It would be utterly ridiculous for any person to sign a contract that said "In the event this company gets hacked, you a personally liable." I wouldn't, and you wouldn't either.
If you claim you are responsible for the performance of the company, that goes both ways. You can't claim responsibility ONLY when things go well (and rake in large amounts of cash) and then when things go to shit suddenly act like you had nothing to do with it.
No doubt that CEOs should be held responsible. And here the board would say, yes, that's why we fired him.
No it wouldn't. The current contracts do that. The CEO can basically take huge risks with the company at zero personal risk. If it pans out, he gets a huge bonus, if it fails he bails out with a huge severance package and no personal consequences.
It's the same mechanism that got us into the financial crisis. Executives have every reason to take huge risks and none to play it safe.
Same claim was made before SOX forced attestations.
No, it should read 'if big bad things happen, you pay us the damages'.
The question is simple: Is the CEO (directly or indirectly) responsible for how the company operates ? If (s)he is, then it's fair (s)he gets a decent bonus when the company does well, but that would also mean they are responsible when everything goes south, and then they should pay for the damage. Otherwise they can basically take huge risks with the company in the hope they score a big bonus, and there will be no consequences when it goes tits up.
You cannot only be responsible when things go well, that's not how responsibility works.