> The reason you need to be careful is that under many jurisdictions, your company is liable for considerable penalties for failing to adequately protect client

> The reason you need to be careful is that under many jurisdictions, your company is liable for considerable penalties for failing to adequately protect client information and you don't want to become a casualty in the fallout that may come about. In the US, at least, proper disclosure of risk to senior leadership is sufficient to protect one's self from personal liability. Make sure you are not committing illegal acts, especially as an officer of the company. If you are not an officer, and you disclaim risk to senior leadership, you should be ok. But, that's not always the case. If you are sufficiently worried, call a lawyer. I have been in a very similar position. Respectable lawyers have no problem spending an hour consulting with potential clients (for free) and will often times give valuable advice, even if they're yet-unretained. I nearly sued a previous employer for firing me (arguably for whistleblowing) after I refused to be silent about illegal skirting of, and leadership's brazen refusal to implement, federally required safeguards for HIPAA, GLBA, SOX, FFEC, etc. In the nine months I spent trying to right their ship, I spent all my social capital accrued at the company - and it started it impact my reputation as a security professional. I wish I had given up (and quit) a lot earlier. Sometimes, the fight is just not worth it. Especially when non-expert execs are micromanaging know-it-alls who can't bear to be corrected by domain experts they've hired.