Skip to content
CISO Spotlights

Glossary

What is CISO personal liability? A security chief's own legal exposure, defined

CISO personal liability is the legal exposure a security chief carries as an individual. Two key cases, the rule that adds a personal signature, and why it matters.

Term: CISO personal liability · also CISO liability, security chief legal exposure

By the CISO Spotlights Desk · Published · 4 sources

CISO personal liability is the legal exposure a chief information security officer (CISO) carries as an individual, separate from the employer's, for statements, signed certifications or conduct tied to the security program. The two cases this site's guide examines turned on specific statements and acts, not on holding the title or suffering a breach.

Two cases, two outcomes

On 30 October 2023 the SEC charged SolarWinds and its CISO with fraud and internal control failures. The complaint covered the period from the company's October 2018 initial public offering to its December 2020 disclosure of a cyberattack, and sought relief that included an officer and director bar against the CISO. On 20 November 2025 the SEC and the defendants filed a joint stipulation of dismissal with prejudice, and the SEC added that the decision does not necessarily reflect its position on any other case.

The second case is criminal. Uber's former chief security officer was found guilty by a jury of two felonies in October 2022 and, according to a Justice Department release of 5 May 2023, sentenced to three years of probation and a $50,000 fine. The conduct at issue was concealing a breach from the Federal Trade Commission during its investigation, not the breach itself.

Where a personal signature is written into the rules

New York's 23 NYCRR Part 500, as amended effective 1 November 2023, requires each covered financial firm to file by 15 April every year either a certification of material compliance or an acknowledgment of noncompliance. That filing must be signed by the firm's highest-ranking executive and by its CISO, which puts the security chief's own name on a regulatory submission.

Why it matters in a career

For a candidate weighing a seat, liability raises practical questions alongside pay and reporting line: what the CISO will be asked to sign, whether the role is a designated officer, and how the company's insurance treats the person in it. This site's guide covers each case and the insurance gap in full.

Where it appears on cisospotlights.com

Related terms

Chief security officer (CSO), CISO reporting line and interim CISO.

Sources

  1. 1.
    U.S. Securities and Exchange Commission, Press Release 2023-227sec.gov · published 30 October 2023 · tier A
  2. 2.
    U.S. Securities and Exchange Commission, Litigation Release No. 26423sec.gov · published 20 November 2025 · tier A
  3. 3.
    U.S. Attorney's Office, Northern District of Californiajustice.gov · published 5 May 2023 · tier A
  4. 4.
    New York State Department of Financial Services, 23 NYCRR Part 500 (Second Amendment)dfs.ny.gov · published 1 November 2023 · tier A

Tier A: the organization itself, a regulator or a government page. Tier B: established trade or business press.

Cite this definition as “CISO Spotlights glossary” with a link to this page. See an error? Request a correction.