3. If You Don't Have a CISO, You ARE the CISO
In the event of a breach, SOMEONE will be held accountable. Investigations, fines, lawsuits. It's never pretty. If you haven't properly protected your technology (or hired someone to do it), it's YOUR neck on the line.