Personal liability for cyber risk exposure could be a very real possibility for Directors and Officers of companies.  Shareholders want to know that reasonable measures are being taken to protect customer data; and Boards are facing increasing pressure to prepare for worst-case scenarios. Preparing for a cyber incident requires many layers of preparedness that need to be reviewed and continuously improved upon.  There is a legal responsibility for companies to secure the data that they hold on their servers and aside from the adverse effect a cyber event could have on a company’s reputation, there could be legal ramifications and more.   Protecting data is a huge responsibility.