The responsibility for the topic of information security in the company is borne by the management, which is also liable if damage occurs due to negligent handling of the topic of information security. For this reason, many managing directors decide to appoint an external or internal information security officer in order to establish the professional operation of an ISMS and to reduce possible liability risks.