This is a silly standard that nobody is held to in the real world. Nearly every company can have a breach due to an intern or another employee leaking credentials. There’s nothing the CEO can do about that.

It is often the case after these breaches that HNers start assigning blame in ways that indicate their lack of practical experience in the security world. After 20 years working in security, from startups to fortune 500s, including the most well funded security teams in the world, EVERYONE has stupid password problems in some corners of their company. The password leak was absolutely not the CEOs mistake.