7 ways to mitigate CISO liability and risk – TechTarget

2. Treat secrets as red flags

In the interest of minimizing CISO liability issues, Miller also suggested security leaders stay alert for one major red flag. “When you find yourself asking the question, ‘How can we keep this a secret?’ that should be your indication that maybe that’s not the road you want to go down,” she said.

In the Sullivan case — as in so many others — the bigger problem was not the incident, but the cover-up. And the premium that regulators put on open communication and transparency makes any efforts to mislead law enforcement, investors or the public inherently risky.

3. Hold crisis communication tabletop drills

While most security teams practice incident response tabletop exercises, Miller suggested also holding drills for executive teams that focus specifically on crisis communications and ethical dilemmas.

“It’s a great way to accomplish two things. First, it can help you clearly establish your lane as the CISO,” she said. “And, second, it sets executives’ expectations — so now you know they understand the types of scary decisions the team is going to have to make.”

Executives who have practiced thinking on their feet during crisis drills will likely make better choices under pressure when the time comes. In late 2022, Miller’s own team at Epiq conducted such an exercise, which the company’s compliance team designed.

After running crisis communications drills, Baker added, CISOs should revise their incident response plans based on lessons learned.

4. Get it in writing

The vast majority of CISOs in the U.S. don’t have employment contracts outlining the scope of their responsibilities and the legal protections their organizations afford them. But, according to Baker, they should.

“If you don’t have a contract, then you need an understanding in writing about how you’re protected,” he said. That might mean, for example, coverage under directors and officers or indemnity insurance policies. “To my mind, that is crucial,” he added.

And, again, ensuring everyone understands the limits of the CISO’s responsibilities goes a long way. Baker said in his experience — during both tabletop exercises and real incidents — much decision-making should and does roll toward the lawyers’ end of the table. “Make it clear you’re going to consult the lawyers and they are going to make the final decision,” he said. For example, the legal team should officially declare when an incident rises to the level of a breach, which starts the clock on disclosure requirement windows.

Employers would be wise to offer their CISOs legal assurances in writing, Baker added, as they shouldn’t want security leaders to have to choose between protecting themselves and protecting their organizations. “As a CISO, I should be acting in the company’s interest, and I should know that the company has my back,” he said, adding that a written agreement can come from the CEO or the HR department, as long as it is binding to the corporation.

That said, CISOs who can’t secure formal employment contracts have a back-up option: articulating in their incident response plans who bears responsibility for making which decisions. “Write down exactly what the procedures will be,” Baker said.

5. Find a personal lawyer

“If you’re a CISO or you want to be a CISO, my number one recommendation is to find a lawyer you can trust to help you negotiate your next job,” Davies said. This person, she added, ideally specializes in the ins and outs of contract law and has previous experience working on the corporate side of the fence.

The best time to negotiate a contract is before accepting a job. But recent high-profile instances of CISO liability, such as the Uber case, can offer sitting security leaders an opportunity to revisit the terms of their employment. Davies said she has recently seen many of her peers broach the topic with their employers, including one CISO who had a particularly candid conversation with her company’s CFO.

“She said, ‘In the event of an incident, I know you’re going to need a head on a platter to show to the shareholders,'” Davies said. “‘I’m going to let it be me, and this is what it’s going to cost you.'” The unnamed security executive ultimately negotiated a CISO golden parachute package that included a super-vesting of equity, a year in severance and a year’s worth of benefits.

“You need a little bit of a safety net to say, ‘I am all in with this company. I am here to protect the company, and you need to protect me as an executive,'” Davies said. “I can guarantee you CFOs, CEOs, chief legal officers — they have those protections in their contracts.”

All three panelists reminded CISOs that corporate lawyers are not personal lawyers — they put the interests of their companies first. Similarly, Baker said CISOs should cooperate with federal law enforcement, while also protecting themselves legally.

“The FBI is not your friend,” he said. “They are working for the Justice Department — the same people who indicted a CISO. Just remember that.”

6. Use precise terminology

Davies urged CISOs to accurately differentiate among security events, incidents and breaches in the language they use. “If it’s an actual breach, then there are regulatory requirements in certain jurisdictions,” she said. “Stop using the term ‘breach’ unless your law department has said, ‘This meets the legal threshold and definition.'”

She also warned against making “puffery statements” on corporate websites, in marketing materials and in public appearances that — in the event of a breach — shareholders could potentially characterize as misrepresentations.

“Be careful about statements such as, ‘We have world-class security,’ or ‘We have the best security I’ve ever seen,'” Davies said. “Any of us can fall prey to an incident at any time. A better statement to make is, ‘We aim for great security.'”

7. Don’t panic

Although CISOs should consider liability issues as a matter of best practice, Miller said she views the Sullivan conviction as an outlier that does not fundamentally change the landscape.

“I don’t think we have to panic as CISOs,” she said. “After this case, everyone was like, ‘Oh my God! They’re holding him liable for the fact they had a breach.’ But no, they’re not — that’s not what happened.”

Nor, she added, does the case call into question the future of bug bounty programs as some have suggested. Rather, Sullivan and his team stretched the limits of what a bug bounty is meant to be — arguably beyond all recognition. And the former CISO’s liability hinged on the cover-up, not the breach itself.

Bearing all of that in mind, CISOs who remain true to their established policies, playbooks and processes needn’t worry unduly, Miller said.

“This was a perfect storm, and it’s not likely to happen again,” Baker agreed.