FTC Orders Drizly CEO to Implement Security Program
The FTC finalized its order against Drizly and its CEO James Cory Rellas personally for security failures that exposed the personal data of approximately 2.5 million consumers, after first announcing the action in October 2022. The order requires Rellas to implement an information security program for the next ten years at any company that collects data on more than 25,000 individuals where he serves as majority owner, CEO, or a senior officer with security responsibilities. This was a landmark action because it attached compliance obligations directly to an individual executive, not just the corporate entity.
Key Analytics
Impact Analysis
The personal liability precedent fundamentally changes the risk calculus for technology executives and board members. CEOs and CISOs at SaaS companies can no longer treat security programs as purely corporate obligations; individual accountability now follows executives across roles and companies. This enforcement action accelerates the trend toward board-level cybersecurity governance and personal executive accountability.
Recommended Actions
- Brief executive leadership and board members on personal liability exposure under FTC enforcement actions
- Document executive involvement in security program governance decisions to demonstrate due diligence
- Implement a formal information security program with documented executive oversight, annual assessments, and evidence of continuous improvement
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Security program gap assessment against FTC order expectations
- ›Executive oversight documentation and decision records
- ›Board and leadership liability briefing
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 70 to 170 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.