Adrian Johnson
TLDR:
- A government agency will soon hold a corporate CEO personally liable for a failure to invest in cybersecurity
- CEOs need to take a personal interest in cybersecurity to avoid government enforcement actions
In a recent article, Joe Sullivan discusses the growing trend of holding CEOs personally accountable for cybersecurity failures in their organizations. The government’s shift towards regulation by enforcement means that CEOs need to be actively involved in ensuring proper cybersecurity investments are made.
The current focus on security leaders such as CISOs is seen as flawed, as the ultimate responsibility lies with the CEO. Government agencies like the SEC have already started targeting CEOs in cybersecurity cases, rather than focusing solely on security leaders.
CEOs and boards are being urged to sign pledges and invest in cybersecurity to protect citizens from cyberattacks. Security leaders are pushing for more resources and involvement from top executives in cyber-incident response processes. Ultimately, CEOs need to prioritize cybersecurity to avoid becoming the target of government enforcement actions.
Joe Sullivan provides insights and advice based on his extensive experience in cybersecurity and executive leadership roles. By taking proactive steps to prioritize cybersecurity, CEOs can protect their organizations and avoid potential legal implications.
