CISOs also have indirect obligations that are not always clear but nonetheless must be uncovered and met. These include meeting the general market expectations for organizational security, often based on a general standard of what is considered reasonable. They also have obligations regarding “vicarious liability,” which refers to the organization’s responsibility for the actions or omissions of its employees. If an employee goes rogue and uses his or her work computer to hack someone else, the CISO will, at the very least, have an obligation to aid law enforcement in the investigation. Varying legal obligations also abound around record retention, eDiscovery, and the mountains of data heaped throughout an organization.

All of these obligations churn and compete in the day-to-day affairs of a CISO. Consider the simple requirement under most breach disclosure laws to notify victims within a fixed time period. It seems straightforward to outsiders: notify victims if their data has been exposed. The reality is that it can takes weeks if not months to determine exactly what happened in a breach situation. Given the ephemeral nature of digital evidence, coupled with the fact that cyber crooks have actively tried to cover up their tracks, it’s difficult to know the whole story. But over-notification because you don’t know the whole story could mean unnecessary class-action law suits and bad press. In such a dilemma, it’s difficult to know the right thing to do. Whatever choice you make, it’s going to be painful.

Like most things information security, you can turn to risk as your first, best tool. If things spiral out of control into the worst-case situation, everyone will be looking at your actions. Did you do what was reasonable? Do your actions look good on the six o’clock news? As a CISO, you are in the best position to realize what is at stake with your understanding of technology, security, law, and the business needs.

Your final tool is to be boldly transparent and assertive in your responses to your obligations.

Clearly and consistently describe what you are doing and what you will not be doing in policies, notices, obligations, and internal emails. You should never be passive about claiming your obligations. Keep your stakeholders in the loop and tell them ahead of time of the responsibilities you are accepting. This transparency will attest to your integrity and reasonable due care if things go badly.

In the end, CISOs have many painful, sometimes contradictory obligations. Your choices can be narrowed to only concerning yourself with what is truly at stake and then being open about what you will and will not do. In the end, we all try to do more good than bad.