The paper also suggests a potential change to regulation—making individuals within a company responsible for what goes wrong within that company’s IT systems W

The paper also suggests a potential change to regulation—making individuals within a company responsible for what goes wrong within that company’s IT systems We all know how that looks in practice - Experian’s senior management pointing the finger at a single lowly sysadmin. Or VW blaming their emissions scandal on a single engineer. There is one individual responsible: the CEO. That’s why he or she is paid the big bucks. Maybe make all the C-level jointly responsible. They can share cells afterwards.