This podcast episode features Mark Rasch, a renowned privacy and cybersecurity attorney, to discuss the SEC’s investigation into the SolarWinds incident and the “Wells notices” it sent to the company’s CISO and CFO. The Wells notices indicate the SEC is conducting a civil investigation of those individuals and they may be facing enforcement actions. The news sent tremors through the CISO community and brought back thoughts of Joe Sullivan’s criminal prosecution — and conviction — for the way he handled a breach while CISO at Uber. The SEC’s action is civil, but it targets certain individuals. We discuss what this means for CISOs, what they can do to protect themselves, and generally how the implementation of cyber governance programs can help protect CISOs by making cyber risk management a responsibility of all officers and directors.