Employees cannot be individually liable for conduct that leads to a security failure as long as they were acting in the course and scope of their employment. The size or type of the organization is not an issue in employee liability. The chances of liability are remote if the CSO is doing his job. Most claims are based on an allegation of negligence, but the plaintiff must prove that the company did not act as a reasonably prudent company of that size and type would have acted under the circumstances. Most companies that carry insurance for injuries related to security failures will have insurance that covers their employees’ acts.”]
Source: https://www.csoonline.com/article/2119072/john-thompson–avoiding-legal-pitfalls.html