Your Name Is on the Risk Register. The Decision Wasn’t Yours. 

Cybersecurity gave one person responsibility for the whole and almost none of the authority. That isn’t unfair. It’s badly designed.

I've watched CISOs sign off risk acceptances for decisions they argued against and lost. It usually goes something like this…

They've spent months warning that something needs to change. Nobody really disagrees. But there's a release date to meet, and delaying it will cost money. The cyber risk is harder to quantify. Something could go badly wrong, or nothing might happen at all.

So, the business decides to press ahead. And who gets asked to sign off the risk?

You guessed it, the CISO. The very person who argued against taking it.

So, what do they do? They approve it. Let's face it, what else are they going to do?

But that approval is doing something strange. It looks like authority, when it's actually the opposite. It's the record of a decision made by somebody else, signed off by the person who will carry the can if it goes wrong.

You see, assessing risk is the CISO's job. Accepting it on behalf of the business is somebody else's, and it should be. An executive who takes a risk with their eyes open, for reasons they can defend, is doing their job rather than failing at it.

The problem arises when those two responsibilities become confused. The assessment and the acceptance end up recorded against the same person, while the executive who actually made the decision is nowhere to be seen.

And that's assuming the cybersecurity team was consulted in the first place. Increasingly, decisions about technology, suppliers and AI are being made elsewhere in the business, sometimes before the cybersecurity team even knows about them. Yet the accountability still finds its way back to the CISO.

This isn't about defending CISOs who want more power. It's about questioning why we've made people accountable for decisions they don't control. Plenty of CISOs are well supported. Others aren't. The problem is how the role has evolved, with responsibilities accumulating without the authority needed to discharge them.

A year on from the most expensive attack in British history

Last autumn I wrote about the Jaguar Land Rover cyberattack and the government loan guarantee that followed, and argued that underwriting the consequences of an attack sets a precedent we haven't thought through.

A year on, the figures are larger than the early estimates. The Cyber Monitoring Centre put the cost to the UK economy at around £1.9 billion, making it one of the most financially damaging cyber incidents recorded in the UK. Production stopped for weeks. The Bank of England cited it as a factor in slower growth. The government guaranteed a £1.5 billion loan to hold the supply chain together.

So, let's ask the question a public inquiry asks about a bridge, an aircraft or a hospital. Not who did it, because we know roughly who did it and a criminal investigation continues. The other one. Which professional judgements were wrong, who made them, and what happens to those people now?

I can't answer it, and neither can you. There may well have been internal reviews, insurer assessments and some very uncomfortable board meetings, and any of those could have examined whether the decisions were reasonable. None of it is public, and nothing in the public record tells us which risks had been identified, who had the authority to act on them, or what happened to any objection that was raised.

I'm not suggesting anybody was negligent. I’ve no basis for that and neither does anyone else that I know of. What interests me is the asymmetry. You see, we can cost the economic damage of a cyberattack to the nearest hundred million pounds, euros or dollars but we know hardly anything about the decisions that shaped it.

We measure the consequences but we rarely get to examine the choices.

Now I'm not calling for heads here. I’m pointing at a vacuum.

The seal, and what it was actually for

In an earlier blog in this series I wrote about the professional seal in civil engineering. When a licensed civil engineer applies it they take responsibility for the work, and that responsibility can't be handed on.

What matters isn't the punishment at the end of it. It's what the seal does.

If your name goes on the whole thing, and it can't be delegated away, then you need the standing to refuse. Not to be difficult, but because a signature is pointless if the person signing can be overruled by someone whose name isn't on it. The seal exists to make a professional judgement expensive to override.

You see, a seal doesn't hand a civil engineer control of the project. It's bounded by scope and jurisdiction, and the client still decides the budget, the programme and whether the building gets built at all.

So, the cyber equivalent is not that the CISO should control commercial decisions. It's that when a material cybersecurity judgement is overridden, what should the organisation have to do first?

Now let's put the two side by side. Remember Jack Gillum who I wrote about before? He had the authority, didn't exercise it, and was held responsible for the whole anyway. A CISO is held responsible for the whole and doesn't have the authority.

It's the seal without the sealing power.

And that’s the accountability gap.

What happened when the law tried

Cyber accountability is getting tighter, but what I question is whether responsibility is really shifting. Let's look at two landmark cases.

Joe Sullivan, Uber's former security chief, was convicted of obstruction and misprision over the handling of the 2016 breach, and the Ninth Circuit upheld it in March 2025. The SEC charged SolarWinds and its CISO Tim Brown over what the company had said publicly about its cybersecurity, the first time it had brought a cyber enforcement action against an individual CISO. Most of that was thrown out in 2024, and in November 2025 the SEC dismissed what remained, with prejudice and no settlement.

Now notice what they were about. Joe Sullivan was convicted for concealment but Tim Brown was charged over statements. Neither case turned on a cybersecurity decision, and neither asked whether a professional judgement about risk had been defensible.

That isn't a criticism of either court, and it’s not a claim that anybody can ever assess a cybersecurity decision. A civil negligence claim does exactly that, with expert evidence and a standard of reasonable practice to measure against. However, what doesn't exist is a professional route with any force behind it. Nothing that works the way a medical or engineering regulator works, and no obligation standing behind a practitioner on the day they refuse.

So a CISO can face serious exposure for what they say about a breach, and almost none, professionally, for the judgements that led to it. It’s the worst of both worlds, with exposure that doesn't improve standards, and discourages the very honesty that might prevent the next failure.

In the UK, we have the UK Cyber Security Council, which has built professional titles and registration pathways, and peers spent part of September's committee stage debating whether it should have statutory functions, through the Cyber Security and Resilience Bill, which is good and tells you the question is live. But registration is not a license, and when the UK government set up the Council it was explicit that "we are not proposing a licence to practice regime." Nobody can be removed from a register nobody has to be on. You cannot be struck off cybersecurity.

And there's another side to professional regulation that's rarely discussed: the protection it can give practitioners who stand by their judgement.

A doctor who refuses to discharge a patient has a professional obligation standing behind them. A civil engineer who won't seal a drawing has the same. Not immunity, as plenty of doctors and civil engineers have been punished by employers for refusing, and whistleblowing cases are full of them. But the refusal is in something outside the employment relationship, which means it has to be answered rather than absorbed.

A CISO who says "no" has their judgement, their reputation and their salaru on the line.

UK Parliament looked at exactly this

Remember the scrutiny TalkTalk's CEO faced over its widely criticised response to the 2015 data breach? I do.

A decade later, during a September 2026 debate on the UK's Cyber Security and Resilience Bill, that same CEO, now Baroness Harding of Winscombe, made a striking observation:

"All the incentives for you, as a corporate leader, are not to say anything."

She was arguing for mandatory staged reporting, drawing directly on her experience at TalkTalk. And she has a point. When speaking up brings scrutiny and potential liability, silence can start to look like the safer option.

During the same debate, peers considered amendments to make senior executives more personally accountable for cybersecurity. They weren't adopted. Instead, the UK Government pointed to proposed fines of up to £17 million or 4% of global turnover and board-level governance requirements to follow through secondary legislation. The Bill is still progressing through Parliament, so none of this is law yet, but here's the problem.

Personal liability without personal authority could make things worse. You get all the exposure, none of the professional standing to challenge the decision, and another reason for capable people to think twice about taking the job.

The EU has gone a little further under NIS2, where management bodies must approve and oversee cyber risk measures, though how far that reaches individuals varies by member state, and let's face it, some member states still haven't fully transposed the Directive, two years after the deadline.

None of this means directors and executives escape accountability. Under the UK's Companies Act 2006, directors already have a duty to exercise reasonable care, skill and diligence, which includes how they oversee material cyber risks. The UK's NIS Regulations 2018 place cybersecurity obligations on certain essential services and digital providers. And in regulated sectors, the UK's SM&CR, the EU's DORA and NIS2 go further in different ways, placing specific responsibilities on senior leaders or management bodies.

Yet assigning responsibility in law doesn't necessarily mean the right people have the information, authority or mechanisms to make the decisions that matter. A board can be accountable for oversight while the CISO lacks the standing to challenge a commercial decision. Both can be fulfilling their formal roles while the organisation remains exposed.

That's the gap I'm interested in. Not whether somebody can be held responsible after an incident, but whether accountability has been designed into the decisions that precede it.

Regulation can establish who is accountable, blame. It cannot, by itself, ensure that professional judgement is heard, that authority is exercised or that the right decisions are made in time. That has to be designed into the organisation. And it's within the power of every board and executive team to do it.

Where the engineering comparison breaks

My father hasn’t yet read my engineering blogs, but I know he’d pick me up on something about this engineering comparison, and he'd be right.

No single civil engineer understands every part of a complex building, nor would anyone expect them to. Different disciplines contribute, with defined responsibilities and processes for coordinating their work. The integrity of the whole cannot depend on one person's judgement.

But complexity isn't where the comparison breaks.

Pace and adversarial pressure are much bigger differences. An enterprise changes constantly. New systems, suppliers, integrations and now AI agents introduce risks faster than traditional governance processes can assess them. And unlike a building, a digital environment has adversaries actively looking for weaknesses.

Expecting a CISO to own the consequences of decisions made across all those moving parts, without the authority to influence them, isn't rigorous governance. It's wishful thinking.

But giving CISOs the equivalent of a civil engineer's seal wouldn't solve this. We'd still have to work out who makes the decisions, who can challenge them, and who owns the consequences.

And organisations don't need to wait for the profession or the law to change before addressing that. There are practical things they can do now.

What it should take to overrule a cybersecurity objection

I've never thought the answer was giving cybersecurity a veto, and the people asking for one usually haven't thought through what it would do to their relationship with the business. But three things are needed, and none of them require more regulation.

A professional judgement should have standing. This means it gets recorded as an assessment rather than an opinion, in terms that survive the meeting, and it travels with the decision rather than staying in the risk function. The difference between "cybersecurity had concerns" and a documented professional judgement about likelihood and consequence is the difference between something you can overrule by changing the subject and something you have to answer.

An override should have a name on it. Whoever makes the commercial call signs for it. Not countersigns, not notes it, not asks the CISO to log it as accepted. If the decision is defensible, and it often is, then signing it doesn’t cost anything. If nobody will put their name to it, then that tells you something before the cyber incident rather than after.

Now, that isn't the same as insisting one person holds everything. A COO can legitimately carry an operational risk that a CFO created by declining to fund something, and neither of them is doing anything wrong. Decision authority and risk ownership can sit in different places. What they can't do is sit nowhere, which is what a register tells you when it names the person who advised against the decision and nobody else.

A disagreement should have somewhere to go. A route that doesn't depend on the CISO's personal relationship with the CEO, because personal influence isn't a control. It's a bit of luck that varies with whoever currently holds both jobs.

And the obligation runs both ways, which is the part cybersecurity is less keen to hear. Standing is earned by the quality of the judgement, not conferred by the job title. "We're not comfortable with this" isn't a professional judgement.

A professional judgement says what the consequence would be, how likely it is, what's genuinely uncertain, and what decision is being asked for - delay it, put a compensating control in, or proceed with a defined recovery capability, and here is what each costs you. That’s something an executive can weigh up, and it's much harder to overrule by changing the subject.

But none of this makes cybersecurity right. Cybersecurity is sometimes wrong, sometimes expensively wrong, and a business that never overrides its cybersecurity function would be badly run. The question isn't whether a professional judgement can be overruled. It's whether it can be overruled casually, invisibly, and without anybody owning it.

Overruling a cybersecurity objection ought to be something a person decides. Too often it's just what happens.

Why this is the Authority layer

So, does a CISO have the authority to match their accountability? Usually, they don’t, and the mismatch is structural rather than accidental. You see, nobody designed it that way. It accumulated much like the fragmented car park payment systems I described in the first blog in this series with one locally sensible decision at a time, until the whole stopped working as intended.

Think about the first few minutes of a serious cyber incident. The CISO knows a system needs to be isolated to contain the attack, but doesn't have the authority to take it offline. The operations executive has that authority but needs to understand the consequences.

Nobody is behaving badly. They're each doing the job they've been given. Meanwhile, the attacker isn't waiting for them to agree. The options are closing while they talk. What might have been a manageable incident becomes a major disruption.

Professional judgement identifies what's at risk. But knowing what needs to happen isn't the same as having the authority to make it happen. If nobody has agreed who can take a critical system offline, that decision has to be negotiated while the attack is unfolding.

And while they're negotiating, the options are closing.

One thing worth doing

Take three risks on your register with your name against them.

For each, ask who actually controls the decision. Who decides whether to fund the fix, delay the release, keep the supplier or retire the system? And does the recorded accountability reflect where that authority sits?

If it doesn't, you've found the design fault. The next conversation isn't about accepting the risk. It's about who should be signing for it.

And if you're reading this from the boardroom, run the exercise backwards. Take the last three times cybersecurity raised a material objection and the business proceeded anyway. Who made the decision? Is their name recorded? Could you explain today why it was reasonable at the time?

If you can't, the gap isn't in your risk register. It's in how your organisation makes up its mind.

Accountability shouldn't begin when something goes wrong. It should begin when somebody decides to proceed.

Now I want to hear from you…

In a well-designed organisation, what should it actually cost to overrule a security objection? Tell me in the comments, over on LinkedIn where I'll be waiting for you there.