Simply Solving Cyber - Mike Hineline

Welcome to Simply Solving Cyber. I am Aaron Pritz.

And I'm Cody Rivers.

And today we're here with Mike Heinlein, who back in 2021 retired as the CIO at Indiana Public Retirement System. I'm assuming you were taken care of well retiring from a retirement system.

Well, it's, they, it's nice as you leave, they still keep sending you A check.

There you go. It's like you can retire.

Nice deal.

There you go.

You still get a paycheck from the same person.

That's right.

Excellent.

Just not quite as big.

That's fair.

Awesome. So to tee up today's topic, Mike's been doing a lot of kind of personal growth investment and getting involved in, as many do after retiring from executive roles, getting involved in boards. So take us through, Mike, your journey, what you've done to prepare yourself, the boards that you've kind of gotten active with. How you're giving back, where you're giving back, all that good stuff.

Well, one of the things coming from the technology perspective is that if you want to do something new, what's the first thing you do? You go get a certification, you know, take a class, do something like that. I found an organization that's been around for almost 40 years, National Association of Corporate Directors. They're out in Virginia, but they— about a year and a half before COVID they had created a certification program. Because they had identified the fact that they needed to raise the overall education level of all their members. And so went through a program with them, became a certified director. Currently in another course that's a cyber course.

Excellent.

That they have. So I'm picking up another certification to—

So needed. So needed at the board space. Just a huge deficit.

And which is some of our topic for today. And so I've gotten involved with several of them here. Just recently joined the board for the Retired Indiana Public Employees Association. I had been on a board for them that does their insurance trust for about 15 months. Recently joined the Indiana Wesleyan Accelerator board, which they formed when they acquired the 1150 Academy assets. So I've been able to work with that and get those going. So, just touching different places here and there, being able to give back, and allows you to keep your head in it. You're able to keep active and keep doing things.

Awesome.

Well, that's awesome, man. Well, let's start off here. So, give me, for those who are not in the board area, give us a little chat about the board member's traditional role. So, let's talk about the board as a general, and what's the traditional role for a board member?

Well, the biggest thing, whether you're talking about publicly traded, private, or you move into the not-for-profit boards, the responsibility of the board is really to be looking at your strategy. Where are you going, and risk. What, what are the challenges to running your board? They act as advisors to the senior management team, the CEO and the other senior management. And what we've been seeing is that in addition to those roles as fiduciaries, cyber is the topic for today, just seems to be falling in there because it's such an amount of risk and it's changing the risk parameters. So that's one of the main challenges that we've run into. Also in the board space, we've seen a few other things in addition to cyber that's been a challenge, or not so much a challenge, but an attention area is, of course, we hear a lot about in the news these days, the diversity, equity, inclusion. We're trying to broaden the background of everyone that's involved in the boards to bring more diversity and more differences of perspective. Into those boards. We also have ESG, which is the environmental, social, and governance that seems to be moving more and more into the board space. In PERS, my ex-employer is actively— there's been dealing with some legislation in this legislative session about that topic specifically. It's gotten some press. And of course, anybody that's dealing with any place these days is the war for talent. Everybody's trying to find the right people, get them in the right roles, and especially in our IT space.

Yeah, no one's a stranger to that.

No. And so those are really sort of 4 areas that in addition to the more traditional stuff seem to be new focus that have been going on here this last couple of years.

Excellent. All right, great.

So maybe fast forwarding to now, what's changed? And if you look at the last 5 or 10 years, what you mentioned, some of the things DEI, ESG, But specifically pivoting to cyber, what are some of the questions that are coming up? Or you mentioned that you have invested in some cyber training for yourself at the board level. What, what do boards need to be doing or what, what is the focus to drive deeper into that topic?

Well, the main focus is, is that the board traditionally had risk as just part of what they needed to be dealing with. Yeah, but with cyber becoming such a major player, It seems like every quarter we see something new and different that we're reading about, or somebody else has had something else occur to their organization. So it has become even more of an increased attention, just grabbing more attention, and there's more push for it. And especially when you look at the financial impacts that we're seeing, because a board is responsible for assessing risk. Well, one of the majors is financial risk. You see so many organizations these days that they have a breach, they have something that has occurred, a major event, many small and medium-sized organizations, when you look at the statistics, they may not make it out the other side. 2 years past that, you see a lot of companies that if they've had a major hit, they don't exist anymore. Or when you talk about it, and I think I was looking at some of the stats I pulled up, the spending on cyber is projected to be $8 trillion in 2023, growing to over $10 trillion, $10.5 by 2025. That growth line is very high. A lot of organizations, the numbers, you know, 76% of the organizations were targeted by ransomware attacks in '22 based on one study I just looked at. 64% actually got some type of an infection out of that. So some percentage was able to fully defend.

More than a coin flip there.

That's good odds. Exactly, yeah. The bad guys seem to have the benefit of the doubt. For all this stuff.

Well, I always say a lot of times it's like the good guys have to be right every time. The bad guys need to be right one time.

That's exactly.

It's not one out of 1,000. Yeah, it's a successful day.

The same thing with other types. It's not just ransomware stuff, it's not malware. It's the business email compromises. There's another number I saw was 75% of organizations reported an attempt. People had tried to get to them with a BEC attack. So those type things are going on. I actually, just before I came over here today, I saw another stat that I thought was interesting. One healthcare breach that occurred recently, they lost data for about 4.2 million patients. They already have 5 class action lawsuits filed. So that's the type of risks that a board needs to be paying attention to. Yep. And again, the board doesn't solve it.

Yeah.

The board has to make sure that the management team is engaged, is planning, has the resources, and does what they need to do.

Yep. So I had lunch this week with a chief information security officer and new CEO, getting to know the board. And he mentioned that no one on the board currently really has any cyber depth, not a lot of technical experience. We were joking, it's kind of like seeing the interview between the Congress and TikTok folks. It's like, man, I wish somebody could prep them a little bit better. So you're investing in yourself. You're newly retired. You've got gas in the tank. What do you think? Is there a solution with the current board membership or is the fix kind of getting new and kind of this kind of plays into the DEI topic, but what skillset changes or what education changes do you feel like need to happen?

I feel like I'm going to be a lawyer and answer you that. I think it's all of the above.

Yeah.

Yeah.

It depends.

Yeah. And that's the other lawyer term. Yeah, that's right. The idea is, and NACD is pushing this very solidly with all of their membership, is that you have to raise, you know, the— what is it? Rising tide floats all boats. So you have to raise the knowledge about cyber across all board members and board members, and especially in the major organizations, have some very specific certain number of hours every year they have to do training and everything. So we know you're going to see a lot more of that be around cyber topics and that type thing. So you're trying to raise everyone up. We're also seeing that many boards are going, okay, to jumpstart that, I try to find someone with more cyber background and bring them in, whether that's part of their DEI motivations or just general knowledge. The same way a board in many cases might go out and find a retired CFO because they want to strengthen their audit committee, for example, to put more financial resources. And in a publicly traded company, they are required to have CPA type, or that you're actually measured on, do you have that or not? I wouldn't be surprised to see that in the next couple of years. Might even be a requirement. One of the things we've mentioned, or I've talked about before with others, is that SEC just put out in last year, I think it was March, a set of draft, uh, new requirements for the publicly traded companies, the large ones. And it specifically gets into much more transparency and much more visibility about what kind of knowledge your board members have around cyber. So being very specific. And those have been published now. They may actually be put in to be permanent actual rules in April. So it may be happening here very quickly.

Week and a half.

I learned in my Six Sigma days, you can't improve what you don't measure. So I think a lot of that is if you're not going to put some points on the board, you're not going to force the change that we all see and know that needs to be there.

Right. And some of— just a few of the pieces that are in those rules that they've published for in draft, but we fully expect are going to become permanent, is companies will actually be including their board of directors' cyber experience and resumes in some of their public disclosure docs like their Form 10-K. That type of thing. So this is all about transparency to the stockholders or other stakeholders in the organizations. They also have to put their governance methods, their risk analysis management processes in some of their SEC filings. So again, a lot more visibility, not just, yeah, we're covering it, trust us. You've got to prove it. You've got to show it to the public. Other disclosure pieces of any individual incidents that are deemed— and of course, I always hate when any government entity uses the term material. Okay, now somebody define what material.

You ask 10 people, you get 10 answers.

You get 12 answers. Exactly. And So if you have any of those, but they even have another kicker in there that says if you have a cluster of smaller incidents that when you look at them in the aggregate, so a lot of little phishing attacks, you look at those and then they become material and you have to disclose them.

Yeah.

Yeah.

So as a cyber practitioner, how transparent is helpful? I saw a really good reply to a post about this very topic. From somebody on transparency of— I think transparency of experience from a board is one thing. Transparency of gaps is fuel for the attacker. What's the right balance? Because you want to open up and really have some external confirmation, but how do you keep that in the right hands?

Or do you? Well, I think that is one of the challenges, is that the— for most of the folks, if you talk to CISOs or people that are in the space, they're all on edge with this. Yeah. Yeah. Because They want to say the least amount in public that they can because there could be somebody sitting in their basement in some other foreign land that's looking at that and going, oh, well, he made a comment that he thinks he's fairly secure, so let's go prove him wrong. You don't want to draw attention to your organization in any way.

Right. Or on the flip side, here are my gaps that we're working on.

That's right.

Target fodder.

That's exactly. You know, for example, when I was being CIO for, in PERS, we reported to a board we were able to go into executive session when we did briefings on their cyber plan. Yeah, because every other meeting, because we were a government entity, are public meetings. Yeah, but there were certain things that were in the law that said you could go into session so that you didn't give that up.

Yeah. So in that vein, you brought up a good point. So from the board asking questions, what about going up from the company, the executive team to the board, you know, giving some of that common jargon, common vernacular of what to expect. I think sometimes CEOs, if the board does not have cyber knowledge or not have cyber experience, you know, you can get a technical report and not know what you're looking at. So is there any advice on what the boards are asking for and kind of in what language they're wanting to get some of this information from the executive teams?

Well, the first part of this is it's like any of us that dealt with technology. The answer is you can't use jargon. You have to put it in business terms. And if you explain something and you see sort of deer in the headlights look, you know you haven't done your job properly. So that's part of the interaction interaction between the management staff and the board from that perspective. That probably isn't any different in the cyberspace than it is if you're talking financials or you're talking the talent management or any of the other activities. You have to take it down to the point where your audience understands what you're talking about. That is one of the challenges, though, is that in this new heightened awareness world, a board should be asking for more data.

Yep.

More metrics, dashboards, but you have to build them in such a way where it makes sense. It's not something that just says how many APT threats were avoided in this quarter. Well, many board members are going, okay, I can be apt at a lot of things, but I don't know what these are, right? So you've got those kind of challenges. So you have to deal with them. Some of the pieces that I think is the new independence of the boards is important and what they need to be concerned about. With cyber risk is working with their leadership team. And again, they're not responsible for doing this. They're just responsible for looking at it and making sure it's being done, is to look at things like understanding the nature of what's the threats to the organization.

Yeah.

They need to be told, is it because we're in manufacturing or we're in energy or we're in this? What are the attack vectors that are going to be coming in? Where are the things we need to be worried about? And staying up to date somewhat on that cyber threat landscape. And as we know, the people that are doing this full time in our organizations, that's a tough job just for them. So this is a major challenge for them to figure out how do I boil that down to the essence and give it to a board that may meet monthly, quarterly, you know, that kind of thing. So how do you do that?

So company leaders, CISOs, being more clear business terms, concise, measurable metrics. On the board side, how do you avoid being snowed by companies that don't want to fully share the full state with their board? They want to manage the message.

Well, from the board perspective, it's again like everything else. You can get somebody comes in on a new product and says, well, here's all these things and here's all the bells and whistles and everything, but you didn't see the bottom line that you're only making a half percent.

Yeah.

Okay. So that's expertise in the board's hands.

Yeah.

Is that they have to get their base knowledge of the topic to a level where they can absorb and, you know, sort of tell if they're getting blown smoke or not.

Yeah, pull the right threads.

That's exactly— know to do that. And it's not that every board member has to do that. They just have to trust their peers because a board is always a sum of their individual skills. Yeah, that makes a strong board. So they'll have some people that are a little stronger in one thing versus the other and that kind of thing. So they can count on each other, but they also still have to have that basis that they can go, "My gut's just not telling me that I understand this part. So go back and explain it to me again." Yeah.

I like the relying on the peers because I think no one knows it all, even if they claim they do. If they think they know it all, they probably are that guy or that gal on the board.

Amen. Amen.

Exactly. So, you know, another piece they have to deal with is making sure that they've got decent policies and procedures. Again, everybody's busy. Everybody has a lot to do. But the basis of your cyber program in any organization is the policies and procedures. And I was in IT and I hated doing policies and procedures. Oh yeah.

Oh yeah.

50 years of doing that. But as I moved up the food chain, I learned more and more about how critical they were. Because it's your main way of measuring people and letting know what are you supposed to be doing in your role and how do you do that? And then I can measure against that.

The magic word of governance.

Yes.

One thing that I've seen on the corporate side of my career and then on now on the consulting side is totally agree with your comment. Policy and procedures are kind of the backbone of expectations. But I've seen more progress in companies that really focus on the process and the organizational change management and really equipping their people, whether they read or reread the 40-page or hopefully 4-page document. Are there other ways to communicate the how-tos that embeds it into culture versus, hey, we've got all the right documents, we've had somebody review these, externally audited, we're all good. Are you? Are people doing that? Do you have any way of measuring that? So that's been one thing that kind of pushing on with teams to say, are you good on paper? How do you translate that into practice?

Well, and that's when you get into your tabletop exercises, you get into the better organizations I've worked with and seen and talked to will have— you may have someone that, that does server builds, so they've got it documented, they got it down to a procedure. And okay, they basically said, you three that know how to do this aren't here, and you hand it to somebody in another area and let them go through that procedure. They'll always find things, details that aren't there, and that's how you improve your documents. But it is, it's the testing. It's not just an audit, it's when you do your own internal testing. Yeah, of course your auditors will find it for you too. Sure, at different points, but, uh, you need to do that.

I do find it interesting, I think, as soon as boards are more laid back or hands-off, or historically the CPA or the financial partners reports, and there's precedent on data to bring up to show, I think that would be kind of the, the challenges. What are the artifacts that are being presented in these board meetings to the board members? And the board members have to read these artifacts to, to know This is real. This is not real. We have gaps. We need to build a plan for mediation. So I think for me, that's the question I have, is that you've got decades of precedent and things done before on the financial side, but this is a new area, a new talent on the board, and a new request for some of these businesses. So—

And you're right. It's what we're seeing is the need to mature the capabilities of the board.

Yep.

And just like the maturing the capabilities of the organization.

Yeah.

Isn't, you know, a lot of you get to small and medium-sized organizations and it used to be they didn't have anybody that had security as their title. And of course, if it's spread across 5 people, what I've always found is management by committee is that then effectively nobody's in charge of security.

Oh yeah.

And it always seemed like it was the thing that as they got busy, got set to the side and didn't get dealt with. So now this visibility from a board-level perspective coming down through the senior management team all the way into the, to the folks actually responsible for doing the work. They have to understand that this is just as important as closing the books at the end of the quarter. So we've had the maturity in our financial spaces. Yep. For a lot of years with these companies. And part of what I think the SEC and other organizations, NACD, all of them are trying to show is you got to get that same level of maturity and discipline into the cyberspace now because it has become such a fundamental risk to every organization. To your actual survival. Right.

Yeah.

Is that the bad guys are out there and it's a multi-trillion-dollar business. They're making money very well. And as we've— some people have mentioned before, we have to be right every time. They only have to be right once.

Yeah.

Yeah.

So risk appetite, risk tolerance. I know that's— those are great, I guess, 4 words altogether. A lot of times when you ask companies about them, and I'm curious how boards struggle or if they get answers, there's either deer in headlights, crickets, radio silence, or no one wanting to state the risk tolerance. Because I think it's like, well, we're going to say we're not perfect.

Yeah.

What's your viewpoint on, in cyber and in general, on risk tolerance? It's a tough one.

The first time I'd gotten into the executive level and had an organization where we actually sat down with an exercise to say, okay, let's write down on paper what our risk tolerances are.

It's a fun exercise. It's no.

I know that was sarcasm because it is one of those things is it's like, how much is good enough in so many cases? And because now you're talking about, I can do it from a financial perspective, but I can do it also, what is my risk tolerance for what I'll take in the newspaper? Am I willing to— I can't be mentioned even because we believe our credibility as an organization because we're in the financial services area or whatever, is that our risk tolerance is very low. Go against our reputation. You get into physical risk. I mean, there's so many different— it's not even like a 6 or 8-sided device. It's 15 or 20 different dimensions you're trying to think about when you're doing risk tolerance and literally saying this much is good enough. Because it really comes down to when you've got risk and you're looking against, I've got this measurement, this risk tolerance, management and a board is making a decision is that once I understand what that risk is, I've only got like 4 options. I can say, I'm going to remove the risk. I'll put something in place that takes it away. And that costs money, time, resources, people, all that kind of thing. So that has to be worth the value. I can mitigate the risk. I can put something in place to say, okay, I'm going to take it from it's a 50/50 shot down to it's a 1 in 100. And then I think I can absorb that risk. That's within my tolerance. I can sit there, I can share the risk. This is where we get into cyber insurance and things like that. And then you get to the last one where, hey, this is an important product. I think it's going to make or break my company. And if I do it completely secure, it's going to cost me twice as much that I'll ever make. I'm going to accept the risk.

I love that you said share the risk versus transfer the risk, which is one of the— I think that's in some of the actual frameworks and things, transfer. And I never really found a good case where there was a true transfer. You'll hear some executives saying, we transfer that risk, we're using an external cloud provider, we push that out to a vendor. Well, who owns it? Oh, it's still the company that's performing that. So I like the term share because you can federate that risk, but transfer to me sounds like it's gone.

Yeah, to your point, when Netflix goes down, I don't call AWS and ask why Netflix is down. I'm calling Netflix, why are you down?

Right, exactly. And the other half of it is that in many cases with insurance, it's You're just absorbing— they're covering some of your financial loss.

Yes.

Your credibility, your reputation risk. They don't do anything with that. Yeah. So you're never able to share that portion.

That's a great point.

And I think if you talk to anyone that's ever had to use their cyber policy, they'll always talk about share. They're not— even if they originally were thinking transfer, they've lived through that and they've got the cuts and bruises to show for it.

Yeah. So on incident response, have you been involved at a board level in any incident response exercises, or what are your thoughts on the role board should play in those exercises?

Good question.

I think you need to do them. Unfortunately, I think if we look at some of the stats, we need to make sure that the businesses and the operational people are doing them first. Yeah, first.

Yeah.

And then you can build some that then involve your board because having written incident response plans for years, we would have pieces in there that say, okay, at this point we're going to notify the CEO. At this point, the chief marketing officer is going to get engaged or whatever. And they'd have a list of tasks, and one of theirs was to keep the board in the loop. But again, with all this new visibility, now the rule is that threshold is much lower and the board has to be brought in much earlier and start to actually be a participating member in some of the incident response itself.

Yeah, that's a great point. I think historically you look at things, there's— you control that timeline before the public may know about certain things. So if it's an internal employee issue, if there's a business issue or whatever whatever the private issue may be, there's time to communicate with the board, time to do these things, if ever, you know, and certain things never get out. But now with cyber, that's a very public bad situation people get put in. And so it's— that timing is much shorter now to know where to go and when to go and what to activate right away.

And that actually reminds me of one of the other pieces is these new SEC rules. Another one of their transparency rules that we believe will be in place here within the next month is that you have 4 days from the time you become aware of a situation, of an incident, that you have to go public. Wow. And in many cases, as we all know, that, you know what, I don't know, you guys probably know the number better than I am, 200 and some days people can be in your system before you ever find them.

Oh yeah, it's latent threats.

Latent threats. They're there.

And sometimes 4 days to investigate an incident to get to, is it really a disclosure? Was it a near miss? Is it a vulnerability? So man, if we had to report every potential incident, it'd be daily. And many companies that are seeing the volume—

Yeah, and their wording at this point is that once it's been identified as an incident—

Confirmed.

You have 4 days.

Okay.

That is a huge definition because I know one thing we see a lot with our clients in looking at contracts and sharing agreements is the definition of incident. Because that, to your point, it's like that could be once every 6 months or 6 years. That can be once every week. Looking at vulnerabilities as an incident.

And from a board perspective, I remember, won't I won't name names, but one of the large retailers that a little bit more than a half decade ago had one of the first payment system large-scale incidents, that there was a lawsuit against the audit committee and they were being held accountable. I don't think it went through. I think the audit committee stayed in place, but it was at least the shareholders put that on the book. So I think there's accountability at the board level. When do you need to know or when do you want to get involved? When does it help? When does it hurt? For that company. Because you're right, you know, you're not going to have ransomware and the first thing, let's assemble the board and wait for them to fly in. Yeah, no, that's not realistic.

Yeah, a question came to mind thinking about it. So at NACD, what are their thoughts and what they're teaching or guidance around— you land at a new board, right, and your first 90 days and you try to identify what if they have no cyber experience on the board. What is their guidance to you as far as how to start, who to network with, who to ask questions, where do you go as a newly trained NACD or certified director, what is their guidance to you on how to start that process?

I don't know that I've seen anything that specific in some of the work I've done, but in general, they basically say you are empowered to represent your stockholders, your stakeholders. So you ask questions.

Call Cody Rivers, 317.

Yeah, yes.

Reveal Rich, here it is. They'll walk you through it. So I think it's like any situation is that you're looking around at your peers. Okay, is there somebody that appears to be you one or two people that are the stronger ones. You get to know them, you quickly go, hey, I noticed this. Anybody ask that question before? But maybe documented somewhere, it may be in some board minutes, it may be somewhere I can go to. Anytime you're new to an organization, this is just organizational dynamics. You don't land in the middle and suddenly start tearing up their meetings. You don't become very well accepted by doing that. So I think the challenge is that you're balancing your personal credibility because you signed up to be an independent board member.

Yeah.

And if you assess something that you've got a fear of a risk, then you need to be engaging with the chairman of the board or the chair of the committee that you're on or whatever to start expressing those and saying, "Hey, can somebody just give me some information? Calm me down. I'll be fine." Or you're going, "Hey, I'm new, but I've got a new perspective. I think we really need to be looking at this." Yeah.

I want to conclude on one last topic. If you think about, do you have any stats on how many boards need to level up on cyber talent? And secondly, linked to that, if for those practitioners that are in cyber now and aspire to be on boards, what does that path look like for them? What should they be doing to kind of position themselves, whether it's after they leave the corporate workforce or during? What are some tips that you would advise kind of going down the path that you did?

Sure. On the first piece, I actually pulled up some stats. I wanted to— I'd read a lot of things on it, but I want to make sure I got some current ones. There was a recent Forbes analysis that they did that 51% of the Fortune 100 boards have at least one director with some cyber experience. That's only one. Wow. When you drop that number to the Fortune 500, the numbers drop lower very quickly. Only 9% have cyber-savvy directors at that point.

That's like any savviness across all the director members.

That's anybody with some background. Either you came as a CIO at some point or a CISO or had that experience. Responsibility in when you were in a business. And then when you move even farther out using the Russell 3000, which is one of the groups that they collect statistics on, now your number is down 8% or less. So that— 8%? Yes. Of somebody that documentally they know has cyber background that can bring that to be that, if nothing else, that one player on the board. When they looked at those numbers, even it's about 2,700 directors would be needed with cybersecurity experience to try and raise that Russell 3000 number up.

Wow.

Into some decent ranges. Another statistic I just saw in an article, I think it was about a week ago. There's a recruiting firm that does a lot of the placements for board members and for high-level executives, Heidrick Struggles. They showed that 14% of the board seats that were filled last year to Fortune 500 firms were filled by new board members with cyber.

Okay.

So only 14%, even though this is getting much more visibility and in just like in the last 12 months. So this is a growing area. This is a major place that we need to be paying attention to. Your other question about how to get prepared, I think it's a lot like everything else. It's talking to people, talking to your network, talking to people that are on boards. Expertise is going to be— you're going to be growing your cyber if you're just within the field. So that, I think that will just come along. So the most important part is to be able to get yourself out there, get in front of people talking about it, talking with whether that's folks that are at the CEO level, folks that are at the board level and that kind of thing. Networking. I preach for all the folks I mentor, networking is always so important. So that's probably your main piece.

I'm one of those proud mentors, man. Very blessed to have you as a mentor.

Cool.

Been fun. So I hope this has been informative, maybe a little bit of knowledge. And it's just every week I read something new that says, okay, that's something else we need to be paying attention to.

Yeah, no, it's been great to do that. It's been great. Our goal with this podcast is always to share knowledge, have great conversations, and just, you know, what is— what are we doing? What are you supposed to be doing? What are they doing? With some guidance and everything, because I think you can get lost in all the stuff that comes out, but sometimes there's not a lot of actionable things other than just these new requirements. There's one other piece I did—

I thought of that didn't mention with the idea of the boards that I think is important too, is that any of the board members that are working in this space, it is their responsibility to make sure that they get the resources to the teams so that if the CEO and the CFO and the COO are all going, we got all these different challenges and everything, and IT only gets X percent and X percent of that is cyber, it's a board member's responsibility when they're looking at the risk to go, are you guys making the right allocation of resources?

Right.

That's an important role, and it usually wouldn't have been one over the years that I've dealt with boards. It usually didn't get to that level of discussions. It's just that the cyber risk is becoming so large and major player for the organizations is, guys, we have to invest in it.

So it's almost like if the technical leaders can communicate more clearly to the non-technical leaders, and if the non-technical board members can level up their skills and be able to ask better questions and pull those threads that you talked about, I think there'll be more alignment and more unblockage of resources that may be causing some of the challenges today.

That's the goal anyway. I would say, yeah, that's the end result, the outcome you're looking for.

Awesome. Well, Mike, thanks for coming on to the show. We really appreciate it. And hopefully this is helpful to our members and both where they're seeking opportunities to help in this space or if they're wanting to better communicate to board members that they have to serve today.

All right. Happy to help. Thank you for the invitation.

And Mike, are you for hire as an NACD, right? You're out there looking for boards to join, correct? Right.

I'm actually— yeah, I'm open to any folks that want to talk about it. I've actually— it's funny because amongst our network, we talk about our networking. I've been getting a lot of folks that want to go to coffee and that type thing saying, I've been thinking about that in my career, what do I need to do? So it's been fun. It gives me a chance being retired, I get to go see more people and just talk to them. That's actually fun that way.

I appreciate it.

Sounds like you're getting to do your— what you practice, what you preach, continue networking. So that's awesome. And Aaron Pritz, thanks for coming on.

All right, thank you.

Thanks, Mike. Bye.