Liability is a backward-looking obligation to answer for conduct or its consequences. In privacy and cybersecurity work, it means being able to account for a decision, action, or failure after it is reviewed by regulators, courts, customers, or internal investigators. It is different from a forward-looking duty: one describes what should be done next, while the other concerns what must be explained later.
In cyber security, liability matters because incidents rarely turn only on technical failure. They also turn on whether an organization can show that it used reasonable controls, followed approved processes, and documented key decisions. Logs, change records, access reviews, and incident notes help demonstrate that care. Poor documentation, vague ownership, or ignored controls can increase exposure after a breach, complaint, or audit. Liability is therefore not just a legal concept; it is a practical reason to make security governance clear, measurable, and provable.