Department of Justice, the Securities Exchange Commission, and a host of other state and federal regulators have initiated criminal and civil investigations into potential misconduct by the “victim” companies and their executives. As a result, Chief Information Security Officers and other members of the company’s information security team increasingly are coming under intense scrutiny, facing legal proceedings, and becoming the targets of regulators, plaintiffs, the press, and even their own company. On one end, security professionals are losing their jobs, reputation, and even their careers, as they are easy and obvious scapegoats. On the other end, federal criminal prosecutors are taking a hard look at whether CISOs or members of their team violated criminal laws, with well-publicized criminal investigations at Yahoo!, Uber, and Equifax, that last of which has already resulted in criminal insider trading charges filed against the deputy Chief Information Officer. In short, the stakes have never been higher. As a result, information security professionals need to become more aware of the personal risks that they face, the legal landscape for incident response and security generally, and how to best protect themselves, their jobs and their careers. In this session, our presenter will draw on his experience representing and advising information security professionals in their personal capacity in connection with large data security events, and offer practical advice on how to keep you and your career protected. • Personal liability risks to information security professionals, both civil and criminal • Involvement in independent investigations, criminal investigations, litigation, and regulatory proceedings • Getting your own personal legal counsel, and how to get the company to pay for it • Risky conduct, common pitfalls, and best practices • Negotiating protections and indemnification during the hiring process