{"id":7060,"date":"2024-04-26T10:10:00","date_gmt":"2024-04-26T08:10:00","guid":{"rendered":"https:\/\/defenderbox.de\/?p=7060"},"modified":"2026-03-02T17:50:20","modified_gmt":"2026-03-02T16:50:20","slug":"directors-and-officers-liability","status":"publish","type":"post","link":"https:\/\/defenderbox.de\/en\/geschaeftsfuehrerhaftung\/","title":{"rendered":"Management liable for cyberattacks"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Cyber attacks are a matter for the boss<\/strong><\/h2>\n\n

Managing directors are legally responsible for ensuring that IT and information security is not just treated as an IT issue, but as a business risk. Omitted or inadequate protective measures can lead to personal liability in the event of damage - from financial losses to criminal liability.<\/p>\n\n

If the management level is even aware of the insecure IT environment, there is even a risk of personal liability, at the latest since the new\u00a0NIS-2 Directive<\/a>. However, the obligations of the company and its management in connection with IT security are not regulated centrally by law. Instead, they arise from various regulations and standards, such as the GDPR.<\/p>\n\n

The Management Board is \u00a7 Section 91 (2) AktG<\/a> to take appropriate measures to ensure that developments that could jeopardize the continued existence of the company are identified at an early stage. Furthermore, in most cases, the functionality of the IT systems is necessary to maintain the company's business operations. There is a dual responsibility, so to speak, as to why the IT security<\/a> The core task of the management level is: On the one hand, because the functionality of the IT system must be protected as an operationally necessary component of the company, and on the other hand, because the management must ensure that the company complies with the GDPR and applicable special IT laws as part of its duty of legality.<\/p>\n\n

Did you know that the organizational duties to protect IT systems are not only the responsibility of the member of management directly responsible for IT security, but are shared by all managing directors?<\/p>\n\n

The Executive Board has overall responsibility here. The Executive Board as a collegial body\u00a0must<\/strong>\u00a0make the fundamental decisions as to which precautions and measures are to be taken to protect the IT systems.\u00a0<\/p>\n\n

What can you do?<\/span><\/h3>\n\n

In order to exclude personal liability, there are guidelines and key points that must be observed:<\/p>\n\n