In October 2022, a federal jury convicted Joseph Sullivan of obstruction of proceedings of the FTC and misprision of felony in connection with his attempted cover-up of a 2016 hack of Uber. This case left CISOs, directors, and officers across the country wondering how to protect themselves during a security incident while performing their jobs. Companies are looking towards expanding D&O insurance coverage to the CISO, refining IRPs in reaction to the event, and all sorts of other things in reaction to this case.This presentation, however, will cut through the fat to discuss how the Sullivan case unfolded, analyze analogous regulatory activity, and then focus on practical actions attendees can take home.