CISOs Under Indictment: Case Studies, Lessons Learned, and What’s Next
summary
Panel recounts concrete outcomes: regulators use misstatements as their enforcement tool, one CISO is indicted and none are jailed, SEC and state attorneys pursue disclosure language and boilerplate; companies report 1,400 risk acceptances in aggressive governance programs, boards rarely see clear RACI so only 7% have documented roles, timeline to stable standards is five to ten years. Practical fixes: require CEO-signed risk tolerances, D&O/indemnity for execs, preapproved outside counsel in IR, better incident “DVR” notes and third‑party validation.
AI-written summary · about
chapters (11)
- 0:00Introduction and panel overview
- 2:52The heating landscape for CISOs
- 6:06Shifting personal risk calculus
- 10:18Governance and documentation
- 13:23Strategic accountability and boards
- 17:54Regulatory scrutiny and misstatements
- 21:23Legal protections and insurance
- 25:10Managing internal communications
- 30:00Future standards and normalization
- 37:21Practical incident response advice
- 42:09Final takeaways and closing
related talks
52mThe Buck Stops….Where? Data Breach Accountability and the C-Suite
01h 00mFrom the Fry Pan to the Fire—Personal Liability for CISOs and InfoSec Pros
52mCISOs and Legal Uniting in a Post Uber and Twitter World
02h 11mCISO Track Panel
01mCISO Legal Risks And Liabilities
22mThe CISO’s Guide to Securing a Board Seat
01h 00mCXO Panel: Clash Of The Titans; Who Will Survive?
52mCISO Legal Risks and Liabilities