Law

Law deserves more than the one-block slot I gave it — I'd promote it to a full standalone course, and current events prove why: the two landmark CISO personal-liability cases resolved recently in opposite directions. The SEC's case against SolarWinds and its CISO Tim Brown (targeting him over cyber disclosures) was dismissed with prejudice in November 2025. But Uber CSO Joe Sullivan's conviction for obstruction and misprision over the 2016 breach handling held up. Lesson: securities-law theories against CISOs are getting beaten back, but personal criminal exposure for covering up or mishandling a breach is real. A modern CISO course treats law as self-defense.

Here's the expanded law course for your CISO-MBA.

CISO-MBA COURSE 7 (EXPANDED): LAW FOR SECURITY EXECUTIVES

Module A: The law you operate under - Breach notification: state laws (all 50 US states have them), GDPR's 72-hour rule, SEC's cyber disclosure rules for public companies (4-item 8-K) - Privacy regimes: GDPR, CCPA/CPRA, and whichever regs apply to your target industry — HIPAA (health), GLBA (finance), PCI DSS (contractual, not law, but enforced like it) - Regulatory agencies and what they can do to you: SEC, FTC, state AGs, HHS OCR, EU DPAs - Study method: don't read statutes — read enforcement actions. FTC consent decrees and SEC litigation releases are short, factual, and show exactly what conduct gets punished

Module B: The law of personal exposure (the new stuff) - The two cases every CISO must know cold: Uber (Sullivan — convicted and it stuck; the crime wasn't the breach, it was the concealment) and SolarWinds (Brown — SEC case dismissed, but only after two years and presumably seven figures of personal legal costs) - Practical output: what to demand in your employment contract — indemnification, D&O insurance that explicitly covers you, right to counsel. This is now a standard CISO negotiation item - Privilege basics: how to work with outside counsel during an incident so your forensics are privileged

Module C: Contracts and commercial law - Security clauses in vendor contracts: breach notification terms, liability caps, right to audit - Your own paper: when you buy security products, who bears the loss when they fail - Cyber insurance: what policies actually cover, and how your incident response affects whether they pay out

Module D: Incident law — the 48 hours - When a breach happens, lawyers run the response and you work for them. Know the sequence: outside counsel engaged, privilege established, then investigation - Who you must notify and when; the crimes of timing — notifying too late is itself the violation - Regulatory relations: first contact with a regulator, negotiating exam scope, consent orders

Module E: Governance and fiduciary duty - What a board legally owes shareholders regarding cyber risk, and what you owe the board - Duty of care vs business judgment rule: boards are allowed to accept risk; your job is to make sure they do it knowingly - Documentation: a defensible paper trail of your risk advice. "I advised in writing, they accepted in writing" is the shield

Resources, all free - Harvard Law School Forum on Corporate Governance (corpgov.law.harvard.edu) — superb CISO-relevant analysis, including their December 2025 piece on the SolarWinds dismissal - SEC.gov litigation releases and enforcement actions - IAPP (privacy professionals' org) — free articles and US privacy law maps - FTC enforcement actions (ftc.gov/legal-library) - Krebs on Security and Digital Lawyering newsletters for following cases as they happen

Deliverable (this one matters most) Build your own incident legal playbook: notification decision tree (which breach triggers which law in which jurisdiction and at what deadline), a privilege protocol, a personal-indemnity checklist for your next employment contract, and a one-page memo you'd give a new CEO on day one explaining the legal exposure structure of the company.