Episode 109: Bob Zukis and the Digital Directors Network: Helping corporate boards mitigate systemic risk

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda loop.com hello, I'm Bob Gourley, the Chief Technology Officer of OODA llc. And today on the oodacast, Bob Zuckas. Bob, welcome to the oodacast.

Hey Bob, thanks for having me. Great to be here.

You know, I really look forward to this because, Bob, I had heard about you from so many of my friends who strongly endorsed the Digital Directors Network to me. And because of them, they encouraged me to pursue my, my QTE certification and take one of your master classes, which I really enjoyed. And I really look forward to talking to you about that. Plus your book, the Great Rebook. Reboot.

Yeah, thanks, Bob. You were a fantastic student and we had a great group of peers as well as some, some interesting conversations.

Right. You attract so many interesting people to, to this QTE course.

Yeah, I think it's, I think it's the course. I think it's the issue too as well. So I think it's the level of awareness is starting to go up and people are looking for solutions and that's what we're, we're helping them with.

Right, and you're helping them in a very professional way, I should say. And I think people will get a feel for that through this conversation as well as they'll get a feel for it if they pick up your book, the Great Reboot, which I want to talk about as well.

Yeah, yeah, thanks for that. And you know, we took an executive ed approach to this issue and it's, you know, it's not the typical industry talking head type of view where you've heard the same comments a hundred times. We're really stretching people's thinking and giving them the tools they need to solve these problems.

Right. You made me think. But Bob, before we get deep into that, can you tell us a bit about your background and your career trajectory to date?

Yeah, it's been, been a long and fascinating career. I spent most of my career living and working outside the United states as a PwC management consulting partner, so lives all over the world from Saudi Arabia to a decade in Tokyo Hong Kong when China just started opening up as one of the first foreign professionals working in mainland China, which was amazing in the mid-80s London for a few years and finished my career with PwC when I retired in 2012 after running our IT strategy in Ops and West coast data management and cyber security practices. And since then I've been an adjunct professor at the USC Marshall School of Business. Very active in the Governance, community venture backed, early stage SaaS, CEO, private company, corporate board director, having fun with some more entrepreneurial pursuits, and I think trying to transform some issues with a little more freedom of expression than I would have, you know, as a partner in a major firm like that.

Right. Makes a lot of sense. But you bring out the wealth experience to this because you have, you've seen it, you've done it, and now you're helping people understand it better.

Yeah, exactly. Right. Yeah, yeah.

And so one of the ways you did this, we mentioned the book, the Great Reboot, which I enjoyed. Would love for you to talk a bit about that. But let me tell you, my view is it filled a lot of gaps for me personally. And I've been in cybersecurity for decades. I've been serving corporations for decades, I've been serving boards, but still I had these huge gaps in understanding what makes board of directors and leaders really tick, but also how can they improve their understanding of complex digital systems.

So, yeah, and there's a couple, there's a couple of aspects to the problem that we're trying to solve, Bob, and I think you hit the nail on the head. Some of those gaps are actually new gaps. You know, the world that we've created is exponentially more complex than it's ever been. And certainly that manifests itself in the complex digital system pretty profoundly. And so that's a new domain of risk that we haven't been paying attention to. And then some of the gaps are the gaps between the boardroom and digital and cyber executives, because they've never really spent a lot of time in the boardroom. They're not on boards. You know, corporate boards haven't really pulled this knowledge and skill and capability into the boardroom domain before. And so for the first time, really starting to mash up. And they're realizing that they talk different languages and they have different worldviews on, on what's happening. And so we're trying to be the Rosetta Stone, if you will, to make that translation.

Well, and before we get into this, Bob, would you tell me a little bit more about your co authors of the book, Chris and Paul.

Yeah, Paul. Paul Farillo. Chris Velasos. This was a labor of love that we started the day essentially the pandemic started and we were talking about these issues. Paul was the first attorney that, that in my network that really woke up to this issue of systemic risk, the legal liabilities. He's very profound and forward thinking around cybersecurity. Not with us any longer, unfortunately. Chris Veltos is a professor of cybersecurity at the forefront of thinking and teaching these issues as well. So we were kind of this informal group that was pushing each other's thinking around these issues. And the day the pandemic started, we said, hey, we're all living through this colossal systemic failure and the systemic impacts of a pandemic and how it's going to jump from being a medical crisis, a cascading systemic medical crisis, to an economic crisis, to a social crisis, to a political crisis. So why don't we tell that story? So, so we wrote the first edition of this book in 90 days, and, you know, we were all locked down, so we had plenty of time and we cranked it out and we're now on the second edition. And it's really, you know, building up from that foundation to stretch people's thinking around the complex world that we live in and how we can understand it, leverage it, capitalize on it, and deal with the risks that are inherent within it.

Yeah. And Bob, you must have realized throughout your career that the hardest thing for any leader to do is change, change their opin what they're doing. And I think you open the book with a lot of compelling reasons for change, which right now, if corporations just keep doing what they've been doing in this environment, it's just not going to work out.

Yeah. And that's a powerful word, and that's. That's the right word for what we're doing. So when I decided to jump on this train and start this journey six years ago, nobody knew what the heck I was talking about. I was the lone voice in the room on these issues. But the problem was so profound and, you know, consultants are problem solvers. And so I couldn't let the problem go. And I, it would grow increasingly frustrated as I would talk about it in the governance community. Just the lack of progress towards a structured approach to the problem and a structured approach to a solution. And so, you know, change is all about, you know, communications, it's all about education, and it's all about the motivations for why I should move from point A to point B. So the tactics we've been deploying are, you know, playing towards all of those, those different leverage points. And it's not just a us, it's not just an American issue. This is very much a global issue. So I had to decide, do I want to bite off, you know, changing the corporate boardroom on such a transformational issue when the boardrooms are typically reluctant to change at many different levels for a lot of different reasons. Do I want to, you know, step into that world and take this on? And I decided, yes. And here we are. Yeah. Yeah.

Well, I think you build a good case for change, but then you guys don't just admire the problem. You come with suggestions and frameworks and ideas on how to add continuous value to stakeholders while understanding and mitigating risk.

I love that phrase, admire the problem. I'm going to use that. That's essentially what the governance community was doing. They kept talking about the problem. Nobody was offering any solutions to the problem. And, you know, being a consultant and an academic and, you know, being, you know, well grounded in structured problem solving, you know, why shouldn't I do it? Why not me? Right? So, you know, we took a very deliberate approach to how we start to move this issue forward. And the starting point with problems of this scale and of this magnitude is, well, what is the problem? How do we define scope of what this challenge is? And then once you have that, then you can start to assess yourself against that scope. You can start to identify the tactics that move you forward to where you want to be against the issue.

And then two terms keep coming up in the book that I really appreciate you discussing. One is a complex system, and then the other is systemic risk. Can you tell us what should directors know about complex systems and systemic risk?

Yeah, our complex systems. And complex systems are everywhere around us in the natural world. Planetary health, human healthcare is a complex system. The human body is a complex system. But increasingly, the world that we've built is an environment of complex systems. And we build it because we could, because we're very innovative as a species and very creative in terms of how we solve the needs and wants of 8 billion people on a planet. So we built this. This fragile Frankenstein's monster of. Of a complex world. We haven't stopped to really pause and think about how this thing can run amok and, you know, pillage the village and the villagers, you know, in the metaphor of Frankenstein's Monster, which is a complex system, it's a cobbled together collection of body parts, right? And you get the one critical part of that system wrong, the brain, the system is going to run amok. And so that metaphor is what we're actually seeing around. These issues occur time and time and time again. And so systemic risk is, you know, one part fails, and how does it manifest risk across a much broader system? So from Colonial Pipeline, the Solar Winds, to what we're now going through with Silicon Valley bank, you see those words systemic risk popping up. We're living in a world of complex systems and systemic risk, but we're not paying attention to risk and the opportunity enough to really capitalize on, on our ability to build so many fantastic systems.

Right. Let me run another thesis by you, Bob, because it just, it fit with my experience so much reading this book. For decades I have seen organizations where the leadership just doesn't care about cyber security until they get hit. When they get hit in a big way, then it's like, oh, I get it, okay, we're going to pay attention until it's patched and then it's human nature to like, okay, that's been fixed or maybe I'm going to hire a ciso. And now I don't have to care because I have a ciso. And for decades I've seen too many organizations take that approach. I've seen other organizations don't that really get it. The, the CEO, the leadership team. The board understands this is serious and they treat it well. But my view is that's perhaps the most important metric and I would like to get your view on that. If the, if the board cares, you have a hope. You have hope. If the board doesn't care, you have no hope.

I agree with that. And you know the board's a part of the system, right? So if the board doesn't care, by definition they would be a, a low performing part of the overall complex system. Most boards and, and I even, I think most CISOs, they, they're not engaging with the board where the board becomes a part of the system. They're viewing the board as something that's tangential to what their responsibilities are. But the board is actually a critical part of that complex system that's, you know, there to defend the value of the company against the manifestation of these risks wherever they, they may come from. I have a saying that, you know, 100% of boards wish they took a better approach to cybersecurity 100% of the time after a breach. You're absolutely right. You know, they get religion very quickly after an incident. But, but the good news is the things they do after an incident, the things that they put in place to remediate the problem are all things they could self regulate around right now to mitigate the world and the risks that they're, they're, they're living within. And this is not a boil the ocean problem to solve this issue. It's not simple to understand complex systems and risk within the systems. But we're not talking about you know, changing fundamental paradigms here. This is very achievable. Doesn't cost a lot of money for most boards to get themselves to a point where they're high performing on these issues.

And another point on this.

Or not.

Yeah, Bob, you really drove home for me the fact that this is also not something that's just for a CISO. Although, you know, CISOs perform differently in different corporations. For the most part, they're looking internally at systems and their own corporate data and their own policies and procedures. Sometimes they will, if they have a good mature program, work with partners and give guidance to people on contract who are suppliers. But that's rarer than it should be. And almost never have I seen a CISO using this term, systemic risk. Yeah, I took that away from this QTE certification as well.

Yeah, which is why it's the foundation of what we're doing. We needed to create a new way to understand these problems. And frameworks are really just structured ways, ways to think about a problem. So we created something called the Director Framework, which is the eight domains of a complex system. We studied the work that was done by the financial services sector after 2008, some of which we're seeing all play out again. And you see leaders in the financial services sector, regulatory leaders as well as industry leaders, talk about that. They feel like they have a much better control around Silicon Valley, bank, et cetera, et cetera, and how these potential issues could cascade because they did take a differentiated approach after the fact in 2008. So we, so we know we can understand these issues. It's not easy to get on top of them, but we know it's not impossible. So the good news is, you know, there is a better position that we could put in place if we understand these risks in the right way and bring some attention and resources to them.

Yeah, right. I like the Director Framework and it's another reason I really want to encourage people to pick up the book. It's really the best way to understand it is reading it there and looking at the graphic and it's really hard to convey that in a podcast. I think, folks, it is better if they read it or talk to you, go through the course to get a feel for the power of this framework. But I would also say this, there's a lot of other frameworks out there. There's NIST Security Standards, there's the NIST Cybersecurity Framework, there's ISO cobit. None of those are right for boards. You know, it's just too detailed. It's too focused on the technical. It's important internally to understand those controls. It's extremely hard to express those up to busy decision makers. And that's part of the power of this director framework, I think.

Yeah, yeah. And it's, that was the challenge. Right. So how do we create, you know, a structured way to think about this issue for two sides of the boardroom table that are very different sides of the boardroom table? You've got a bunch of corporate directors that don't have any background training, understanding of these issues didn't come through the functional domains of IT or cybersecurity on these areas. Then how do you help CIOs and CISOs translate their world to that audience that they don't understand? They don't understand what governance is about. Who are these people? What do they do? How do they perform their job? How do we take the technical depth and nuances of what we do day in and day out and translate that into what a board wants to talk about and needs to understand in order for them to do their job? So that Rosetta Stone metaphor is perfect. Right. So it needed to be a framework that was high enough level where it wasn't a boil the ocean approach, where there's a 200 page implementation manual behind it. This is a, this is a Porter's five forces, Porter's SWOT analysis style of framework. It really starts to dissect the problem and its component parts in a different way and really qualitatively understand systemic risk and what creates it and what's at stake for the company. Right. So what's, what's the business value that this information system is, is driving for the organization? Are we trying to protect capital, assets, intellectual property? Is it generating revenue? Is it generating profitability, productivity? So how do we translate that system into business value and then how do we understand the things that systemically could jeopardize that value?

Right, Cool. A couple other things about the book.

There was. Let me come back to that point real quick Bob, before we move on there. There was, there was a, something on LinkedIn a couple months ago, somebody asked for a definition of, of what cybersecurity was and we, we. And just what's your definition of cyber security? And it was all over the place. There were long winded explanations, you know, that weren't even definitions. There were explanations of it. And I short definition of it to protect business value. Four words. That is what we're trying to do here. We're trying to protect business value. However it's derived from the complex digital system.

I like that. It's very succinct and well put.

Yeah.

You also remind. You also remind me of someone else. You may have heard the name Steve Katz. Steve is the very first siso in the world. There was a time when there were no sisos. Yeah, well, someone had to be the first. And it was Steve. And he very famously put this in the mid-90s. He said something like, there are no cyber security risks. There are only business risks. And so I think there you have an indication that the first CISO in the world understood this is critical for business. It's a business risk.

Yeah, exactly. Right. Yeah.

Let me mention something else about the book. I was thinking about the book and thinking the key takeaways. Well, the director framework is a key one. People really need to read it for that. But there are also just plenty of nuggets of helpful information. I went hunting for something I knew I read in here, but I just couldn't remember where it was. And I found it. It's two things that I take away that you wrote. One, you said this. You said, it's not just enough for board members to ask questions on cyber risk, as the questions are meaningless if corporate directors don't understand the answers. It calls out for education, doesn't it?

Yeah, that's. That was the pivot point for my frustration on this issue. I'd be at events and the governance community would say, Here are the 10 questions corporate directors need to ask about digital transformation or cybersecurity. I'd be on a panel, be in the audience, and I'd say, the questions are useless if you don't understand the answers. Directors are there to do more than just ask questions that they don't understand the answers to. You've got to be a part of the system, and so you have to, you know, understand how to interact with that system. We do see some boards. FedEx comes to mind. FedEx does a fantastic job with a tech and a cyber committee. They specifically have in their charter that those. The directors on the board on this committee will be advisors to the management team. So they're. They have an expectation that they're going to bring some value to the management team and be a part of that functioning system for cyber and it. So that's a totally different threshold of responsibility at the board level than just asking questions that somebody put on a piece of paper in front of you. We need to expect more from the boardroom and boardrooms and directors need to deliver more, frankly, on this issue.

You Know, you do give several really good examples of corporations that get it right and do well. And we study some case studies in the course of corporations that did not. And you can really draw a line directly to why there was a failure. I want to say in my neighborhood, right down the road from my office is VeriSign. For eight years, they have had a cybersecurity committee off of the board because they realize security and trust is what they're all about. And I think they're one of the exemplars of someone who realizes you just have to keep at this. The board has to understand and they have to have a committee that works with management continuously.

Yeah. And, you know, governance in and of itself is a complex system. So to do this right, you have to have the right skills and competencies in the board. You have to have the right organizing principles. Tech and cyber committees are the leading standard, not the standard practice, they're the emerging leading practice. To pull this stuff out of the audit Committee, to pull it out of the full board, to put it in its own committee, then you have to have the right understanding of risk, which is where the Director framework and systemic risk comes into play. So the, the, we call that the 3s a skill structure and scope. Right. So that complex system needs to be working together at the governance level, just like the complex system of the business, just like the complex system of the digital environment. So we, we see complex systems all around us. If you start looking for them in the right way, that's the good news, you're going to see them everywhere. The bad news is you're going to see them everywhere and you're going to, going to start to see systemic risk in a, in a, in a new way and realize how fragile many of these systems are.

One other thing I want to read you from the book that just really resonated with me because there's so many questions I get from board members or senior leaders that it's hard to express to them why that is irrelevant. But, and I'm sure you hear the same questions too. It's. They'll say things like, well, how much do other peers in my industry spend on security? Or I understand I need to spend 7% of my IT budget on security. Are we spending that much? Or these other things that don't really have any relevance to adding value? The way you put it, page 99 of the book is the right question corporate directors should be asking is what's the value of what we're trying to protect? And how safe is it, for what we're spending.

Yeah, and that's, that's, that's exactly right. It's, it's, you know, those type of metrics, those comparable metrics of what you're spending, what you're spending relative to it, are frankly useless because every, every company's threat environment is unique. Every company's control environment is unique. How companies create business value through their digital information system is unique. And you know, I think boards have felt, you mentioned this earlier in the call. Boards have felt like they've, they've passed the problem on to others. Boards, I think, initially felt like they insured their way out of this problem. We've got cyber insurance. We're good. Let's, you know, let's move on. Next issue. You know, the vast majority of the economic impacts of, of to business value from cyber risk is uninsured. We estimate about 90% of it is uninsured. So the company is actually self insuring themselves for those risks and they don't realize that. And once they realize that and they start to think about cyber risk in the, in economic terms, you know, from a capital asset perspective, from an intellectual property perspective, from a revenue net income expense perspective, then the light goes on very quickly. And then they see this as something other than what they've always thought it was, which was, was the wrong frame for them to look at the problem through.

Right. I found that extremely helpful. Framing is key and I think all directors need to understand this. And another way that, another thing I hear frequently from senior executives is I will never be a cybersecurity expert. And I've been trying to help people shift their conversation on that a little bit by saying you don't have to be a technical expert, but you can be a cybersecurity governance expert. If they apply themselves, if they understand the importance, if they really think through how they can add value, they can be a governance expert even though they're not. They don't know how to program a firewall.

Yeah, I think that's right. I think you can understand risk in a different way at a governance level. You'll never be an expert who's, you know, had the functional responsibilities of doing this job. Interestingly, what the SEC looks for and how they define expertise is applied functional expertise. So they want people in the board that have actually done the work before. And I always say it this way to people. It's, you know, I could sit on a hospital board, but that doesn't make me a medical doctor. You don't want me cutting into your appendix. We'll get somebody else for that. Right. There's a huge difference there.

But.

But I can general understand hospitals like I understand medicine at a higher level than just somebody random off the street. I understand hospital administration, you know, how to, you know, drive that kind of environment forward. But I've never cut into the body before and you don't want me to. Yeah. You know, and the SEC doesn't want amateurs on this issue in the boardroom either, just like they didn't want amateurs around financial expertise 20 years ago. And this is exactly how they defined expertise 20 years ago under Sarbanes Oxley. They want somebody that's been in the job before, has those responsibilities and can govern accordingly off of that foundation. Now, I think all corporate directors can build up a stronger base of these issues, and they should be building up a stronger cybersecurity competency around these issues and a digital competency around these issues. But they'll never be able to take the place of somebody that's been in the job before.

Right. And Bob, I wanted to say that not only did you write this book that captures so many of these things so very well, but you've published multiple articles and you've built an organization where people can continue to learn from each other and network with each other. The Digital Directors Network. Can you describe that for us?

Yeah, it was really step one of how do I move this issue forward at scale and how do I move it forward at a global scale? And just me talking about it, just me doing it, is much different than me plus 1200 other people doing it, which is what our membership base is now. And it's. Bob, it's folks like you, it's folks like, you know, major CIOs and CISOs and corporate directors from some of America's leading companies. And I had an instinct that there was latent desire to solve this problem. And so setting DDN up as a bit of a clubhouse where we can come together and share our thoughts and, you know, create and invent what the solution sets look like to these challenges was an important tactic to really get an army of people and an army of influence behind this issue. And so that was the right decision from a change management perspective to do that. And so we've got 1200 members on DDN. Over a third of them have gone through this structured masterclass programs to learn about corporate governance, to learn about systemic risk, and to apply that in their organizations. So we're making it difference, you know, one leader, one boardroom director at a Time and one board at a time. Yeah, we're 1200. We should be 5000. That's the scope of the problem that we've. We've defined in terms of what boards need in terms of these skills and capabilities. So a lot of work still to do, but a great start. Yeah.

Right. And this. This focused master class, the qte. I went through it. I'm very glad I did. But I wonder, who are you targeting for this class? Who makes a good person to go through this master class?

Yeah. It's targeted both sides of the boardroom table. There's a masterclass for the digital, the cyber leaders. We look for people that have, you know, applied experience in one or multiple domains of a complex digital system. So data scientists, CIOs, CISOs, information architects, you know, regulatory leaders in cyber security. We've got some former SEC's, commissioners that were some of the early voices on cyber security that we would say are qualified technology experts that have taken the class. Right. And, you know, we wanted to build a class because we wanted to take a structured approach to advancing these issues, and we all wanted to be able to have the same frame and the same perspective to build upon. We didn't want to just be a bunch of people that gets together and talks about these things in the abstract. We wanted some structured approach to solving the problem. And so building a certification program, testing our knowledge to that is a higher standard. We wanted to be able to show the other side of the boardroom that we are taking this seriously. We are holding ourselves to a higher standard. And then we built a program for the general corporate director to take them down the path of, hey, what is systemic cyber risk? How do I govern that? Give me this framework, this director framework. How do I apply that? Because we're trying to make a market, right? Ultimately, that's what we're doing. We're trying to make a boardroom market around these issues and bring both sides of the table together in a common way to understand, articulate, and deal with these risks.

Cool. And then this relates to your annual conference domino, too, right? What is domino?

Yeah, domino. Perfect metaphor for systemic risk. Right. That first domino goes over, then boom, boom, boom. We got problem after problem after problem. That's, you know, the domino effect, the butterfly effect. Those are essences of systemic risk and challenges. May 16th and 17th in Chicago. It's getting our members together, 200 of our members, our content partners, to really do a deep dive around these issues and keep the learning and applied learning going. So we've got a Fantastic group of content partners that are going to be teaching really off the back of the SEC rules that are coming out in April. So those are scheduled for April. Far ranging, very transformational. I think as impactful, not quite as broad in scope or mandate as Sarbanes Oxley was, but I think Sarbanes Oxley light what the SEC has proposed for this issue in the boardroom and it will be transformational. So we have SEC Commissioner Jaime Lizarraga kicking us off talking about those rules. We're going to then take that, learn about disclosure, learn about systemic risk related to people risk. We're going to talk about cyber risk, quantification, we're going to talk about complex systems, complex system science and make it a learning event and then go forth and fix these problems. So May 16th and 17th, Chicago, if you're interested, you know, reach out and ping me and we'll figure something out to get you in.

Yeah, I'll make sure we're going to link to that in the show notes for this podcast for sure. Because it is such a critically important event.

Yeah, we'll be doing it every year. And you know, this will be the event on these issues, you know, when boards, boards will start to mature here and boards will start to consume services much like they consume audit services, comp services, legal services. They will start to consume services around these issues and look for help, certainly from their own teams, from external teams, to move this issue forward as it matures. And this conference is at the forefront of this. This is a deep dive. This isn't a typical talking head industry conference where people are just talking about, you know, the nature of the problem.

Are there opportunities for the person to person networking and meeting more of your peers in this conference?

Yeah, it's exactly what it is. It's a day and a half. Right. So it's a day and a half deep dive. We've got some fun things planned, some interesting things planned, and we're gonna, you're gonna come out of there exhausted from the learning experience and, and the new knowledge that you gather. Yeah. But it's also a networking experience as well because we want, you know, when somebody, when a board takes a DDN member, a QTE puts them on their board, it's not just that individual, it's the power of the network behind that individual that's actually helping that company move forward and helping that company succeed. You know, it takes a village. My friend Stan Stahl here in la, give him credit for that. He's got an organization, a not for profit and that's what it's called. It takes a village. The approach we're taking, it has to be a collective security model when you live in a world of distributed risk. And so the power of this network will be the power of transformation on these issues at the governance level.

Cool. That leads to two other things I want to talk to you about, Bob. One is you already mentioned the SEC rules, but can you give us a little preview of what's coming with those?

Pretty, pretty impactful. It's cyber expertise. So do you have cyber expertise on the board? Simple disclosure rule, comply or explain type of rule as it was drafted. We're strongly supportive of it. And what that will lead to is tell us the story of, tell us who it is. Check the box. Essentially, do you have this person and you're not going to want to be a finance director, you know, former audit partner from a firm that goes to a two hour class at Carnegie Mellon on cybersecurity and says, hey, I'm your cyber expert. You're not going to want to sign up for that. So it's going to challenge boards to think about, hey, maybe we need somebody that's cut into this body before. We need a director here that we can put into that position and say that we've got that expertise on the board. Because the other option is explain why you don't essentially, why you essentially don't need that person and what else you're doing and why would you want to start to dig yourself out of that hole, Solve the problem simply. There's plenty of people out there that can do this job at the governance level, get them into the, to the room. And that's step one of skills, structure and scope. Right. And then the other provisions of that proposed rule really deal with what else are you doing? So what are your practices and policies from a governance perspective? So it's going to force boards to mature and interact with their management teams on these issues in a much more structured way from a, from the perspective of implementing a reasonable system of oversight. So they're going to have to mature their governance practices around these issues. Then the third thing I'm paying attention to is a subtle change, but a very powerful change. So the trigger date for a disclosure is proposed to be changed from data discovery to date that the issuer determines it to be material. So when you, Bob Gurley, and your company figure out materiality, then you have to disclose to your investors what the impact of this incident is.

What is materiality?

Exactly. That's what it's Going to drive boards to figure out with their management team. Let's define materiality of the nature of all these type of potential incidents. You know, whether it's a data breach or ransomware attack, whether it's, you know, some other type of threat. What does that mean and what's the impact on the company and how is it material in the eyes of a reasonable investor? So it's going to force the cyber risk quantification issue and the materiality discussion again to help boards think through this and to mature. And I think all of this is good. Board should actually be thrilled with this stuff because this is nowhere near as punitive as what the SEC could have done with Sarbanes Oxley. And these are all common sense things they should be doing anyway. So I think they should take their medicine and work towards where the SEC wants them to head.

Right. Let me ask another thought on this. Because the SEC regulates publicly traded corporations, right? Really, Nothing else. So why would any privately held corporation be concerned with these?

Well, you know, the risks aren't any different whether you're public or private to, to a great extent from these threats. What happens is once the SEC does something like this, the private sector governance community starts to pay attention and views it as a leading practice. And then they start to understand the issues at a different level. And they say so you see in many private companies, they have an audit committee, they have a comp committee, they have a nomin gov committee that was an artifact of Sarbanes Oxley that the SEC put in place for public companies. Now around the world you also see that structure. So private sector and other jurisdictions around the world tend to parrot what the SEC does as the leading practice and advocator for good governance practices. And increasingly, companies compete for capital and markets compete for capital. So good governance is generally viewed positively from the institutional investors who want to invest in economies and invest in companies. And so, you know, making yourself attractive through, you know, leading practices and corporate governance, especially in this area, is a good thing. Cool.

Makes a lot of sense. Another question, Bob. Have you had time to digest the new March Federal cybersecurity strategy yet?

Yeah, I love it, actually. It felt like I wrote it myself, actually. And it's a couple of headlines from the White House's National Cybersecurity Strategy. It's a declaration of war on Systemic Cyber risk. That is the headline. And thankfully, finally somebody is talking about it at that level other than me. But that's really what they're doing, is they're bringing this concept to the forefront of, we live in a world of distributed risk, but we don't have a collective security model. And so what they're also doing is they're pushing liability to the, to the, to the, the doctor who created the monster. Right. So if you create this Frankenstein's monster, you're now going to be responsible for it. A fundamental policy shift. Right. And so instead of the users bearing the brunt of the risk and the liability as essentially victims of these, these poor security practices, what the White House wants to do, work with Congress, put laws in place that swims upstream to the creators of this risk, hold them to a higher standard. So it's not just us as the villagers. We're in the pain and suffering of Frankenstein running amok. It's Dr. Frankenstein they're coming after now. Right.

So that's very well put and that helps a lot. I found it to be incredibly well written. You could tell they're writing in a way that people haven't before. It's so easy to understand. So I like that about it. Another thing I really liked is the focus. There's a whole pillar on allies and the need to cooperate with others internationally. There was never anything like that in any previous cybersecurity strategy. And that also gets to this point about systemic risk. This is not just in the us this is global. And we need to work with other free and open nations to mitigate these risks.

Yeah, and the White House National Cybersecurity Strategy talks about that too as well. And you know, government's a little bit ahead of the curve over private enterprise on these issues because I think they've, they've had to be with critical infrastructure, national security issues. So there is something to learn from there. For private sector. We have a little bit of catch up to do in the private sector, but peer to peer, will you start to see private sector companies that are ecosystem partners, that are supply chain partners, start to work within that ecosystem to create their own collective security model. So almost moving towards a captive insurance model, a captive security model. So if you're a large influential company in a highly interconnected ecosystem, you've got the most to lose. But the risk landscape is probably most vulnerable at the edges for the small companies that you're doing work with because they don't have the same budget and maturity of their or defensive posture as you do. So do you take a new model where you collectively create the standards and create, you know, the risk transfer mechanisms to make that ecosystem more secure and take a more collective security model? It's going to force us to rethink the security foundations and models that we've been working through and that we now need to put in place moving forward.

Right. Makes a lot of sense. Bob, can you give us some concluding thoughts here? We talked about a lot and I think you outlined very well the nature of the threat today and how it's evolving. You discussed systemic risk and these complex systems we all depend on. We talked about the SEC and things that are going to force some change. So can you wrap all this up and tell us your view of the future for boards and what boards should be doing to survive and thrive in the coming years?

Yeah, I think this is table stakes. I think any board would be well served on the upside and on the downside by strengthening their foundational competencies with digitally and cyber savvy directors. It doesn't take a lot to do that. These are people that understand business. They aren't just technical specialists. They understand how these technologies drive a business value proposition and where the important parts of that value proposition are and where they're worth protecting and how you protect them. So, you know, I think my concluding thought is patient heal thyself. I think we can self regulate our way out of this problem, out of this challenge. You know, the SEC is going to force us to think about it and I think force us to take some action. And you know, thankfully the answer's out there. It's just a matter of deciding that we want to self regulate to a better position here. And if you do, I think it can have a material impact on your risk profile, your risk posture well, serve your stakeholders, your shareholders, all the people and companies and organizations that are dependent upon your organization without too much pain and suffering to get you there. Cool.

Thanks, Bob. I appreciate all this and I really look forward to seeing you at Domino in May.

Yeah, thanks Bob. Thanks for having me. And thanks everyone for listening. And we'll see you in Chicago.

Thanks for listening to this OODA Loop production for the latest analysis on cybersecurity technology and global risks, please visit www.oodaloop.com.