Yes, but rarely for the breach itself. Personal exposure comes from what people said and did around it: misleading security statements, concealing an incident, or a board that never built a reporting system at all. In the EU, NIS2 goes further and makes management bodies directly accountable for approving and overseeing cyber risk measures.
US directors are judged under Delaware's Caremark oversight doctrine. Liability needs bad faith: either the board made no effort to set up a reporting system for a mission-critical risk, or it had one and consciously ignored red flags. Being breached is not enough.
The Court of Chancery applied this to cyber in the SolarWinds derivative suit in 2022 and dismissed it. The board had committees with risk in their remit and received reports; the claim that they should have done more did not reach bad faith. The lesson is not that boards are safe. It is that documented, recurring oversight is the defence, and an empty minute book is the exposure.
| Where exposure comes from | What it looks like |
|---|---|
| Misleading security statements | Public claims about controls that internal reports contradict (SEC v. SolarWinds theory) |
| Concealing an incident | Withholding a breach from a regulator or investigator (Uber CSO conviction) |
| No oversight system | Board never set up cyber reporting for a mission-critical risk (Caremark) |
| Failure to approve and oversee | NIS2 Art. 20 duties on the management body, plus training |
The SEC sued SolarWinds and its CISO in 2023 over public security statements made before the SUNBURST breach. In July 2024 the court threw out most of the case, including the claims about post-incident disclosures and internal accounting controls, and kept only the claims about the pre-breach "Security Statement". In November 2025 the SEC dismissed what remained.
The Uber case went the other way. Its former CSO was criminally convicted in 2022 for concealing a 2016 breach from the FTC while the agency was investigating an earlier one. The difference matters: misstating your controls is a civil-enforcement risk; hiding an incident is a criminal one.
Article 20 of NIS2 (Directive (EU) 2022/2555) requires the management bodies of essential and important entities to approve the cyber risk measures in Article 21, oversee their implementation, and states they can be held liable for infringements. Members must also follow training.
For essential entities, Article 32 lets authorities seek a temporary ban on a person exercising managerial functions. Entity fines under Article 34 reach €10m or 2% of worldwide turnover for essential entities, and €7m or 1.4% for important ones. How personal liability works in practice depends on each Member State's transposition, so read the national law, not just the Directive.
Board reporting, AI governance, DPDP readiness or CMMC. Tell me which and what the constraint is.
me@sarfarazchougule.com →