Do you think CTOs should be held criminally negligent if they lose data that is of national security concern? Because that’s the only way I see us getting audi

Do you think CTOs should be held criminally negligent if they lose data that is of national security concern? Because that’s the only way I see us getting audited dependencies as a commonality.