulator or investigator, false statements, misleading NDAs	US v. Sullivan: 18 U.S.C. 1505 (obstruction of FTC proceedings) and 18 U.S.C. 4 (misprision of felony)	Whoever directed the concealment
Securities fraud (civil)	Public statements about security that the person knew were false or misleading	SEC v. SolarWinds and Timothy G. Brown: antifraud provisions of the Securities Act and Exchange Act, with Brown charged with aiding and abetting	Officers who make, approve or help prepare statements
Disclosure controls and reporting	Incomplete or late material incident disclosure, weak escalation to disclosure committees	SEC Form 8-K and Regulation S-K Item 106 (17 CFR 229.106)	Mainly the company, then signing officers
Regulatory management accountability	Failure to approve and oversee cyber risk measures	NIS2 management body accountability; DORA Art. 5	Management body members
Directors' duties (UK)	Failure to promote the company's success with due regard to risk	Companies Act 2006 s172, cited by the NCSC Board Toolkit	Directors, including a CISO who sits on a board
Employment and contract	Dismissal, clawback, breach of contract claims after an incident	Employment terms, consultancy contracts	Employees and contractors, including vCISOs

US v. Joseph Sullivan: what the Uber case established

According to the US Department of Justice, a federal jury convicted Joseph Sullivan, Uber's former chief security officer, on 5 October 2022 of obstructing proceedings of the Federal Trade Commission and misprision of a felony. The facts set out by the DOJ explain why this was a concealment case:

Context: Sullivan joined Uber in April 2015, after Uber had disclosed a 2014 breach to the FTC, and he testified to the FTC under oath in November 2016 as part of that inquiry.
The 2016 breach: attackers emailed Sullivan on 14 November 2016 saying they had taken user data. The DOJ states the data covered about 57 million users and 600,000 driver's licence numbers.
The payment: Uber paid the attackers 100,000 dollars in bitcoin in December 2016 in exchange for non-disclosure agreements that falsely stated no data had been taken.
Who was told: the DOJ says Sullivan did not disclose the breach to the FTC and misled Uber's new CEO and outside lawyers. Uber disclosed the breach publicly and to the FTC in November 2017.

The practical lesson is narrow and important. A CISO who learns of a breach while the company is under regulatory scrutiny must not control who learns about it. Route it to legal counsel and the executive team in writing and let disclosure decisions be made by the people who own them. The Uber Breach 2016 page covers the technical cause, an AWS key in a GitHub repository.

SEC v. SolarWinds and Timothy Brown: what the case did and did not establish

On 30 October 2023 the SEC charged SolarWinds and its CISO, Timothy G. Brown, in the Southern District of New York. The SEC alleged that from the October 2018 IPO to the December 2020 disclosure of the SUNBURST attack, the company overstated its cybersecurity practices and disclosed only generic, hypothetical risks. Against Brown personally, the SEC alleged that he knew of the risks, did not resolve or adequately escalate them, and helped mislead investors. The complaint pointed to internal material: a 2018 engineer presentation that described the remote access set-up as "not very secure", Brown's own 2018 and 2019 presentations describing the company as highly vulnerable, and a June 2020 statement calling a potential attack "very concerning". The SEC sought an officer and director bar against Brown.

July 2024 ruling: the court dismissed most of the SEC's claims, including those based on the post-SUNBURST disclosures and the internal accounting controls theory, while letting claims based on the company's public security statement proceed.
Dismissal: on 20 November 2025 the SEC announced a joint stipulation to dismiss the action with prejudice, stating it did so "in the exercise of its discretion" and that the decision does not necessarily reflect its position on other cases (Litigation Release LR-26423).
What did not change: Brown spent two years as a named defendant. The allegations rested on contradictions between public statements and internal documents, and that pattern can recur in any company.

The lesson is about consistency. A CISO's internal risk reports are evidence. If they say the environment is "very vulnerable", the public security statement, the 10-K risk factors and customer questionnaires must not say the opposite. The SolarWinds Supply Chain Compromise page covers the attack itself. See the SEC Cybersecurity Disclosure Rules Guide for the disclosure regime.

Europe and the UK: management body accountability

European law approaches the problem from the board down rather than from the CISO up.

Instrument	Who it targets	What it requires	What it means for a CISO
NIS2 Directive (EU) 2022/2555, Art. 20	Management bodies of essential and important entities	Approve cybersecurity risk-management measures, oversee their implementation, follow training; can be held liable for infringements under national law	The CISO prepares what the management body approves, so the quality and honesty of that briefing becomes evidence
NIS2 Art. 32 and 34	Essential entities and their managers	Supervisory measures and fines; for essential entities, national authorities can seek a temporary ban on a person exercising managerial functions	Exposure depends on national transposition and whether the CISO holds a managerial function
DORA Regulation (EU) 2022/2554, Art. 5	Management body of financial entities	Bear "the ultimate responsibility" for ICT risk; set clear roles; approve the digital operational resilience strategy and risk tolerance; approve continuity and response plans and ICT audit plans; keep ICT risk knowledge up to date	The CISO or ICT risk function is the second line that informs those decisions
UK Cyber Governance Code of Practice (April 2025)	Boards and directors of medium and large organisations	Five principles: risk management, strategy, people, incident planning and recovery, assurance and oversight	Action E.3 asks for regular two-way dialogue with the CISO or equivalent; E.2 asks for formal reporting at least quarterly
Companies Act 2006 s172	Company directors	Promote the success of the company, considering long-term consequences and other factors	Relevant if the CISO is a statutory director

The European Commission describes NIS2 as introducing "accountability of the top management for non-compliance with cybersecurity risk management measures". National laws decide the detail, so check the transposing law in each country where you operate. See the NIS2 Directive Guide, the DORA Guide and the UK Cyber Governance Code of Practice Guide.

Indemnification and D&O insurance

Most CISOs assume the company will defend them. That assumption should be tested in writing before an incident, with your own lawyer if needed. The points below are general; terms vary widely by jurisdiction, policy wording and employment contract.

Indemnification: a company promise to pay a person's legal costs and losses arising from their role. It may sit in the articles or bylaws, an indemnity agreement or the employment contract. Check whether it names your role, covers former officers, and includes advancement of defence costs before the outcome is known.
Limits on indemnity (UK example): under the Companies Act 2006, s232 makes void any provision exempting a director from liability to the company, s233 allows the company to buy insurance, and s234 permits a qualifying third party indemnity that may not cover criminal fines, sums payable to a regulator as a penalty, or the costs of defending criminal proceedings in which the director is convicted. These sections are about directors; non-director officers depend more on contract and policy terms.
D&O insurance: directors and officers liability policies typically cover defence costs and some losses for insured persons. Ask whether "insured person" includes the CISO by title or by function, whether regulatory investigations are covered from the first subpoena or only from a formal claim, and how conduct exclusions apply.
Contractors and vCISOs: a fractional CISO is often outside the D&O definition of officer. Their protection comes from the engagement contract and their own professional indemnity cover. See the vCISO Guide.
Cyber insurance is different: a cyber policy covers the company's incident costs, not personal defence. See the Cyber Insurance Guide.

Question for general counsel or the broker	Why it matters
Am I an insured person under the D&O policy, by name, title or definition?	Many definitions list directors and specified officers only
Does cover start at an informal regulator inquiry, a subpoena or only a formal claim?	The SEC investigation before charges can be the most expensive phase
Will the company advance defence costs, and on what undertaking?	Advancement decides whether you can afford separate counsel early
Does indemnity survive my departure?	Claims often arrive years after the events
Can I retain separate counsel if my interests diverge from the company's?	In SolarWinds, the company and the CISO were co-defendants
What conduct exclusions apply, and when are they decided?	Exclusions usually bite only after a final adjudication

Habits that reduce exposure

Put the role in writing. Agree a charter or job description that states your authority, reporting line, budget control and what decisions belong to others. Map it to NIST CSF 2.0 GV.RR-02 (roles, responsibilities and authorities established and enforced). See the Security Governance Committee Charter Template.
Escalate in writing, to named owners. Material risks go to the executive and board with a recommendation, an owner and a date. Brown's alleged failure to escalate was one of the SEC's theories against him.
Document risk acceptance. When the business accepts a risk, record who accepted it, the rationale and the review date in the risk register. See the Risk Register Template.
Review every public security statement. Website trust pages, SOC 2 bridge letters, 10-K risk factors, Item 106 text, sales questionnaires and RFP answers should be checked against the current internal risk picture at least annually.
Join the disclosure process. Make sure incidents route to the disclosure committee or general counsel through a defined materiality process, with the CISO providing facts and legal owning the decision.
Never negotiate incident confidentiality alone. Any payment, NDA or agreement with an attacker or researcher goes through legal and executive approval and is recorded.
Keep your own records lawfully. Retain copies of reports you sent and approvals you received within company policy, so you can show what you knew and when.
Exercise with legal in the room. Tabletop exercises should test notification decisions and evidence handling, not only containment. The UK Code asks for exercises at least annually (action D.2).

Decision guidance: what changes by organisation and role

US listed company CISO: the highest civil exposure. Focus on statement consistency, Item 106 accuracy and the 8-K materiality workflow. Insist on D&O definition coverage.
EU essential or important entity: exposure runs through the management body. Make sure the board formally approves risk measures, receives training and minutes its oversight, so accountability sits where the law puts it.
Financial entity under DORA: make the management body's approvals of strategy, risk tolerance, continuity and audit plans explicit and dated.
Small or private company: lower regulatory exposure, but often no D&O definition for the CISO and no disclosure committee. Get the indemnity in your contract.
CISO who is also a director: statutory duties and the Companies Act indemnity limits apply directly; you sign off on more and can rely less on "I escalated it".
vCISO or consultant: clarify in the contract that you advise and the client decides; carry professional indemnity insurance; avoid signing attestations as if you were an officer.

Detection and measurement

Governance hygiene can be measured like any control. Useful indicators:

Statement drift: number of public security statements reviewed against the internal risk picture in the last 12 months, and discrepancies found and fixed.
Escalation latency: median time from a risk being rated high to written notification of the accountable executive.
Risk acceptance coverage: percentage of open high risks with a named, dated acceptance or treatment plan.
Board reporting cadence: formal cyber reports to the board per year (the UK Code asks for at least quarterly).
Disclosure readiness: time taken in the last exercise from incident declaration to a materiality decision recorded by legal.
Cover confirmation: date indemnity and D&O coverage for the security leadership team was last confirmed in writing.

See the Board Cyber Risk Reporting Guide and the Board Cyber Report Template.

Framework mapping

Protective habit	NIST CSF 2.0	NIST SP 800-53 Rev. 5	Other
Leadership accountability for cyber risk	GV.RR-01	PM-2, PM-29	DORA Art. 5(2)(a); UK Code A.2
Defined roles and authorities	GV.RR-02	PM-1	DORA Art. 5(2)(c); UK Code E.1
Legal and regulatory obligations understood	GV.OC-03	PM-9	UK Code E.5; Reg S-K Item 106
Strategy reviewed and adjusted	GV.OV-01, GV.OV-02	PM-9	UK Code B.4
Performance evaluated	GV.OV-03	PM-1	UK Code E.2
Incident decisions and reporting owned	GV.RR-01	PM-2	UK Code D.3; SEC Form 8-K

Common failure patterns

Owning a disclosure decision alone. The Uber Breach 2016 shows how a security-led decision to keep a breach quiet became a criminal case.
Two versions of the truth. Internal decks call controls weak while the website security statement calls them strong. This contradiction was the core of the SEC's case against SolarWinds and Brown.
Escalation by conversation. Risks raised verbally in corridors leave no evidence that the CISO escalated, or that leadership decided.
Assuming D&O cover. Discovering after a subpoena that the policy defines officers by title and excludes the CISO.
Board approval without understanding. Boards that approve NIS2 or DORA measures without training or minuted challenge leave both themselves and the CISO exposed.
Unchecked questionnaire answers. Sales teams reuse old security answers that no longer reflect reality, creating misleading statements to customers.

Practitioner checklist

Confirm in writing that you are covered by the company indemnity and are an insured person under the D&O policy, including after you leave.
Agree a written role charter covering authority, reporting line and decision rights.
Set up a written escalation route for material risks to named executives and the board.
Record every risk acceptance with owner, rationale and review date.
Review all public and customer-facing security statements against internal assessments at least annually.
Define the incident materiality workflow with legal, and rehearse it in an exercise.
Route any attacker payment, NDA or confidentiality request through legal and executive approval.
For EU entities, check how your country transposed NIS2 management liability and whether you hold a managerial function.
Take independent legal advice on your own position if your interests and the company's could diverge.

Standards and references

Related NHI Mgmt Group resources: CISO Guide: First 90 Days · SEC Cybersecurity Disclosure Rules Guide · Board Cyber Risk Reporting Guide · UK Cyber Governance Code of Practice Guide · vCISO Guide. This guide summarises legal developments and is not legal advice.

CISO Personal Liability Guide: Legal Exposure and How to Manage It