CISO Personal Liability Lab
After SolarWinds and Uber, the accountability is personal. Sit in the chair and make the calls that decide whether you are the officer who raised the alarm or the one left holding it: what you attest, what you escalate to the board, who signs a risk acceptance, how you answer pressure to downplay or conceal, and what D&O coverage and indemnification protect you before a crisis. Each decision shows you why the defensible call is defensible.
Pair this drill with the free CISO Liability & Documentation-Hygiene Checklist — the record that captures the escalations, attestations and sign-offs you practise here. Educational drill, not legal advice.
The real job. More noise, a tighter clock.
You are the CISO, and after SolarWinds and Uber the accountability is personal. Work 10 board-room decisions — make the call that protects you and the company the way a regulator and a court would judge it, then see why. You are graded on how many you get right against the clock.
What this lab is
- A free, browser-based decision drill on INDIVIDUAL CISO accountability after the SolarWinds and Uber cases: work ~14 board-room decisions about what you attest, what you escalate, and what protects you personally as the named security officer.
- The recurring lesson: escalate known material risk on the record, never sign an attestation you cannot stand behind, and make the business own and sign its own risk acceptances — do not absorb them.
- You practise the real traps: pressure to downplay a board slide, a public security claim that outruns reality (SolarWinds), concealing a breach from a regulator (Uber), qualifying an attestation you can only partly support, and the D&O / indemnification asks to make before a crisis.
- Each decision reveals why the defensible answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill — not legal advice. Pair it with the free CISO Liability & Documentation-Hygiene Checklist.
Frequently asked questions
What is the CISO Personal Liability Lab?
A free, in-browser decision simulation that puts you in the security officer’s chair after the SolarWinds and Uber cases made CISO accountability personal. You work through board-room decisions — what to escalate, what to sign, who owns an accepted risk, how to respond to pressure to downplay, and what insurance and indemnification protect you — and each one has a single defensible answer, revealed after you lock in your call.
What actually happened in the SolarWinds and Uber cases?
In October 2023 the SEC charged SolarWinds and its CISO over the company’s cybersecurity disclosures and controls, with the agency focusing on public statements it alleged overstated the company’s security posture (a court later narrowed those claims in 2024). Separately, former Uber CISO Joe Sullivan was convicted in October 2022 of obstruction of justice and misprision of a felony for concealing the company’s 2016 data breach from the FTC — including routing a payment to the attackers through the bug-bounty program and having them sign NDAs. Both are referenced here for orientation, not as legal advice.
Is this legal advice?
No. The lab is an educational drill and the legal and regulatory references are summarised for orientation and can change. The defensible answers describe general, sober practice — not a ruling on your situation. Always confirm current requirements and apply them to your specific facts with qualified counsel.
Who is it for?
CISOs, security leaders, general counsel, CFOs and board directors — anyone who is, or reports to, the named officer accountable for security at a public (or soon-to-be-public) company, and who wants to rehearse the personal-accountability calls before they are real.