A New Risk For CISOs: Criminal Liability

With cybersecurity risks and incidents rising every year, businesses are increasingly taking active steps in their cyber risk management and instituting a chief information security officer (CISO). CISOs or equivalent positions have been shown to decrease the probability of information security breaches when included in top management and with board access. Yet, in the face of an inevitable data breach or ransomware attack, businesses face consumer class actions and regulatory investigation that may put CISOs and their employers in conflicting legal positions.