Can they keep their CISO out of jail?