CISO Liability & Documentation-Hygiene Checklist
A personal protection record for the named security officer. After the SolarWinds SEC action and the Uber CISO conviction, what shields you is a clean, contemporaneous trail: what you attested, what you escalated, who owns each accepted risk, and the coverage that backs you. Use this to build that trail before you need it. Educational — not legal advice; adapt with qualified counsel.
01Attestations & representations — never sign blind
Before you put your name on any security certification, questionnaire, SOC/ISO representation or disclosure sign-off, confirm you can stand behind it — and qualify it where you cannot. The SolarWinds action centered on security statements alleged to overstate the company’s posture; a signature on something false or unsupported is where personal exposure begins.
- I have read the exact wording and understand what is being certified
- Every claim is supported by current evidence I can produce on request
- Anything only partially true is qualified — scoped to my knowledge, with what it relies on and what is still being assessed stated explicitly
- I have NOT signed any blanket "fully implemented and operating effectively" statement I cannot support
- Public-facing security claims (website, sales collateral, filings) match internal reality; I have flagged in writing any that do not
- The evidence behind what I attested is retained and dated
02Board & audit-committee reporting log
Your central protection is a contemporaneous record of what you escalated, to whom, and when. When regulators and plaintiffs reconstruct "who knew what, when," this log is the difference between being the officer who raised the alarm and the officer who stayed silent. Log material risks as you brief them — do not reconstruct afterward.
| Date | Topic / risk reported | Who was told | Decision / outcome |
|---|---|---|---|
| YYYY-MM-DD | The material risk or incident briefed | Exec mgmt / board / audit committee — names | What they decided; owner; follow-up |
| YYYY-MM-DD | … | … | … |
| YYYY-MM-DD | … | … | … |
- Back each entry with the artifact: dated board/committee materials, minutes, or a follow-up email summarising what you reported.
- Where the board oversees cyber risk, confirm the material items reached the board or audit committee — not just a single manager who could block them.
03Risk-acceptance sign-off record — the business owns it
Risk acceptance is a business decision and must be owned and signed by the accountable business executive who holds the budget and the upside — not absorbed by you. Your role is to assess and recommend; do not let the "risk accepted by" line carry your name.
| Accepted risk | Your recommendation | Accountable business owner | Owner signature / date |
|---|---|---|---|
| The risk being accepted | Your assessment and recommendation — e.g. "recommended against" | Executive who owns the system/budget | Name / signature / date |
| … | … | … | … |
- Each accepted risk names a single accountable business owner (not "the security team" or "the CISO")
- My role is recorded as assessor / recommender, not acceptor
- The sign-off is signed by the business owner, dated, with an expiry or review date
- My recommendation (including any objection) is captured in writing
04D&O insurance & indemnification checklist
Confirm your personal coverage in writing and before a crisis — not after. Corporate indemnification can evaporate exactly when you most need it (insolvency or a refusal), which is what Side-A D&O coverage exists for.
- I am confirmed as a covered "officer" (or otherwise an insured person) under the company’s D&O policy
- I have a written indemnification agreement — not just a verbal promise
- The indemnification provides for advancement of defense costs (paid as incurred, not only reimbursed at the end)
- Side-A D&O coverage is in place to protect me directly if the company cannot or will not indemnify
- I have seen the policy limits, key exclusions and the notice/reporting requirements
- I know who to notify, and how quickly, to preserve coverage if a claim arises
- I have retained a dated copy of the indemnification agreement and the relevant policy pages
05Escalation & whistleblower route
Map the path a material risk takes when management is the obstacle — before you need it. When internal escalation is genuinely exhausted and a real violation persists, the protected route is the independent directors and, for genuine securities-law violations, formal whistleblower channels with your own counsel. Concealment, anonymous posts and leaks are neither protected nor safe.
- Escalate to executive management in writing, with the risk and your recommendation stated plainly.
- If blocked or overruled, escalate to the independent directors — the audit committee or board chair.
- Engage your own counsel (separate from company counsel) when your personal exposure is in play.
- For a genuine securities-law violation that persists, use the protected whistleblower channel (e.g. the SEC) with counsel — retaliation for protected reporting is itself unlawful.
- I know the independent-director escalation path and have used it when management blocked a material risk
- I never agreed to conceal a breach or mislead a regulator (the Uber fact pattern); disclosures go through proper channels with counsel
- I did not route attacker payments or NDAs to make an incident disappear
- Protected reporting, where used, went through the lawful channel — not an anonymous post or a leak
06Personal documentation hygiene
The record that shows you raised the risk is usually your friend — the danger is silence, destruction or alteration. Keep factual, dated records; involve counsel where legal advice genuinely needs privilege; and never spoliate.
- My escalations and recommendations are recorded contemporaneously, factually and dated
- Genuine legal-strategy discussions are routed through counsel for privilege (a "privileged" label alone does not create it)
- I have not deleted, altered or backdated records, and I honor any litigation hold
- I keep no contradictory "private" set of notes that undercuts the official record
- Records are retained per the retention/legal-hold policy, not destroyed on an ad hoc basis
- I retain my own dated copies of key artifacts (escalations, attestations, sign-offs, coverage) in case my conduct is later questioned