CISO Accountability: What the Rules Actually Put on the Role

In short: "CISO accountability" means two different things that get conflated constantly. In the US, the SEC's disclosure rule requires a public company to describe who inside it assesses and manages cybersecurity risk and how that reaches the board, an accountability obligation that runs to the company, not a named individual. In the EU, NIS2 goes further and puts legal liability for cybersecurity governance on the management body itself, again not a named CISO. What neither rule fixes is the gap 2026 survey data keeps finding: security leaders report being held responsible for outcomes they do not have the budget, staff or authority to fully control.

Three different things hide under one word

"Accountability" gets used for at least three separate ideas, and most confusion about the CISO's exposure comes from treating them as one.

The first is disclosure accountability: a legal requirement that a company name, in a public filing, which role or committee handles a risk and how that information reaches the board. The second is personal liability: whether an individual can be sued or prosecuted over how a risk was handled, a much narrower and rarer question covered in detail in CISO Tribune's guide to CISO personal liability, which found that the two cases most often cited for it, SEC v. SolarWinds and the Uber prosecution of Joe Sullivan, resulted in a full dismissal and a probation sentence for obstruction, not a precedent that a CISO is liable for how a breach was disclosed. The third is authority: whether the person held accountable actually has the budget, staff and decision rights to manage the risk they are accountable for. The first two are legal questions with texts that can be read. The third is a management and resourcing question, and it is the one the 2026 data below says is still unresolved.

What the SEC actually requires: a description, not a name

Item 106 of Regulation S-K, which took effect for annual reports covering fiscal years ending on or after December 15, 2023, is the rule usually cited when people talk about CISO accountability in US public companies. Its governance paragraph requires a company to describe, per the SEC's own compliance guide, "the board of directors' oversight of risks from cybersecurity threats" and "management's role in assessing and managing material risks from cybersecurity threats." In practice, that means naming which positions or committees handle the risk, describing their relevant expertise in enough detail to be meaningful, and stating whether they report to the board or a board committee.

What the rule does not do is name an individual or create a new personal duty. It is a disclosure rule aimed at investors, telling them whether a company has a credible structure for managing cyber risk and whether the board is informed. CISO Tribune's review of 22 companies' own Form 10-K filings found only one that named its sitting CISO in the filing itself; most describe a role and a reporting line without naming who holds it. The accountability the rule creates sits with the company's disclosure, not with the person in the seat. For the separate rule on disclosing an actual incident once it happens, see CISO Tribune's guide to the SEC's cybersecurity disclosure rules.

The EU rule that actually does reach individuals, just not the CISO

NIS2, the EU's cybersecurity directive, takes a different approach, and it is the sharper of the two for anyone asking where real legal exposure sits. Article 20 of the directive, in the EU's own text, requires that member states "ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21," that those bodies "oversee its implementation," and that they "can be held liable for infringements by the entities of that Article." The same article requires that "members of the management bodies of essential and important entities are required to follow training" so they have "sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices."

Read that text closely and the target becomes clear: it is the management body, the board or equivalent governing body of the company, not a named security executive. NIS2 does not require that a CISO exist, and it names no security role at all. What it does is make a senior security function that can brief the board credibly a practical necessity, since someone has to prepare the risk assessments and recommendations a now-liable management body is required to approve and oversee. A CISO under NIS2 is accountable to the board that carries the legal exposure, which is a different position than carrying that exposure personally.

The gap the law doesn't touch: accountability without matching authority

Neither rule above resolves the question security leaders raise most often: being treated as responsible for an outcome without being given the resources or standing to control it. Proofpoint's 2026 Voice of the CISO report, published September 9, 2026 from interviews with more than 1,600 CISOs across 16 countries, found that 77% say excessive expectations are placed on them. That is not a liability statistic; it is a mismatch statistic, describing a role where the expectations attached to the seat have grown faster than the authority that comes with it.

Oxford Economics and Splunk's 2026 CISO Report, based on 650 CISOs surveyed in mid-2025 and published July 16, 2026, frames the same pressure differently: it describes CISOs as "forging joint accountability with C-suite peers" rather than holding the risk alone, alongside "mounting personal liability for security incidents" as part of a role description the report says is still expanding. Read together with the actual legal texts above, the picture is consistent: the law puts formal accountability on the company and, in the EU, on its board; the lived experience CISOs report is a role where that formal structure has not yet caught up to how much personal and professional risk the job carries day to day.

How companies are responding, separate from what the law requires

One visible response is insurance, not governance reform. Gartner's March 2024 cybersecurity predictions, as reported at the time, forecast that "by 2027, two-thirds of global 100 organizations will extend directors and officers (D&O) insurance" to cybersecurity leaders, tying the trend directly to "new laws and regulations" such as "the SEC's cybersecurity disclosure and reporting rules" that "expose cybersecurity leaders to personal liability." Gartner's own recommendation was for organizations to consider D&O coverage and other compensation specifically "to mitigate personal liability, professional risk and legal expenses."

That is a useful data point for anyone evaluating a CISO offer or renegotiating their own terms, but it is worth being precise about what it is: a financial backstop companies are extending in response to a liability question, not evidence that the underlying legal exposure described above has actually expanded. The SEC's rule still runs to the company's disclosure, and NIS2's liability still targets the management body. What has changed is that boards appear to be treating the perception of personal exposure, whether or not it holds up as described in CISO Tribune's guide to CISO personal liability, as real enough to insure against.

What this means for a CISO evaluating their own accountability

Three things separate what the rules put on the role from what a specific company puts on a specific person, and they are worth checking directly rather than assumed. First, read the company's own board-reporting structure: CISO Tribune's board committee oversight report and the filing-level detail in the disclosures library show, company by company, which committee a security function actually reports to and what its proxy statement says oversees it, since that reporting line is what Item 106 and, for EU-headquartered entities, NIS2's Article 20 actually require to exist. Second, ask directly whether D&O coverage or an equivalent extends to the security role, given Gartner's prediction that this is becoming the norm rather than the exception. Third, treat "accountable" and "personally liable" as different words with different evidence behind them: the case law so far, read in full in CISO Tribune's personal liability guide, has not produced a finding of personal liability against a CISO for how a breach was disclosed, even though the disclosure rules that make accountability visible have been in force since 2023.

What this guide does not cover

This guide covers what two specific, currently effective rules say about accountability, plus what 2026 survey data shows about the authority gap around the role; it does not catalogue every national cybersecurity law with a governance provision, and it is not legal advice for any specific company's structure or filing obligations. A security leader with a real question about their own company's exposure, or the seat left open by someone who has recently left, is better served checking CISO Tribune's tracked open seats and their own company's governing documents than a general guide. Figures from the surveys cited above are theirs, not CISO Tribune's, and are attributed by name throughout.