The CIO should be charged with negligence. This is all avoidable if they company would reroute the C-suite and Executive bonuses into basic IT security services.
Their auditors should also be decertified.