Why Management Owns the Risk

A 150-person distributor loses its order system to ransomware on a Tuesday. By Wednesday the owner is not asking which antivirus product failed. She is asking how long until trucks roll, whether customer data left the building, who has to be told, what the insurer will pay and whether anyone should have seen this coming. Every one of those questions is a management question. The IT manager can answer part of the first. The rest belongs to the people who run the company.

This lesson sets up the frame for the other twelve: what the words mean, what the problem costs, where management's liability comes from, and who does what. It is written for owners, general managers, finance and HR leads, operations managers and board members at businesses of roughly 10 to 500 employees. For the hands-on steps, this course links to the sibling modules instead of repeating them: Securing Your Small Business Data and Systems covers the how-to for accounts, backups and email, and Securing Your Home Computer, Phone and Money covers personal devices. The privacy and data security laws that protect the general public are in Privacy and Data Security Laws. This course takes the business side of those same laws.

Three words people use as if they were one

Boards hear "privacy," "security" and "compliance" in the same sentence and assume one team handles all three. They are different jobs, and mixing them up is how gaps open.

Term	The question it answers	Typical owner	Evidence an auditor wants
Information security	Can only the right people and systems reach this data, is it accurate, and is it available when needed?	Security lead, IT provider	Access reviews, patch reports, backup restore tests, incident logs
Privacy	Should we have this personal data at all, did we tell people what we do with it, and did we honor their choices?	Privacy lead, often HR, marketing or operations	Data inventory, notices, consent records, retention schedule, requests log
Compliance	Which specific rules bind us, and can we prove we met them?	Finance, HR or an operations manager, with the security and privacy leads	A rule-by-rule register with owners, dates and artifacts
Risk management	What could hurt us, how likely is it, what would it cost, and what are we doing about it?	Executive team, with the board over it	Risk register, sign-offs, board minutes

Security is the one most people picture, because it has products you can buy. Privacy gets forgotten until a customer asks to delete their data or a state attorney general sends a letter. Compliance is the paperwork layer, and it can be fully satisfied while real security is poor. A company can pass a questionnaire with a policy it never follows. The reverse also happens: a business with excellent security can still break a privacy law by collecting more than it told people it would.

The simplest test of which one you are looking at: security fails when someone unauthorized gets in. Privacy fails when you misuse data you were allowed to hold. Compliance fails when you cannot show your work.

What failure costs, and what the numbers cannot tell you

Three sources give most of the figures executives see. Each measures something different, and none is a forecast for one firm.

Source and year	Figure (as of October 2026)	What it measures
IBM and Ponemon, Cost of a Data Breach Report 2026	$4.99 million global average cost, up 12 percent from the prior year, a record	Costs reported by organizations that had a breach, including detection, response, lost business and fines
Same report, as summarized by a trade publication	$11.5 million U.S. average; 247 days to identify and contain; 55 percent of breaches malicious; phishing the most common starting point for the fourth year in a row	IBM's own page confirmed the $4.99 million figure and the 12 percent rise. The U.S. figure, the 247 days, the 55 percent and the phishing finding were read in trade-press summaries of the report (eSecurityPlanet and Baker Donelson) and should be checked against the full report before you quote them to a board.
Verizon, 2026 Data Breach Investigations Report	More than 31,000 incidents and over 22,000 confirmed breaches analyzed in 145 countries; ransomware in 48 percent of breaches; third parties in 48 percent, up from 30 percent; exploited vulnerabilities the top way in at 31 percent; human involvement in 62 percent	Incidents from November 1, 2024 to October 31, 2025. Verizon's own page confirmed the 48 percent ransomware and 31 percent vulnerability figures and the reporting period. The incident counts, the 145 countries, the 62 percent human involvement and the third-party rise from 30 to 48 percent were read in trade-press summaries of the report and should be checked in the full report.
FBI Internet Crime Complaint Center (IC3), 2025 report	1,008,597 complaints; $20.877 billion in reported losses; business email compromise 24,768 complaints and $3.05 billion; ransomware 3,611 complaints; phishing and spoofing 191,561 complaints	Complaints that victims chose to file. Under-reported by nature.

Read these with care.

• Averages hide the shape. A few enormous breaches pull the mean up. The typical small firm's loss is often far below $4.99 million, and the worst case is far above it. Verizon's 2026 Breach Impact Study, cited in its small business infographic, found that in extreme cases, the top 2.5 percent, a breach's financial loss exceeded 7 percent of an SMB's revenue. A 7 percent revenue hit ends many 100-person companies.
• IC3 counts what was reported. The business email compromise number, $3.05 billion on 24,768 complaints, works out to about $123,000 per complaint (3,046,598,558 divided by 24,768). That is the average of victims who reported, not a promise about your next wire request.
• Third-party involvement is rising. Verizon reports third parties in 48 percent of breaches, up from 30 percent. Your vendors are part of your attack surface. Lesson 09 covers vendor contracts and review.
• Speed matters more than most budgets admit. IBM's summary figure of 247 days to identify and contain, and a cost gap between breaches that run past 200 days and faster ones, means detection is a financial control, not just a technical one. Lesson 11 covers detection and response.

Where management's liability comes from

"Who is liable" has no single answer. The company is the usual defendant, but the pressure reaches owners and executives through several doors at once.

Source of liability	Who enforces	What triggers it	Where this course covers it
FTC Act section 5	Federal Trade Commission	Deceptive statements about security or privacy, or unfair security practices that injure consumers	This lesson; Lesson 06
Sector federal laws (financial customer data, health data, children's data)	FTC, HHS Office for Civil Rights, other agencies	Failing a written rule such as the Safeguards Rule or the HIPAA Security Rule	Lesson 06
State breach notice and data security laws	State attorneys general, sometimes private plaintiffs	Late or missing notice; no reasonable safeguards	Lesson 07
Contracts: customers, card brands, lenders, insurers	The counterparty, by termination, fees or denied claims	Breaking a security clause, a PCI DSS obligation or a policy warranty	Lessons 05, 09, 12
Private lawsuits	Affected customers, employees, and sometimes shareholders	Negligence theories, statutory damages where a law provides them	Lessons 07, 08
Corporate fiduciary duties	Shareholders, through derivative suits	Directors or officers who ignored a mission-critical risk	This lesson
Securities law (public companies only)	Securities and Exchange Commission	Failing to disclose a material incident or to describe governance	Lesson 06

The FTC Act and the unfair or deceptive theory

The Federal Trade Commission Act, at 15 U.S.C. 45(a)(1), declares "unfair or deceptive acts or practices in or affecting commerce" unlawful. Subsection (a)(2) directs the Commission to prevent businesses from using them, and it carves out entities that have their own regulators, such as banks and certain common carriers. For most small and mid-sized private companies, the FTC is the federal agency that can come calling about data practices, even if no specific privacy statute applies to your industry.

The FTC works from deception and from unfairness.

• Deception. You told customers something false or misleading about security or privacy. A website that says "your data is encrypted and never shared" when it is neither is the classic case. The promise can sit in a privacy policy, a sales deck, a security questionnaire or an advertisement.
• Unfairness. Section 45(n) says the Commission cannot declare a practice unfair unless it "causes or is likely to cause substantial injury to consumers" that consumers cannot reasonably avoid, and the injury is not outweighed by benefits to consumers or competition. Weak security that exposes consumers' sensitive data can meet that test even if you never made a promise.

Whether the FTC could use unfairness against data security was tested in FTC v. Wyndham Worldwide Corp., No. 14-3514 (3d Cir. Aug. 24, 2015). Hackers had reached the hotel company's systems three times, in April 2008, March 2009 and late 2009, and took payment card data for over 619,000 consumers, with at least $10.6 million in fraud loss. The Third Circuit held that the FTC may use the unfairness prong of section 5 against a company's cybersecurity, and it rejected the argument that Wyndham lacked fair notice. That is one federal appeals court, and it binds the Third Circuit states, but regulators nationwide treat it as settled enough to act on.

What the FTC expects is not secret, even though no rule lists it. The agency's Start with Security guide, drawn from its settlements, gives ten lessons: collect and keep only what you need, limit access, require strong authentication, encrypt, segment and monitor the network, secure remote access, build security into products, put security terms in vendor contracts and check them, patch third-party software, and protect paper and devices. The FTC's data security page describes "50+ data security settlements" behind that guidance. Compare your program to that list and you have a fair picture of what an FTC investigator would measure.

The reasonable security idea

"Reasonable security" is the standard that keeps appearing, and it deliberately has no fixed definition. Examples in primary text:

• California Civil Code 1798.81.5(b) requires a business that owns, licenses or maintains personal information about a California resident to "implement and maintain reasonable security procedures and practices appropriate to the nature of the information." Subdivision (c) requires the business to put the same duty on outside vendors by contract.
• Texas Business and Commerce Code 521.052(a) says a business "shall implement and maintain reasonable procedures" to protect sensitive personal information it collects or keeps.
• Idaho's breach statute, Idaho Code 28-51-105, sets an investigation and notice duty: a "reasonable and prompt investigation" once a breach is known, then notice "in the most expedient time possible and without unreasonable delay." The sections reviewed for this lesson do not contain a general duty to maintain safeguards. Lesson 07 covers Idaho in detail.

How do you know what is reasonable? Regulators point to published frameworks. A 2016 California Attorney General breach report, as quoted in a Cooley LLP summary (the report text itself was not read for this lesson), said the CIS Critical Security Controls "define a minimum level of information security" and that failing to implement the applicable controls "constitutes a lack of reasonable security." That report is not binding law, but it shows how a regulator thinks. Ohio went further and wrote it into statute. Ohio Revised Code 1354.03 lists frameworks, including the NIST Cybersecurity Framework, CIS Critical Security Controls, the ISO/IEC 27000 family and NIST SP 800-171, that a business can follow to qualify for an affirmative defense under section 1354.02 in tort actions about a data breach. Federal law does something similar for health data: Public Law 116-321 directs HHS to consider whether a covered entity or business associate has shown "recognized security practices" in place for the previous 12 months when it sets fines, audits and settlement terms.

The practical meaning for a manager: pick a recognized framework (Lesson 04 compares them), implement it to a level that fits your size, and keep dated evidence. A program built on a named framework with records behind it is the best answer to "was it reasonable?"

Director and officer oversight, in general terms

Corporate law adds a second layer. This part is general education about Delaware cases, which are widely followed but do not bind every state or every entity type. LLCs, partnerships and corporations organized elsewhere have their own rules, and the operating agreement or bylaws matter.

• The Delaware Supreme Court held in Marchand v. Barnhill (June 18, 2019) that directors must act in good faith to oversee operations, and that bad faith can be shown by an "utter failure to attempt to assure a reasonable information and reporting system exists." Because food safety was "essential and mission critical" to the ice cream maker, the board needed a system to monitor it. The complaint supported an inference that none existed at board level, and that nominal compliance with regulators was not enough. The claim was allowed to proceed.
• In In re McDonald's Corp. Stockholder Derivative Litigation (Del. Ch. 2023), the Court of Chancery held for the first time that officers, like directors, owe a duty of oversight, scaled to their area of responsibility. A CEO's reach is company-wide.
• The cybersecurity version of the claim has so far been hard to win. In the SolarWinds derivative case, Construction Industry Laborers Pension Fund v. Bingle, the Court of Chancery dismissed the complaint because it did not plead bad faith: the committees charged with cyber oversight met and discussed the topic, and the court found no basis to call them sham committees. The court left open whether the oversight duty even covers business risk from third-party cybercrime.

Read together, these cases suggest a modest, workable standard: if a risk can sink the company, the board should have a reporting channel for it, use it on a schedule and leave a record. Whether a given breach would create personal liability depends on facts, state law and the entity's charter, and nothing here predicts an outcome.

Two written rules already require governance evidence from certain businesses. Under the FTC Safeguards Rule, 16 CFR 314.4(i), a covered financial institution must have its Qualified Individual report in writing to its board, "regularly and at least annually," or to a senior officer if there is no board. Institutions that hold customer information on fewer than 5,000 consumers are exempt from that paragraph under 16 CFR 314.6. For public companies, SEC Regulation S-K Item 106(c), adopted in Release 33-11216 and effective September 5, 2023, requires describing the board's oversight of cybersecurity risk and management's role. As of October 2026 the rule is still on the books, but industry groups including SIFMA and the American Bankers Association asked the SEC in an April 10, 2026 letter to rescind Item 106, and the SEC has invited comment on reforming Regulation S-K. Check the current text before relying on it. Lesson 06 covers who those rules reach.

Who does what: roles that every business needs filled

Small companies rarely have a full-time security chief. They still need every role below covered, by a named person, even if one person wears two hats.

Role	What it decides or does	Common small-firm arrangement	Cannot be delegated
Owner or CEO	Sets risk appetite, funds the program, signs risk acceptances	Same person	Accepting risk on behalf of the company
Board or advisory board	Oversees management, asks for regular reporting, reviews appetite	Quarterly agenda item	Oversight itself
Security lead (CISO or equivalent)	Runs the program, tracks risks, reports to management	Operations manager with a security title, or a vCISO	Accountability for reporting honestly
vCISO	Part-time outside leader who builds the program and presents to the board	A few hours a month under contract	The company still owns outcomes
IT provider or managed service provider (MSP)	Operates systems, patches, backs up, monitors	Outside firm or one IT manager	The company still owns the risk the provider manages
Privacy lead	Keeps the data inventory, notices and rights requests	HR, marketing or compliance manager	Honest notices to customers
Data owners	Business heads who say who may use each data set	Finance for payroll data, sales for customer data	Access approvals for their data
HR, finance, operations	Onboarding and offboarding, wire controls, vendor payments	Existing department heads	Following the controls themselves

The arrangements that cause the most trouble are an IT provider treated as the owner of the risk, and a security lead with a title but no authority or budget. The first leaves nobody deciding what the business will accept. The second gives the board a report nobody can act on. A good test: can your security lead tell the owner "no" on a risky request, and does the owner record the override in writing when he overrides?

For the IT provider, put the split in the contract. Lesson 09 in this course lists the clauses. A short list of questions to put to any provider:

Risk appetite and tolerance in dollars and days

NIST's guidance on integrating cybersecurity into enterprise risk management, NIST IR 8286 Rev. 1 (December 2025, replacing the 2020 edition), treats risk appetite and risk tolerance as core inputs to a risk register. The plain version:

• Risk appetite is the broad statement: "We will accept some operational disruption to move fast on new products, but we will not accept loss of customer payment data."
• Risk tolerance is the measurable limit: "No single incident may cost more than $250,000 net of insurance, and order entry may not be down more than 3 days."

The second statement is the one that drives budgets. If the order system's tolerance is 3 days and recovery from backup currently takes 9, there is a gap management can see, price and close. If nobody has written the tolerance down, IT is guessing, and so is the insurer. Lesson 03 shows how to turn tolerance into a risk register, and Lesson 12 turns downtime tolerance into recovery objectives.

The three lines

The Institute of Internal Auditors' Three Lines Model, first published in September 2020 and updated since, separates risk work into roles. In a small business it looks like this.

Line	Role	Small-business version
Governing body	Accountable for oversight and sets direction	Board, or owner plus an outside adviser
First line	Operating managers who own and manage risk day to day	Department heads, IT provider, the people who actually click, approve and configure
Second line	Specialists who advise, monitor and challenge	Security lead, vCISO, privacy lead, compliance manager
Third line	Independent assurance	External assessor, outside auditor, or an internal reviewer who does not report to the team being reviewed

A 40-person company will not have a third line on staff, but it can still buy independence once a year: a penetration test, a framework gap assessment or a SOC 2 audit gives the board a view that did not come from the people who built the controls. The IIA page for the model notes that it has been updated since 2020 and points to a newer statement of position, so check the IIA site for the current text before citing the model in a formal document.

Decision table: who decides what

Decision	Who decides	Who advises	Evidence that it happened
How much loss or downtime the company will tolerate	Owner or board	Security lead, finance	Signed tolerance memo, board minutes
Which framework the program follows	Executive team	Security lead, vCISO	Written program charter that names the framework and version
Whether to accept a known risk rather than fix it	The data or system owner, with owner or CEO approval above a set dollar level	Security lead	Risk acceptance form with expiry date
Which vendors may hold sensitive data	Business owner of the relationship	Security and privacy leads	Vendor register entry and contract review
Whether and when to notify customers or regulators	Executive team under the incident plan	Security lead, forensics provider, the statute text	Incident log with timestamps and the clock calculation
Whether to buy cyber insurance and at what limits	Owner or CFO	Broker, security lead	Policy, application and the signed attestations behind it

Questions and answers

Is privacy the same as security?

No. Security protects data from unauthorized access, change or loss. Privacy covers what you collect, why, how long you keep it and who you share it with. Good security is a precondition for privacy, but a business that over-collects or over-shares has a privacy problem even if no hacker ever touches the data.

Does the FTC have a list of security controls we must follow?

Not for businesses generally. Section 5 prohibits unfair or deceptive practices, and the agency's guidance and settlements show what it looks for. Specific written rules exist for narrower groups, such as the Safeguards Rule for certain financial businesses (16 CFR Part 314). Lesson 06 helps you work out which apply to you.

What does reasonable security mean for a 60-person company?

The statutes say "appropriate to the nature of the information" (California) or "reasonable procedures" (Texas), which scales with the data you hold and your size. In practice, it means a recognized framework applied to your risks, documented. Lesson 04 compares the frameworks and Lesson 02 shows the layers a company your size usually needs.

Can a board member be personally sued after a breach?

Shareholder derivative suits that allege failure of oversight are possible in Delaware corporations. The reported cyber examples, including the SolarWinds case, have been dismissed, in part because boards had committees and briefings in place. Outcomes depend on the facts, the state, the entity type and any charter protections. The practical protection is evidence of regular, informed oversight.

If our IT provider is breached, is that our problem?

Yes, for most purposes. California's section 1798.81.5(c) puts a duty on the business to require vendors, by contract, to keep reasonable security, and breach notice laws generally keep the duty to notify with the data owner. Your vendor may owe you money under the contract, but your customers look to you. Verizon's finding that third parties appear in 48 percent of breaches is why Lesson 09 exists.

Do we need a full-time security person?

Most firms under 500 employees do not. They need a named accountable lead with the authority to report to the owner or board, and often a vCISO for a few hours a month. What they cannot skip is a person who owns the job.

Who should sit on a security steering group?

Owner or CEO, finance, HR, operations, the IT provider's lead and the security lead, meeting quarterly. Keep it a risk meeting and keep the technology talk short.

Are the IBM and Verizon figures good enough to justify a budget request?

They show the direction of the problem. A budget case works best when it uses your own numbers, as in the Harborline example: your revenue per day, your recovery time, your tolerance. Use the published figures as context only and name the source and year.

Hard questions

"A breach is bad luck. Why should the board be blamed for what criminals do?"

Nobody is blamed for the crime. Management is held to account for the controls, the speed of response and the honesty of what it told customers. Courts and regulators ask whether a reasonable business your size would have taken the steps that were available. The Wyndham case involved three separate intrusions between April 2008 and late 2009. The FTC's case was built on the company's own security practices, not on the existence of an attacker.

"We have never been breached, so the spending looks like waste."

Absence of a known incident is weak evidence. IBM's figures put the average time to find and contain a breach at 247 days, which means many firms were breached for months without knowing. The better test is whether you can detect one and recover within your stated tolerance, and whether you can prove it. A tested restore and a written tolerance answer that better than a clean history does.

"Insurance covers us. Why do we need all these controls?"

Insurers now ask for specific controls on the application, and a policy can deny or reduce a claim if the answers were wrong. Coverage also has limits and exclusions, and it pays money, not uptime or reputation. Lesson 12 covers how to read the policy. In short, controls are what make the insurance both obtainable and collectable.

"Frameworks are paperwork. Real security is technical."

Technical controls are the substance, and a framework is how you decide which ones to buy first, confirm none was skipped and show a third party. Ohio's statute and the HHS recognized-practices law both reward documented adherence to a named framework, which is a legal reason to use one.

"This is all educational. Where is the rule that tells us exactly what to do?"

For the narrow groups that have one, the rule is in the text: the Safeguards Rule, the HIPAA Security Rule and the card brands' PCI DSS requirements, covered in Lessons 05 and 06. For everyone else, the standard is reasonableness, and the way to meet it is to follow a recognized framework to fit your size and keep the records. The law's open-ended wording is deliberate. It lets one rule cover a 10-person shop and a 500-person manufacturer, and it puts the burden of showing reasonableness on the business.

Next, Lesson 02 sets out the layers of defense a business your size should expect to have.