('blog',0,64,548,'en',0,'<p>D o you know if your organization is Cyber Secure or Cyber Insecure?</p><p>My focus in this blog series will be about Cybersecurity and your organization.</p><p>Cyber-Insecurity and Cyber Crime have been hurting your business yesterday, and today and will continue to do so tomorrow if you do not:</p><ol><li>have a robust business understanding of the risks of not securing adequately your digital business infrastructures, systems, and product lines.</li><li>have a comprehensive set of business-focused strategies and plans to secure and provide cyber resilience in your digital business world.</li><li>have in place the enterprise and business unit governance policies, processes, procedures, and training which creates a foundation for a company culture of ownership and accountability for cybersecurity at all levels of your company, … Board of Directors, Executive Leadership, management, and employees.</li><li>have in place the operational practices, which include the use of your processes, procedures, supporting tools (manual or automated) and reporting to know whether your Cybersecurity capabilities are protecting your enterprise or not.</li><li>have the practice and acquired learning and knowledge about what to do and not do when your organization has been cyber-compromised.</li></ol><p>Cyber compromise takes many forms and attacks us from many directions. National States, terrorists, criminals, hacktivists, business competitors and business insiders all take advantage of Cyber Insecurity for illegal political, economic, financial, ideological, societal, business competitive and/or personal gain. The reason behind a cyber-attack is interesting but matters little compared to the impact on your business.</p><p>One of the industry reports I pay attention to year after year is the IBM Cost of a Data Breach Report. The latest IBM Cost of a Data Breach (2022) Report tells us that:</p><ul><li>83% of organizations studied have had more than one data breach.</li><li>60% of breaches led to increases in prices passed on to their customers.</li><li>79 of critical infrastructure organizations didn’t deploy a zero trust architecture.</li><li>19% of breaches occurred because of a compromise with a business partner.</li><li>45% of breaches were cloud-based.</li><li>The average cost of a data breach was $4.35m.</li><li>The average cost of a ransomware attack, not including the cost of the ransom itself, was $4.5m.</li><li>19% of breaches were caused by stolen or compromised credentials.</li><li>The average cost savings associated with Incident Response Governance, regularly tested Incident Response plans and Incident Response Teams was $2.66m.</li><li>The average cost of a data breach in the United States, the highest of any country was $9.44m.</li><li>The average time to identify and contain a data breach was 277 days.</li></ul><p>This last fact is the big one. The average time to identify and contain a data breach was 277 days. This is just an average. How many news reports have you read this past year about data breaches being reported that had been ongoing for over a year or more?</p><p>Another industry report I pay attention to is the Version Data Breach Investigations Report (DBIR). The Version DBIR 2022 tells us that:</p><ul><li>82% of breaches involve a human element, including social attacks, employee errors and misuse of systems and data.</li><li>There has been a 13% increase in Ransomware breaches, more than the last five years combined.</li><li>62% of system intrusions involved threat actors compromising business partners.</li></ul><p>These facts should be alarming to you. 82% of data breaches occurred due to a person making a mistake. Ransomware breaches continue to increase. 62% of digital systems intrusions originated with a business partner.</p><p>If you are a Board member, executive, director, or manager of a small, medium, or large business enterprise, you should be alarmed and concerned enough by this information to at least ask some questions within your organization to determine if you are Cyber Secure or Cyber Insecure!</p><p>In my next post, I will speak about <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,64,623,'en',0,'<p>D o you know if your organization is Cyber Secure or Cyber Insecure?</p><p>My focus in this blog series will be about Cybersecurity and your organization.</p><p>Cyber-Insecurity and Cyber Crime have been hurting your business yesterday, and today and will continue to do so tomorrow if you do not:</p><ol><li>have a robust business understanding of the risks of not securing adequately your digital business infrastructures, systems, and product lines.</li><li>have a comprehensive set of business-focused strategies and plans to secure and provide cyber resilience in your digital business world.</li><li>have in place the enterprise and business unit governance policies, processes, procedures, and training which creates a foundation for a company culture of ownership and accountability for cybersecurity at all levels of your company, … Board of Directors, Executive Leadership, management, and employees.</li><li>have in place the operational practices, which include the use of your processes, procedures, supporting tools (manual or automated) and reporting to know whether your Cybersecurity capabilities are protecting your enterprise or not.</li><li>have the practice and acquired learning and knowledge about what to do and not do when your organization has been cyber-compromised.</li></ol><p>Cyber compromise takes many forms and attacks us from many directions. National States, terrorists, criminals, hacktivists, business competitors and business insiders all take advantage of Cyber Insecurity for illegal political, economic, financial, ideological, societal, business competitive and/or personal gain. The reason behind a cyber-attack is interesting but matters little compared to the impact on your business.</p><p>One of the industry reports I pay attention to year after year is the IBM Cost of a Data Breach Report. The latest IBM Cost of a Data Breach (2022) Report tells us that:</p><ul><li>83% of organizations studied have had more than one data breach.</li><li>60% of breaches led to increases in prices passed on to their customers.</li><li>79 of critical infrastructure organizations didn’t deploy a zero trust architecture.</li><li>19% of breaches occurred because of a compromise with a business partner.</li><li>45% of breaches were cloud-based.</li><li>The average cost of a data breach was $4.35m.</li><li>The average cost of a ransomware attack, not including the cost of the ransom itself, was $4.5m.</li><li>19% of breaches were caused by stolen or compromised credentials.</li><li>The average cost savings associated with Incident Response Governance, regularly tested Incident Response plans and Incident Response Teams was $2.66m.</li><li>The average cost of a data breach in the United States, the highest of any country was $9.44m.</li><li>The average time to identify and contain a data breach was 277 days.</li></ul><p>This last fact is the big one. The average time to identify and contain a data breach was 277 days. This is just an average. How many news reports have you read this past year about data breaches being reported that had been ongoing for over a year or more?</p><p>Another industry report I pay attention to is the Version Data Breach Investigations Report (DBIR). The Version DBIR 2022 tells us that:</p><ul><li>82% of breaches involve a human element, including social attacks, employee errors and misuse of systems and data.</li><li>There has been a 13% increase in Ransomware breaches, more than the last five years combined.</li><li>62% of system intrusions involved threat actors compromising business partners.</li></ul><p>These facts should be alarming to you. 82% of data breaches occurred due to a person making a mistake. Ransomware breaches continue to increase. 62% of digital systems intrusions originated with a business partner.</p><p>If you are a Board member, executive, director, or manager of a small, medium, or large business enterprise, you should be alarmed and concerned enough by this information to at least ask some questions within your organization to determine if you are Cyber Secure or Cyber Insecure!</p><p>In my next post, I will speak about <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,64,809,'en',0,'<p>D o you know if your organization is Cyber Secure or Cyber Insecure?</p><p>My focus in this blog series will be about Cybersecurity and your organization.</p><p>Cyber-Insecurity and Cyber Crime have been hurting your business yesterday, and today and will continue to do so tomorrow if you do not:</p><ol><li>have a robust business understanding of the risks of not securing adequately your digital business infrastructures, systems, and product lines.</li><li>have a comprehensive set of business-focused strategies and plans to secure and provide cyber resilience in your digital business world.</li><li>have in place the enterprise and business unit governance policies, processes, procedures, and training which creates a foundation for a company culture of ownership and accountability for cybersecurity at all levels of your company, … Board of Directors, Executive Leadership, management, and employees.</li><li>have in place the operational practices, which include the use of your processes, procedures, supporting tools (manual or automated) and reporting to know whether your Cybersecurity capabilities are protecting your enterprise or not.</li><li>have the practice and acquired learning and knowledge about what to do and not do when your organization has been cyber-compromised.</li></ol><p>Cyber compromise takes many forms and attacks us from many directions. National States, terrorists, criminals, hacktivists, business competitors and business insiders all take advantage of Cyber Insecurity for illegal political, economic, financial, ideological, societal, business competitive and/or personal gain. The reason behind a cyber-attack is interesting but matters little compared to the impact on your business.</p><p>One of the industry reports I pay attention to year after year is the IBM Cost of a Data Breach Report. The latest IBM Cost of a Data Breach (2022) Report tells us that:</p><ul><li>83% of organizations studied have had more than one data breach.</li><li>60% of breaches led to increases in prices passed on to their customers.</li><li>79 of critical infrastructure organizations didn’t deploy a zero trust architecture.</li><li>19% of breaches occurred because of a compromise with a business partner.</li><li>45% of breaches were cloud-based.</li><li>The average cost of a data breach was $4.35m.</li><li>The average cost of a ransomware attack, not including the cost of the ransom itself, was $4.5m.</li><li>19% of breaches were caused by stolen or compromised credentials.</li><li>The average cost savings associated with Incident Response Governance, regularly tested Incident Response plans and Incident Response Teams was $2.66m.</li><li>The average cost of a data breach in the United States, the highest of any country was $9.44m.</li><li>The average time to identify and contain a data breach was 277 days.</li></ul><p>This last fact is the big one. The average time to identify and contain a data breach was 277 days. This is just an average. How many news reports have you read this past year about data breaches being reported that had been ongoing for over a year or more?</p><p>Another industry report I pay attention to is the Version Data Breach Investigations Report (DBIR). The Version DBIR 2022 tells us that:</p><ul><li>82% of breaches involve a human element, including social attacks, employee errors and misuse of systems and data.</li><li>There has been a 13% increase in Ransomware breaches, more than the last five years combined.</li><li>62% of system intrusions involved threat actors compromising business partners.</li></ul><p>These facts should be alarming to you. 82% of data breaches occurred due to a person making a mistake. Ransomware breaches continue to increase. 62% of digital systems intrusions originated with a business partner.</p><p>If you are a Board member, executive, director, or manager of a small, medium, or large business enterprise, you should be alarmed and concerned enough by this information to at least ask some questions within your organization to determine if you are Cyber Secure or Cyber Insecure!</p><p>In my next post, I will speak about <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,65,149,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyber Insecurity and systemic Business Interruption caused by Cybersecurity events can no longer be contained by any one company or organization. Recognizing this (at long last) the United States Securities and Exchange Commission issued a press release on March 15, 2023: <em>The Securities and Exchange Commission today proposed requirements … to address cybersecurity risks. Market Entities increasingly rely on information systems to perform their functions and provide their services and thus are targets for threat actors who may seek to disrupt their functions or gain access to the data stored on the information systems for financial gain. Cybersecurity risk also can be caused by the errors of employees, service providers, or business partners. The interconnectedness of Market Entities increases the risk that a significant cybersecurity incident can simultaneously impact multiple Market Entities causing systemic harm to the U.S. securities markets. (https://www.sec.gov/news/press-release/2023-52)</em></p><p>If your organization is a publicly-traded company in the United States, you will soon be required to report your Cyber Risk and Cyber Insecurity risk management policies, practices, and procedures as well as actually assessed risks to the SEC. The insurance industry is already assessing this in determining what your Cybersecurity insurance premiums will be.</p><p><strong>Cyber Disruption equals Business Interruption</strong></p><p>If you are a senior Digital / Information Technology leader and you are asked the following question:</p><p><strong>“How much security do we need?”</strong></p><p>I would recommend that you change the question narrative to understand your organization’s tolerance for risk. I would answer the above question with the following question:</p><p><strong>“As a business, what can we/you live without?”</strong></p><p>A business leader can not begin to understand why and how much to invest in Cybersecurity to reduce Cyber Insecurity unless they have been provided and understand a comprehensive view of the systemic cyber-driven business risks and the implicit business impact these risks can inflict on business operations today and tomorrow.</p><p>A quick test to determine if your Cybersecurity / Cyber Insecurity Risk Management practices are adequate, ask yourself the following question:</p><p>“When your Threat Intelligence tells you that a Risk Threshold has been reached, who do you tell and what action plan do you implement?\"</p><p>If your answer to any part of this question is <strong>“I do not know”</strong>, then you can be assured that your Cybersecurity / Cyber insecurity Risk Management practices are not adequate to help you protect your organization.</p><p>In my next post, I will provide visibility into risk categories and types, with an emphasis on Cyber Risks and their systemic interconnected with and potential impacts on business operations.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,65,150,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyber Insecurity and systemic Business Interruption caused by Cybersecurity events can no longer be contained by any one company or organization. Recognizing this (at long last) the United States Securities and Exchange Commission issued a press release on March 15, 2023: <em>The Securities and Exchange Commission today proposed requirements … to address cybersecurity risks. Market Entities increasingly rely on information systems to perform their functions and provide their services and thus are targets for threat actors who may seek to disrupt their functions or gain access to the data stored on the information systems for financial gain. Cybersecurity risk also can be caused by the errors of employees, service providers, or business partners. The interconnectedness of Market Entities increases the risk that a significant cybersecurity incident can simultaneously impact multiple Market Entities causing systemic harm to the U.S. securities markets. (https://www.sec.gov/news/press-release/2023-52)</em></p><p>If your organization is a publicly-traded company in the United States, you will soon be required to report your Cyber Risk and Cyber Insecurity risk management policies, practices, and procedures as well as actually assessed risks to the SEC. The insurance industry is already assessing this in determining what your Cybersecurity insurance premiums will be.</p><p><strong>Cyber Disruption equals Business Interruption</strong></p><p>If you are a senior Digital / Information Technology leader and you are asked the following question:</p><p><strong>“How much security do we need?”</strong></p><p>I would recommend that you change the question narrative to understand your organization’s tolerance for risk. I would answer the above question with the following question:</p><p><strong>“As a business, what can we/you live without?”</strong></p><p>A business leader can not begin to understand why and how much to invest in Cybersecurity to reduce Cyber Insecurity unless they have been provided and understand a comprehensive view of the systemic cyber-driven business risks and the implicit business impact these risks can inflict on business operations today and tomorrow.</p><p>A quick test to determine if your Cybersecurity / Cyber Insecurity Risk Management practices are adequate, ask yourself the following question:</p><p>“When your Threat Intelligence tells you that a Risk Threshold has been reached, who do you tell and what action plan do you implement?\"</p><p>If your answer to any part of this question is <strong>“I do not know”</strong>, then you can be assured that your Cybersecurity / Cyber insecurity Risk Management practices are not adequate to help you protect your organization.</p><p>In my next post, I will provide visibility into risk categories and types, with an emphasis on Cyber Risks and their systemic interconnected with and potential impacts on business operations.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html');
INSERT INTO `node_revision__body` VALUES ('blog',0,65,151,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyber Insecurity and systemic Business Interruption caused by Cybersecurity events can no longer be contained by any one company or organization. Recognizing this (at long last) the United States Securities and Exchange Commission issued a press release on March 15, 2023: <em>The Securities and Exchange Commission today proposed requirements … to address cybersecurity risks. Market Entities increasingly rely on information systems to perform their functions and provide their services and thus are targets for threat actors who may seek to disrupt their functions or gain access to the data stored on the information systems for financial gain. Cybersecurity risk also can be caused by the errors of employees, service providers, or business partners. The interconnectedness of Market Entities increases the risk that a significant cybersecurity incident can simultaneously impact multiple Market Entities causing systemic harm to the U.S. securities markets. (https://www.sec.gov/news/press-release/2023-52)</em></p><p>If your organization is a publicly-traded company in the United States, you will soon be required to report your Cyber Risk and Cyber Insecurity risk management policies, practices, and procedures as well as actually assessed risks to the SEC. The insurance industry is already assessing this in determining what your Cybersecurity insurance premiums will be.</p><p><strong>Cyber Disruption equals Business Interruption</strong></p><p>If you are a senior Digital / Information Technology leader and you are asked the following question:</p><p><strong>“How much security do we need?”</strong></p><p>I would recommend that you change the question narrative to understand your organization’s tolerance for risk. I would answer the above question with the following question:</p><p><strong>“As a business, what can we/you live without?”</strong></p><p>A business leader can not begin to understand why and how much to invest in Cybersecurity to reduce Cyber Insecurity unless they have been provided and understand a comprehensive view of the systemic cyber-driven business risks and the implicit business impact these risks can inflict on business operations today and tomorrow.</p><p>A quick test to determine if your Cybersecurity / Cyber Insecurity Risk Management practices are adequate, ask yourself the following question:</p><p>“When your Threat Intelligence tells you that a Risk Threshold has been reached, who do you tell and what action plan do you implement?\"</p><p>If your answer to any part of this question is <strong>“I do not know”</strong>, then you can be assured that your Cybersecurity / Cyber insecurity Risk Management practices are not adequate to help you protect your organization.</p><p>In my next post, I will provide visibility into risk categories and types, with an emphasis on Cyber Risks and their systemic interconnected with and potential impacts on business operations.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,65,248,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyber Insecurity and systemic Business Interruption caused by Cybersecurity events can no longer be contained by any one company or organization. Recognizing this (at long last) the United States Securities and Exchange Commission issued a press release on March 15, 2023: <em>The Securities and Exchange Commission today proposed requirements … to address cybersecurity risks. Market Entities increasingly rely on information systems to perform their functions and provide their services and thus are targets for threat actors who may seek to disrupt their functions or gain access to the data stored on the information systems for financial gain. Cybersecurity risk also can be caused by the errors of employees, service providers, or business partners. The interconnectedness of Market Entities increases the risk that a significant cybersecurity incident can simultaneously impact multiple Market Entities causing systemic harm to the U.S. securities markets. (https://www.sec.gov/news/press-release/2023-52)</em></p><p>If your organization is a publicly-traded company in the United States, you will soon be required to report your Cyber Risk and Cyber Insecurity risk management policies, practices, and procedures as well as actually assessed risks to the SEC. The insurance industry is already assessing this in determining what your Cybersecurity insurance premiums will be.</p><p><strong>Cyber Disruption equals Business Interruption</strong></p><p>If you are a senior Digital / Information Technology leader and you are asked the following question:</p><p><strong>“How much security do we need?”</strong></p><p>I would recommend that you change the question narrative to understand your organization’s tolerance for risk. I would answer the above question with the following question:</p><p><strong>“As a business, what can we/you live without?”</strong></p><p>A business leader can not begin to understand why and how much to invest in Cybersecurity to reduce Cyber Insecurity unless they have been provided and understand a comprehensive view of the systemic cyber-driven business risks and the implicit business impact these risks can inflict on business operations today and tomorrow.</p><p>A quick test to determine if your Cybersecurity / Cyber Insecurity Risk Management practices are adequate, ask yourself the following question:</p><p>“When your Threat Intelligence tells you that a Risk Threshold has been reached, who do you tell and what action plan do you implement?\"</p><p>If your answer to any part of this question is <strong>“I do not know”</strong>, then you can be assured that your Cybersecurity / Cyber insecurity Risk Management practices are not adequate to help you protect your organization.</p><p>In my next post, I will provide visibility into risk categories and types, with an emphasis on Cyber Risks and their systemic interconnected with and potential impacts on business operations.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,65,396,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyb</p>','','full_html'),('blog',0,65,469,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyb</p>','','full_html'),('blog',0,65,549,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyb</p>','','full_html'),('blog',0,65,624,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyb</p>','','full_html'),('blog',0,65,810,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyb</p>','','full_html'),('blog',0,65,811,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyb</p>','','full_html'),('blog',0,66,152,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><p>body { font-family: Arial, sans-serif; } .container { display: flex; gap: 20px; justify-content: center; align-items: flex-start; margin: 40px; } .column { border: 1px solid black; padding: 20px; width: 220px; } .column h3 { margin-top: 0; text-align: left; } ul { list-style: none; padding-left: 0; } ul li::before { content: \"●\"; color: orange; font-weight: bold; display: inline-block; width: 1em; margin-left: -1em; }&nbsp;</p><h3>Strategic Risks</h3><ul><li>Political</li><li>Economic</li><li>Regulatory</li><li>Market</li><li>Reputation</li><li>Leadership</li><li>Brand</li><li>Customer</li><li>Mergers &amp; Acquisitions</li><li>Etc.</li></ul><h3>Operational Risks</h3><ul><li>Human Resource</li><li>Business Process</li><li>Technology</li><li>Supply Chain</li><li>Business Continuity</li><li>Channel Effectiveness</li><li>Customer Satisfaction</li><li>Health and Safety</li><li>Environment</li><li>Product and Servic</li><li>Efficiency</li><li>Capacity</li><li>Compliance</li><li>Etc.</li></ul><h3>Financial Risks</h3><ul><li>Volatility</li><li>Currencies</li><li>Interest Rates</li><li>Commodities</li><li>Credit</li><li>Liquidity</li><li>Market</li><li>Compliance</li><li>Legal</li><li>Etc</li></ul><h3>Hazard Risks</h3><ul><li>Natural Disasters</li><li>Terrorism</li><li>Shooter Events</li><li>Insurable Liabilities</li><li>Impairment of Assets</li><li>Health / Pandemic</li><li>Etc.&lt;</li></ul>','','full_html'),('blog',0,66,153,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><p>&nbsp;</p>','','full_html'),('blog',0,66,154,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,155,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,247,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,397,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,468,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,470,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,550,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,625,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,812,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,813,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,814,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,156,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,157,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,158,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,246,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,398,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,471,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,551,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,626,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,815,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,68,160,'en',0,'<p>My last blog post presented the changes released by the Security and Exchange Commission on July 26, 2023 to their “SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure by Public Companies.”</p><p>These changes are quite impactful to Public Companies and their regulatory reporting concerning cybersecurity and have been welcomed by professional practitioners in the cybersecurity fields. Some of us may wish that the SEC had gone a little further in and with their new rules, but …. progress is progress. If you are a member of a private company breathing a sigh of relief that you are not “required” to make such reporting and disclosures, I would suggest that you take a close look at these new SEC Rules and consider how your Cybersecurity practices compare to these “rules” for public companies. I will be coming back to this topic in future posts to explore some of these new rules in more depth. These are just a small sample of things we learn about as children that can harm us or cause injury.</p><p><strong>These are threats to our well-being.</strong></p><p>These four threats are very specific. Each of these threats has a specific range of impacts. We can easily be hit by a car when crossing a street and be injured or killed. Some strangers may wish to do us physical harm. Being struck by lightning will cause grievous bodily harm or outright death. We can easily suffer frostbite or hypothermia and potential death if exposed to cold temperatures for an extended period.</p><p>The specific actions we have been taught as children to avoid harm are very specific <strong>threat avoidance and mitigation actions</strong> we can practice.</p><p>Every time we check traffic before crossing a street or intersection to determine if we can cross safely,<strong> we are evaluating the probability of a potential event, </strong>i.e., that we may be struck and injured by a vehicle.</p><p>Practicing <strong>Risk Management</strong> in our personal lives is no different from practicing Risk Management in our business lives and roles! Risk Management entails:</p><ol><li>Acknowledging that Threats Exist</li><li>Determining the probability that a potential Threat will occur.</li><li>Understanding and assessing the potential Impact of a Threat Event if it occurs.</li><li>Ranking or Scoring Threat Risks for their Impacts (I.E., Probability X Impact = Risk Score)</li><li>Implementing Risk Actions / Plans to avoid and/or mitigate the impact of Threat Events.</li></ol><p><strong>Effective Risk Management requires both Knowing and Doing</strong></p><p>Now, let me circle back to Risk Behaviors. I stated earlier that throughout my career I have been amazed by the disconnect I have seen and experienced between the way we behave in our personal lives as compared to how we behave in our business lives regarding Risk. In our daily lives, we naturally embrace our roles as Risk Managers for our own safety, and the safety of our family members and loved ones. Yet it always seems that as soon as we enter our work environments (in an office place or remotely from home or hotel) we often witness employees, at staff, management, and executive levels, unconsciously ignore or abandon any sense of understanding of Business Risk. Most Risk Event impacts occurring today in business, especially related to Cybersecurity and Cyber Insecurity, occur because individuals did not practice the same level of acceptance and ownership of their roles as Managers of Risk in their business lives as they do every day when they leave their work environments and enter their personal life environments. If we did, no staff member, manager, or executive of a company would ever click on a phishing link, be fooled by social scamming, or not fund mandatory security awareness training and certification for every employee of a company, from bottom to top.</p><p>In my next blog post, it is my intention to explore Systemic Risk in Business with you.&nbsp;</p><p><em>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</em></p><p><strong>Joseph F. Norton </strong>is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,68,161,'en',0,'<p>My last blog post presented the changes released by the Security and Exchange Commission on July 26, 2023 to their “SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure by Public Companies.”</p><p>These changes are quite impactful to Public Companies and their regulatory reporting concerning cybersecurity and have been welcomed by professional practitioners in the cybersecurity fields. Some of us may wish that the SEC had gone a little further in and with their new rules, but …. progress is progress. If you are a member of a private company breathing a sigh of relief that you are not “required” to make such reporting and disclosures, I would suggest that you take a close look at these new SEC Rules and consider how your Cybersecurity practices compare to these “rules” for public companies. I will be coming back to this topic in future posts to explore some of these new rules in more depth. These are just a small sample of things we learn about as children that can harm us or cause injury.</p><p><strong>These are threats to our well-being.</strong></p><p>These four threats are very specific. Each of these threats has a specific range of impacts. We can easily be hit by a car when crossing a street and be injured or killed. Some strangers may wish to do us physical harm. Being struck by lightning will cause grievous bodily harm or outright death. We can easily suffer frostbite or hypothermia and potential death if exposed to cold temperatures for an extended period.</p><p>The specific actions we have been taught as children to avoid harm are very specific <strong>threat avoidance and mitigation actions</strong> we can practice.</p><p>Every time we check traffic before crossing a street or intersection to determine if we can cross safely,<strong> we are evaluating the probability of a potential event, </strong>i.e., that we may be struck and injured by a vehicle.</p><p>Practicing <strong>Risk Management</strong> in our personal lives is no different from practicing Risk Management in our business lives and roles! Risk Management entails:</p><ol><li>Acknowledging that Threats Exist</li><li>Determining the probability that a potential Threat will occur.</li><li>Understanding and assessing the potential Impact of a Threat Event if it occurs.</li><li>Ranking or Scoring Threat Risks for their Impacts (I.E., Probability X Impact = Risk Score)</li><li>Implementing Risk Actions / Plans to avoid and/or mitigate the impact of Threat Events.</li></ol><p>&nbsp;</p><p><strong>Effective Risk Management requires both Knowing and Doing</strong></p><p>Now, let me circle back to Risk Behaviors. I stated earlier that throughout my career I have been amazed by the disconnect I have seen and experienced between the way we behave in our personal lives as compared to how we behave in our business lives regarding Risk. In our daily lives, we naturally embrace our roles as Risk Managers for our own safety, and the safety of our family members and loved ones. Yet it always seems that as soon as we enter our work environments (in an office place or remotely from home or hotel) we often witness employees, at staff, management, and executive levels, unconsciously ignore or abandon any sense of understanding of Business Risk. Most Risk Event impacts occurring today in business, especially related to Cybersecurity and Cyber Insecurity, occur because individuals did not practice the same level of acceptance and ownership of their roles as Managers of Risk in their business lives as they do every day when they leave their work environments and enter their personal life environments. If we did, no staff member, manager, or executive of a company would ever click on a phishing link, be fooled by social scamming, or not fund mandatory security awareness training and certification for every employee of a company, from bottom to top.</p><p>In my next blog post, it is my intention to explore Systemic Risk in Business with you.&nbsp;</p><p><em>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</em></p><p><strong>Joseph F. Norton </strong>is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,68,245,'en',0,'<p>My last blog post presented the changes released by the Security and Exchange Commission on July 26, 2023 to their “SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure by Public Companies.”</p><p>These changes are quite impactful to Public Companies and their regulatory reporting concerning cybersecurity and have been welcomed by professional practitioners in the cybersecurity fields. Some of us may wish that the SEC had gone a little further in and with their new rules, but …. progress is progress. If you are a member of a private company breathing a sigh of relief that you are not “required” to make such reporting and disclosures, I would suggest that you take a close look at these new SEC Rules and consider how your Cybersecurity practices compare to these “rules” for public companies. I will be coming back to this topic in future posts to explore some of these new rules in more depth. These are just a small sample of things we learn about as children that can harm us or cause injury.</p><p><strong>These are threats to our well-being.</strong></p><p>These four threats are very specific. Each of these threats has a specific range of impacts. We can easily be hit by a car when crossing a street and be injured or killed. Some strangers may wish to do us physical harm. Being struck by lightning will cause grievous bodily harm or outright death. We can easily suffer frostbite or hypothermia and potential death if exposed to cold temperatures for an extended period.</p><p>The specific actions we have been taught as children to avoid harm are very specific <strong>threat avoidance and mitigation actions</strong> we can practice.</p><p>Every time we check traffic before crossing a street or intersection to determine if we can cross safely,<strong> we are evaluating the probability of a potential event, </strong>i.e., that we may be struck and injured by a vehicle.</p><p>Practicing <strong>Risk Management</strong> in our personal lives is no different from practicing Risk Management in our business lives and roles! Risk Management entails:</p><ol><li>Acknowledging that Threats Exist</li><li>Determining the probability that a potential Threat will occur.</li><li>Understanding and assessing the potential Impact of a Threat Event if it occurs.</li><li>Ranking or Scoring Threat Risks for their Impacts (I.E., Probability X Impact = Risk Score)</li><li>Implementing Risk Actions / Plans to avoid and/or mitigate the impact of Threat Events.</li></ol><p>&nbsp;</p><p><strong>Effective Risk Management requires both Knowing and Doing</strong></p><p>Now, let me circle back to Risk Behaviors. I stated earlier that throughout my career I have been amazed by the disconnect I have seen and experienced between the way we behave in our personal lives as compared to how we behave in our business lives regarding Risk. In our daily lives, we naturally embrace our roles as Risk Managers for our own safety, and the safety of our family members and loved ones. Yet it always seems that as soon as we enter our work environments (in an office place or remotely from home or hotel) we often witness employees, at staff, management, and executive levels, unconsciously ignore or abandon any sense of understanding of Business Risk. Most Risk Event impacts occurring today in business, especially related to Cybersecurity and Cyber Insecurity, occur because individuals did not practice the same level of acceptance and ownership of their roles as Managers of Risk in their business lives as they do every day when they leave their work environments and enter their personal life environments. If we did, no staff member, manager, or executive of a company would ever click on a phishing link, be fooled by social scamming, or not fund mandatory security awareness training and certification for every employee of a company, from bottom to top.</p><p>In my next blog post, it is my intention to explore Systemic Risk in Business with you.&nbsp;</p><p><em>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</em></p><p><strong>Joseph F. Norton </strong>is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,68,399,'en',0,'<p>My last blog post presented the changes released by the Security and Exchange Commission on July 26, 2023 to their “SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure by Public Companies.”</p><p>These changes are quite impactful to Public Companies and their regulatory reporting concerning cybersecurity and have been welcomed by professional practitioners in the cybersecurity fields. Some of us may wish that the SEC had gone a little further in and with their new rules, but …. progress is progress. If you are a member of a private company breathing a sigh of relief that you are not “required” to make such reporting and disclosures, I would suggest that you take a close look at these new SEC Rules and consider how your Cybersecurity practices compare to these “rules” for public companies. I will be coming back to this topic in future posts to explore some of these new rules in more depth. These are just a small sample of things we learn about as children that can harm us or cause injury.</p><p><strong>These are threats to our well-being.</strong></p><p>These four threats are very specific. Each of these threats has a specific range of impacts. We can easily be hit by a car when crossing a street and be injured or killed. Some strangers may wish to do us physical harm. Being struck by lightning will cause grievous bodily harm or outright death. We can easily suffer frostbite or hypothermia and potential death if exposed to cold temperatures for an extended period.</p><p>The specific actions we have been taught as children to avoid harm are very specific <strong>threat avoidance and mitigation actions</strong> we can practice.</p><p>Every time we check traffic before crossing a street or intersection to determine if we can cross safely,<strong> we are evaluating the probability of a potential event, </strong>i.e., that we may be struck and injured by a vehicle.</p><p>Practicing <strong>Risk Management</strong> in our personal lives is no different from practicing Risk Management in our business lives and roles! Risk Management entails:</p><ol><li>Acknowledging that Threats Exist</li><li>Determining the probability that a potential Threat will occur.</li><li>Understanding and assessing the potential Impact of a Threat Event if it occurs.</li><li>Ranking or Scoring Threat Risks for their Impacts (I.E., Probability X Impact = Risk Score)</li><li>Implementing Risk Actions / Plans to avoid and/or mitigate the impact of Threat Events.</li></ol><p>&nbsp;</p><p><strong>Effective Risk Management requires both Knowing and Doing</strong></p><p>Now, let me circle back to Risk Behaviors. I stated earlier that throughout my career I have been amazed by the disconnect I have seen and experienced between the way we behave in our personal lives as compared to how we behave in our business lives regarding Risk. In our daily lives, we naturally embrace our roles as Risk Managers for our own safety, and the safety of our family members and loved ones. Yet it always seems that as soon as we enter our work environments (in an office place or remotely from home or hotel) we often witness employees, at staff, management, and executive levels, unconsciously ignore or abandon any sense of understanding of Business Risk. Most Risk Event impacts occurring today in business, especially related to Cybersecurity and Cyber Insecurity, occur because individuals did not practice the same level of acceptance and ownership of their roles as Managers of Risk in their business lives as they do every day when they leave their work environments and enter their personal life environments. If we did, no staff member, manager, or executive of a company would ever click on a phishing link, be fooled by social scamming, or not fund mandatory security awareness training and certification for every employee of a company, from bottom to top.</p><p>In my next blog post, it is my intention to explore Systemic Risk in Business with you.&nbsp;</p><p><em>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</em></p><p><strong>Joseph F. Norton </strong>is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,68,472,'en',0,'<p>My last blog post presented the changes released by the Security and Exchange Commission on July 26, 2023 to their “SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure by Public Companies.”</p><p>These changes are quite impactful to Public Companies and their regulatory reporting concerning cybersecurity and have been welcomed by professional practitioners in the cybersecurity fields. Some of us may wish that the SEC had gone a little further in and with their new rules, but …. progress is progress. If you are a member of a private company breathing a sigh of relief that you are not “required” to make such reporting and disclosures, I would suggest that you take a close look at these new SEC Rules and consider how your Cybersecurity practices compare to these “rules” for public companies. I will be coming back to this topic in future posts to explore some of these new rules in more depth. These are just a small sample of things we learn about as children that can harm us or cause injury.</p><p><strong>These are threats to our well-being.</strong></p><p>These four threats are very specific. Each of these threats has a specific range of impacts. We can easily be hit by a car when crossing a street and be injured or killed. Some strangers may wish to do us physical harm. Being struck by lightning will cause grievous bodily harm or outright death. We can easily suffer frostbite or hypothermia and potential death if exposed to cold temperatures for an extended period.</p><p>The specific actions we have been taught as children to avoid harm are very specific <strong>threat avoidance and mitigation actions</strong> we can practice.</p><p>Every time we check traffic before crossing a street or intersection to determine if we can cross safely,<strong> we are evaluating the probability of a potential event, </strong>i.e., that we may be struck and injured by a vehicle.</p><p>Practicing <strong>Risk Management</strong> in our personal lives is no different from practicing Risk Management in our business lives and roles! Risk Management entails:</p><ol><li>Acknowledging that Threats Exist</li><li>Determining the probability that a potential Threat will occur.</li><li>Understanding and assessing the potential Impact of a Threat Event if it occurs.</li><li>Ranking or Scoring Threat Risks for their Impacts (I.E., Probability X Impact = Risk Score)</li><li>Implementing Risk Actions / Plans to avoid and/or mitigate the impact of Threat Events.</li></ol><p>&nbsp;</p><p><strong>Effective Risk Management requires both Knowing and Doing</strong></p><p>Now, let me circle back to Risk Behaviors. I stated earlier that throughout my career I have been amazed by the disconnect I have seen and experienced between the way we behave in our personal lives as compared to how we behave in our business lives regarding Risk. In our daily lives, we naturally embrace our roles as Risk Managers for our own safety, and the safety of our family members and loved ones. Yet it always seems that as soon as we enter our work environments (in an office place or remotely from home or hotel) we often witness employees, at staff, management, and executive levels, unconsciously ignore or abandon any sense of understanding of Business Risk. Most Risk Event impacts occurring today in business, especially related to Cybersecurity and Cyber Insecurity, occur because individuals did not practice the same level of acceptance and ownership of their roles as Managers of Risk in their business lives as they do every day when they leave their work environments and enter their personal life environments. If we did, no staff member, manager, or executive of a company would ever click on a phishing link, be fooled by social scamming, or not fund mandatory security awareness training and certification for every employee of a company, from bottom to top.</p><p>In my next blog post, it is my intention to explore Systemic Risk in Business with you.&nbsp;</p><p><em>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</em></p><p><strong>Joseph F. Norton </strong>is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,68,552,'en',0,'<p>My last blog post presented the changes released by the Security and Exchange Commission on July 26, 2023 to their “SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure by Public Companies.”</p><p>These changes are quite impactful to Public Companies and their regulatory reporting concerning cybersecurity and have been welcomed by professional practitioners in the cybersecurity fields. Some of us may wish that the SEC had gone a little further in and with their new rules, but …. progress is progress. If you are a member of a private company breathing a sigh of relief that you are not “required” to make such reporting and disclosures, I would suggest that you take a close look at these new SEC Rules and consider how your Cybersecurity practices compare to these “rules” for public companies. I will be coming back to this topic in future posts to explore some of these new rules in more depth. These are just a small sample of things we learn about as children that can harm us or cause injury.</p><p><strong>These are threats to our well-being.</strong></p><p>These four threats are very specific. Each of these threats has a specific range of impacts. We can easily be hit by a car when crossing a street and be injured or killed. Some strangers may wish to do us physical harm. Being struck by lightning will cause grievous bodily harm or outright death. We can easily suffer frostbite or hypothermia and potential death if exposed to cold temperatures for an extended period.</p><p>The specific actions we have been taught as children to avoid harm are very specific <strong>threat avoidance and mitigation actions</strong> we can practice.</p><p>Every time we check traffic before crossing a street or intersection to determine if we can cross safely,<strong> we are evaluating the probability of a potential event, </strong>i.e., that we may be struck and injured by a vehicle.</p><p>Practicing <strong>Risk Management</strong> in our personal lives is no different from practicing Risk Management in our business lives and roles! Risk Management entails:</p><ol><li>Acknowledging that Threats Exist</li><li>Determining the probability that a potential Threat will occur.</li><li>Understanding and assessing the potential Impact of a Threat Event if it occurs.</li><li>Ranking or Scoring Threat Risks for their Impacts (I.E., Probability X Impact = Risk Score)</li><li>Implementing Risk Actions / Plans to avoid and/or mitigate the impact of Threat Events.</li></ol><p>&nbsp;</p><p><strong>Effective Risk Management requires both Knowing and Doing</strong></p><p>Now, let me circle back to Risk Behaviors. I stated earlier that throughout my career I have been amazed by the disconnect I have seen and experienced between the way we behave in our personal lives as compared to how we behave in our business lives regarding Risk. In our daily lives, we naturally embrace our roles as Risk Managers for our own safety, and the safety of our family members and loved ones. Yet it always seems that as soon as we enter our work environments (in an office place or remotely from home or hotel) we often witness employees, at staff, management, and executive levels, unconsciously ignore or abandon any sense of understanding of Business Risk. Most Risk Event impacts occurring today in business, especially related to Cybersecurity and Cyber Insecurity, occur because individuals did not practice the same level of acceptance and ownership of their roles as Managers of Risk in their business lives as they do every day when they leave their work environments and enter their personal life environments. If we did, no staff member, manager, or executive of a company would ever click on a phishing link, be fooled by social scamming, or not fund mandatory security awareness training and certification for every employee of a company, from bottom to top.</p><p>In my next blog post, it is my intention to explore Systemic Risk in Business with you.&nbsp;</p><p><em>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</em></p><p><strong>Joseph F. Norton </strong>is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,68,627,'en',0,'<p>My last blog post presented the changes released by the Security and Exchange Commission on July 26, 2023 to their “SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure by Public Companies.”</p><p>These changes are quite impactful to Public Companies and their regulatory reporting concerning cybersecurity and have been welcomed by professional practitioners in the cybersecurity fields. Some of us may wish that the SEC had gone a little further in and with their new rules, but …. progress is progress. If you are a member of a private company breathing a sigh of relief that you are not “required” to make such reporting and disclosures, I would suggest that you take a close look at these new SEC Rules and consider how your Cybersecurity practices compare to these “rules” for public companies. I will be coming back to this topic in future posts to explore some of these new rules in more depth. These are just a small sample of things we learn about as children that can harm us or cause injury.</p><p><strong>These are threats to our well-being.</strong></p><p>These four threats are very specific. Each of these threats has a specific range of impacts. We can easily be hit by a car when crossing a street and be injured or killed. Some strangers may wish to do us physical harm. Being struck by lightning will cause grievous bodily harm or outright death. We can easily suffer frostbite or hypothermia and potential death if exposed to cold temperatures for an extended period.</p><p>The specific actions we have been taught as children to avoid harm are very specific <strong>threat avoidance and mitigation actions</strong> we can practice.</p><p>Every time we check traffic before crossing a street or intersection to determine if we can cross safely,<strong> we are evaluating the probability of a potential event, </strong>i.e., that we may be struck and injured by a vehicle.</p><p>Practicing <strong>Risk Management</strong> in our personal lives is no different from practicing Risk Management in our business lives and roles! Risk Management entails:</p><ol><li>Acknowledging that Threats Exist</li><li>Determining the probability that a potential Threat will occur.</li><li>Understanding and assessing the potential Impact of a Threat Event if it occurs.</li><li>Ranking or Scoring Threat Risks for their Impacts (I.E., Probability X Impact = Risk Score)</li><li>Implementing Risk Actions / Plans to avoid and/or mitigate the impact of Threat Events.</li></ol><p>&nbsp;</p><p><strong>Effective Risk Management requires both Knowing and Doing</strong></p><p>Now, let me circle back to Risk Behaviors. I stated earlier that throughout my career I have been amazed by the disconnect I have seen and experienced between the way we behave in our personal lives as compared to how we behave in our business lives regarding Risk. In our daily lives, we naturally embrace our roles as Risk Managers for our own safety, and the safety of our family members and loved ones. Yet it always seems that as soon as we enter our work environments (in an office place or remotely from home or hotel) we often witness employees, at staff, management, and executive levels, unconsciously ignore or abandon any sense of understanding of Business Risk. Most Risk Event impacts occurring today in business, especially related to Cybersecurity and Cyber Insecurity, occur because individuals did not practice the same level of acceptance and ownership of their roles as Managers of Risk in their business lives as they do every day when they leave their work environments and enter their personal life environments. If we did, no staff member, manager, or executive of a company would ever click on a phishing link, be fooled by social scamming, or not fund mandatory security awareness training and certification for every employee of a company, from bottom to top.</p><p>In my next blog post, it is my intention to explore Systemic Risk in Business with you.&nbsp;</p><p><em>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</em></p><p><strong>Joseph F. Norton </strong>is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,68,816,'en',0,'<p>My last blog post presented the changes released by the Security and Exchange Commission on July 26, 2023 to their “SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure by Public Companies.”</p><p>These changes are quite impactful to Public Companies and their regulatory reporting concerning cybersecurity and have been welcomed by professional practitioners in the cybersecurity fields. Some of us may wish that the SEC had gone a little further in and with their new rules, but …. progress is progress. If you are a member of a private company breathing a sigh of relief that you are not “required” to make such reporting and disclosures, I would suggest that you take a close look at these new SEC Rules and consider how your Cybersecurity practices compare to these “rules” for public companies. I will be coming back to this topic in future posts to explore some of these new rules in more depth. These are just a small sample of things we learn about as children that can harm us or cause injury.</p><p><strong>These are threats to our well-being.</strong></p><p>These four threats are very specific. Each of these threats has a specific range of impacts. We can easily be hit by a car when crossing a street and be injured or killed. Some strangers may wish to do us physical harm. Being struck by lightning will cause grievous bodily harm or outright death. We can easily suffer frostbite or hypothermia and potential death if exposed to cold temperatures for an extended period.</p><p>The specific actions we have been taught as children to avoid harm are very specific <strong>threat avoidance and mitigation actions</strong> we can practice.</p><p>Every time we check traffic before crossing a street or intersection to determine if we can cross safely,<strong> we are evaluating the probability of a potential event, </strong>i.e., that we may be struck and injured by a vehicle.</p><p>Practicing <strong>Risk Management</strong> in our personal lives is no different from practicing Risk Management in our business lives and roles! Risk Management entails:</p><ol><li>Acknowledging that Threats Exist</li><li>Determining the probability that a potential Threat will occur.</li><li>Understanding and assessing the potential Impact of a Threat Event if it occurs.</li><li>Ranking or Scoring Threat Risks for their Impacts (I.E., Probability X Impact = Risk Score)</li><li>Implementing Risk Actions / Plans to avoid and/or mitigate the impact of Threat Events.</li></ol><p>&nbsp;</p><p><strong>Effective Risk Management requires both Knowing and Doing</strong></p><p>Now, let me circle back to Risk Behaviors. I stated earlier that throughout my career I have been amazed by the disconnect I have seen and experienced between the way we behave in our personal lives as compared to how we behave in our business lives regarding Risk. In our daily lives, we naturally embrace our roles as Risk Managers for our own safety, and the safety of our family members and loved ones. Yet it always seems that as soon as we enter our work environments (in an office place or remotely from home or hotel) we often witness employees, at staff, management, and executive levels, unconsciously ignore or abandon any sense of understanding of Business Risk. Most Risk Event impacts occurring today in business, especially related to Cybersecurity and Cyber Insecurity, occur because individuals did not practice the same level of acceptance and ownership of their roles as Managers of Risk in their business lives as they do every day when they leave their work environments and enter their personal life environments. If we did, no staff member, manager, or executive of a company would ever click on a phishing link, be fooled by social scamming, or not fund mandatory security awareness training and certification for every employee of a company, from bottom to top.</p><p>In my next blog post, it is my intention to explore Systemic Risk in Business with you.&nbsp;</p><p><em>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</em></p><p><strong>Joseph F. Norton </strong>is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('featured_article',0,70,163,'en',0,'<p>The level of the negative hype surpassed that of Y2K when the wrong date-handling code embedded in every device was to have been so confused by the rollover from 1999 to 2000 that the world would come crashing to a halt, figuratively if not literally.</p><p>Elevators would drop from the top floors of every building, trains would derail, planes would fall from the sky, and microwave ovens would do who-knows-what to us all. That, or nothing at all, would happen, depending on who was hypothesizing. In hindsight, while it is apparent that the risk of Y2K was mostly overblown, it is helpful to remember that it is at least partly due to the amount of preparation and investment that went towards avoiding the worst potential outcomes.</p><p>We are currently witnessing a significant and rapid growth in the capabilities of AI, in some cases on a near-daily basis. It is driven by huge investments from many top U.S. tech companies and fueled by an unprecedented public interest in heading-grabbing examples like Open AI’s ChatGPT and DALL-E, Google’s Bard, Microsoft’s Bing, and many others.</p><p>These solutions are based on large-language models (LLMs) or large-image models (LIMs), which take vast amounts of text- or image-based data and use it to train a machine-learning model. The resulting LLM or LIM can then be used to generate output in the form of writing or pictures, which can be both beneficial and often convincingly human (aka <strong>Generative AI</strong>)</p><p>There has long been a keen interest in creating machines that can ‘exhibit cognitive capabilities and conversational skills’ to rival human beings. The first functional chatbot was <strong>ELIZA</strong>, a natural language processing program designed at <strong>MIT </strong>by <strong>Joseph Weizenbaum</strong> in the mid-1960s.</p><p>The program prompts the user to enter a comment or question, and ELIZA’s response algorithm looks for specific keywords in the input and pseudo-randomly picks a response from a pre-defined list of phrases. It repeats the prompt-and-respond loop until the program is terminated. The result resembles a back-and-forth ‘conversation’ between the user and the computer. That made ELIZA one of the first programs that could even attempt to pass the famous <strong>Turing Test</strong>, in which ‘artificial intelligence’ is measured by the ability of a machine to convince humans that it is ‘human’ as well.</p><p>ELIZA’s method of processing input keywords and generating output phrases is designed to mimic a <strong>person-centred psychotherapy</strong> approach in the style of Carl Rogers, in which the therapist often reflects the patient’s words to the patient. That’s pretty much the same thing that all modern LLMs do, and they have a keyword list that’s a billion times bigger than ELIZA’s and a much better method for calculating responses. That means they can be much more human-like in their responses and much broader regarding the types of input they can successfully process. They can be so convincing that purveyors of public AI solutions have had to inject more caveats continually, disclaimers, and external references to limit potential harm and liability.</p><p>While today’s publicly available generative AI solutions are far superior to ELIZA in nearly every conceivable way, there is one significant advantage that ELIZA still has – PRIVACY. When you share your most important secrets with your computer-based therapist, and it’s ELIZA, you can be sure that it will keep your input safe (assuming a fully secured or entirely disconnected computing environment).</p><p>ELIZA’s entire codebase is publicly available, making the input-to-output process transparent and understandable. Unfortunately, the same can’t be said if your computer-based therapist is ChatGPT, Bard, Bing, or any other Generative AI offering. With them, you can be sure that the therapist-patient confidentiality agreement WILL be broken when the AI engine adds whatever comments, questions, and secrets you share into its gigantic database of material used to fuel its ongoing learning processes.</p><p>If you want to avoid, or at least minimize, the risks and pitfalls that come along with the potential productivity benefits of public generative AI, remembering past lessons is helpful. ELIZA provided a preview of modern chatbots and other generative AI solutions and served as an excellent example of the main differences between public (external) and private (internal only) artificial intelligence implementations. Y2K showed that it is better to prepare for the worst than to be unpleasantly surprised by it. Mainly when ‘worst’ might someday actually include killer robots from the future.</p>','','full_html'),('featured_article',0,70,168,'en',0,'<p>The level of the negative hype surpassed that of Y2K when the wrong date-handling code embedded in every device was to have been so confused by the rollover from 1999 to 2000 that the world would come crashing to a halt, figuratively if not literally.</p><p>Elevators would drop from the top floors of every building, trains would derail, planes would fall from the sky, and microwave ovens would do who-knows-what to us all. That, or nothing at all, would happen, depending on who was hypothesizing. In hindsight, while it is apparent that the risk of Y2K was mostly overblown, it is helpful to remember that it is at least partly due to the amount of preparation and investment that went towards avoiding the worst potential outcomes.</p><p>We are currently witnessing a significant and rapid growth in the capabilities of AI, in some cases on a near-daily basis. It is driven by huge investments from many top U.S. tech companies and fueled by an unprecedented public interest in heading-grabbing examples like Open AI’s ChatGPT and DALL-E, Google’s Bard, Microsoft’s Bing, and many others.</p><p>These solutions are based on large-language models (LLMs) or large-image models (LIMs), which take vast amounts of text- or image-based data and use it to train a machine-learning model. The resulting LLM or LIM can then be used to generate output in the form of writing or pictures, which can be both beneficial and often convincingly human (aka <strong>Generative AI</strong>)</p><p>There has long been a keen interest in creating machines that can ‘exhibit cognitive capabilities and conversational skills’ to rival human beings. The first functional chatbot was <strong>ELIZA</strong>, a natural language processing program designed at <strong>MIT </strong>by <strong>Joseph Weizenbaum</strong> in the mid-1960s.</p><p>The program prompts the user to enter a comment or question, and ELIZA’s response algorithm looks for specific keywords in the input and pseudo-randomly picks a response from a pre-defined list of phrases. It repeats the prompt-and-respond loop until the program is terminated. The result resembles a back-and-forth ‘conversation’ between the user and the computer. That made ELIZA one of the first programs that could even attempt to pass the famous <strong>Turing Test</strong>, in which ‘artificial intelligence’ is measured by the ability of a machine to convince humans that it is ‘human’ as well.</p><p>ELIZA’s method of processing input keywords and generating output phrases is designed to mimic a <strong>person-centred psychotherapy</strong> approach in the style of Carl Rogers, in which the therapist often reflects the patient’s words to the patient. That’s pretty much the same thing that all modern LLMs do, and they have a keyword list that’s a billion times bigger than ELIZA’s and a much better method for calculating responses. That means they can be much more human-like in their responses and much broader regarding the types of input they can successfully process. They can be so convincing that purveyors of public AI solutions have had to inject more caveats continually, disclaimers, and external references to limit potential harm and liability.</p><p>While today’s publicly available generative AI solutions are far superior to ELIZA in nearly every conceivable way, there is one significant advantage that ELIZA still has – PRIVACY. When you share your most important secrets with your computer-based therapist, and it’s ELIZA, you can be sure that it will keep your input safe (assuming a fully secured or entirely disconnected computing environment).</p><p>ELIZA’s entire codebase is publicly available, making the input-to-output process transparent and understandable. Unfortunately, the same can’t be said if your computer-based therapist is ChatGPT, Bard, Bing, or any other Generative AI offering. With them, you can be sure that the therapist-patient confidentiality agreement WILL be broken when the AI engine adds whatever comments, questions, and secrets you share into its gigantic database of material used to fuel its ongoing learning processes.</p><p>If you want to avoid, or at least minimize, the risks and pitfalls that come along with the potential productivity benefits of public generative AI, remembering past lessons is helpful. ELIZA provided a preview of modern chatbots and other generative AI solutions and served as an excellent example of the main differences between public (external) and private (internal only) artificial intelligence implementations. Y2K showed that it is better to prepare for the worst than to be unpleasantly surprised by it. Mainly when ‘worst’ might someday actually include killer robots from the future.</p>','','full_html'),('featured_article',0,70,261,'en',0,'<p>The level of the negative hype surpassed that of Y2K when the wrong date-handling code embedded in every device was to have been so confused by the rollover from 1999 to 2000 that the world would come crashing to a halt, figuratively if not literally.</p><p>Elevators would drop from the top floors of every building, trains would derail, planes would fall from the sky, and microwave ovens would do who-knows-what to us all. That, or nothing at all, would happen, depending on who was hypothesizing. In hindsight, while it is apparent that the risk of Y2K was mostly overblown, it is helpful to remember that it is at least partly due to the amount of preparation and investment that went towards avoiding the worst potential outcomes.</p><p>We are currently witnessing a significant and rapid growth in the capabilities of AI, in some cases on a near-daily basis. It is driven by huge investments from many top U.S. tech companies and fueled by an unprecedented public interest in heading-grabbing examples like Open AI’s ChatGPT and DALL-E, Google’s Bard, Microsoft’s Bing, and many others.</p><p>These solutions are based on large-language models (LLMs) or large-image models (LIMs), which take vast amounts of text- or image-based data and use it to train a machine-learning model. The resulting LLM or LIM can then be used to generate output in the form of writing or pictures, which can be both beneficial and often convincingly human (aka <strong>Generative AI</strong>)</p><p>There has long been a keen interest in creating machines that can ‘exhibit cognitive capabilities and conversational skills’ to rival human beings. The first functional chatbot was <strong>ELIZA</strong>, a natural language processing program designed at <strong>MIT </strong>by <strong>Joseph Weizenbaum</strong> in the mid-1960s.</p><p>The program prompts the user to enter a comment or question, and ELIZA’s response algorithm looks for specific keywords in the input and pseudo-randomly picks a response from a pre-defined list of phrases. It repeats the prompt-and-respond loop until the program is terminated. The result resembles a back-and-forth ‘conversation’ between the user and the computer. That made ELIZA one of the first programs that could even attempt to pass the famous <strong>Turing Test</strong>, in which ‘artificial intelligence’ is measured by the ability of a machine to convince humans that it is ‘human’ as well.</p><p>ELIZA’s method of processing input keywords and generating output phrases is designed to mimic a <strong>person-centred psychotherapy</strong> approach in the style of Carl Rogers, in which the therapist often reflects the patient’s words to the patient. That’s pretty much the same thing that all modern LLMs do, and they have a keyword list that’s a billion times bigger than ELIZA’s and a much better method for calculating responses. That means they can be much more human-like in their responses and much broader regarding the types of input they can successfully process. They can be so convincing that purveyors of public AI solutions have had to inject more caveats continually, disclaimers, and external references to limit potential harm and liability.</p><p>While today’s publicly available generative AI solutions are far superior to ELIZA in nearly every conceivable way, there is one significant advantage that ELIZA still has – PRIVACY. When you share your most important secrets with your computer-based therapist, and it’s ELIZA, you can be sure that it will keep your input safe (assuming a fully secured or entirely disconnected computing environment).</p><p>ELIZA’s entire codebase is publicly available, making the input-to-output process transparent and understandable. Unfortunately, the same can’t be said if your computer-based therapist is ChatGPT, Bard, Bing, or any other Generative AI offering. With them, you can be sure that the therapist-patient confidentiality agreement WILL be broken when the AI engine adds whatever comments, questions, and secrets you share into its gigantic database of material used to fuel its ongoing learning processes.</p><p>If you want to avoid, or at least minimize, the risks and pitfalls that come along with the potential productivity benefits of public generative AI, remembering past lessons is helpful. ELIZA provided a preview of modern chatbots and other generative AI solutions and served as an excellent example of the main differences between public (external) and private (internal only) artificial intelligence implementations. Y2K showed that it is better to prepare for the worst than to be unpleasantly surprised by it. Mainly when ‘worst’ might someday actually include killer robots from the future.</p>','','full_html'),('featured_article',0,70,473,'en',0,'<p>The level of the negative hype surpassed that of Y2K when the wrong date-handling code embedded in every device was to have been so confused by the rollover from 1999 to 2000 that the world would come crashing to a halt, figuratively if not literally.</p><p>Elevators would drop from the top floors of every building, trains would derail, planes would fall from the sky, and microwave ovens would do who-knows-what to us all. That, or nothing at all, would happen, depending on who was hypothesizing. In hindsight, while it is apparent that the risk of Y2K was mostly overblown, it is helpful to remember that it is at least partly due to the amount of preparation and investment that went towards avoiding the worst potential outcomes.</p><p>We are currently witnessing a significant and rapid growth in the capabilities of AI, in some cases on a near-daily basis. It is driven by huge investments from many top U.S. tech companies and fueled by an unprecedented public interest in heading-grabbing examples like Open AI’s ChatGPT and DALL-E, Google’s Bard, Microsoft’s Bing, and many others.</p><p>These solutions are based on large-language models (LLMs) or large-image models (LIMs), which take vast amounts of text- or image-based data and use it to train a machine-learning model. The resulting LLM or LIM can then be used to generate output in the form of writing or pictures, which can be both beneficial and often convincingly human (aka <strong>Generative AI</strong>)</p><p>There has long been a keen interest in creating machines that can ‘exhibit cognitive capabilities and conversational skills’ to rival human beings. The first functional chatbot was <strong>ELIZA</strong>, a natural language processing program designed at <strong>MIT </strong>by <strong>Joseph Weizenbaum</strong> in the mid-1960s.</p><p>The program prompts the user to enter a comment or question, and ELIZA’s response algorithm looks for specific keywords in the input and pseudo-randomly picks a response from a pre-defined list of phrases. It repeats the prompt-and-respond loop until the program is terminated. The result resembles a back-and-forth ‘conversation’ between the user and the computer. That made ELIZA one of the first programs that could even attempt to pass the famous <strong>Turing Test</strong>, in which ‘artificial intelligence’ is measured by the ability of a machine to convince humans that it is ‘human’ as well.</p><p>ELIZA’s method of processing input keywords and generating output phrases is designed to mimic a <strong>person-centred psychotherapy</strong> approach in the style of Carl Rogers, in which the therapist often reflects the patient’s words to the patient. That’s pretty much the same thing that all modern LLMs do, and they have a keyword list that’s a billion times bigger than ELIZA’s and a much better method for calculating responses. That means they can be much more human-like in their responses and much broader regarding the types of input they can successfully process. They can be so convincing that purveyors of public AI solutions have had to inject more caveats continually, disclaimers, and external references to limit potential harm and liability.</p><p>While today’s publicly available generative AI solutions are far superior to ELIZA in nearly every conceivable way, there is one significant advantage that ELIZA still has – PRIVACY. When you share your most important secrets with your computer-based therapist, and it’s ELIZA, you can be sure that it will keep your input safe (assuming a fully secured or entirely disconnected computing environment).</p><p>ELIZA’s entire codebase is publicly available, making the input-to-output process transparent and understandable. Unfortunately, the same can’t be said if your computer-based therapist is ChatGPT, Bard, Bing, or any other Generative AI offering. With them, you can be sure that the therapist-patient confidentiality agreement WILL be broken when the AI engine adds whatever comments, questions, and secrets you share into its gigantic database of material used to fuel its ongoing learning processes.</p><p>If you want to avoid, or at least minimize, the risks and pitfalls that come along with the potential productivity benefits of public generative AI, remembering past lessons is helpful. ELIZA provided a preview of modern chatbots and other generative AI solutions and served as an excellent example of the main differences between public (external) and private (internal only) artificial intelligence implementations. Y2K showed that it is better to prepare for the worst than to be unpleasantly surprised by it. Mainly when ‘worst’ might someday actually include killer robots from the future.</p>','','full_html'),('featured_article',0,70,553,'en',0,'<p>The level of the negative hype surpassed that of Y2K when the wrong date-handling code embedded in every device was to have been so confused by the rollover from 1999 to 2000 that the world would come crashing to a halt, figuratively if not literally.</p><p>Elevators would drop from the top floors of every building, trains would derail, planes would fall from the sky, and microwave ovens would do who-knows-what to us all. That, or nothing at all, would happen, depending on who was hypothesizing. In hindsight, while it is apparent that the risk of Y2K was mostly overblown, it is helpful to remember that it is at least partly due to the amount of preparation and investment that went towards avoiding the worst potential outcomes.</p><p>We are currently witnessing a significant and rapid growth in the capabilities of AI, in some cases on a near-daily basis. It is driven by huge investments from many top U.S. tech companies and fueled by an unprecedented public interest in heading-grabbing examples like Open AI’s ChatGPT and DALL-E, Google’s Bard, Microsoft’s Bing, and many others.</p><p>These solutions are based on large-language models (LLMs) or large-image models (LIMs), which take vast amounts of text- or image-based data and use it to train a machine-learning model. The resulting LLM or LIM can then be used to generate output in the form of writing or pictures, which can be both beneficial and often convincingly human (aka <strong>Generative AI</strong>)</p><p>There has long been a keen interest in creating machines that can ‘exhibit cognitive capabilities and conversational skills’ to rival human beings. The first functional chatbot was <strong>ELIZA</strong>, a natural language processing program designed at <strong>MIT </strong>by <strong>Joseph Weizenbaum</strong> in the mid-1960s.</p><p>The program prompts the user to enter a comment or question, and ELIZA’s response algorithm looks for specific keywords in the input and pseudo-randomly picks a response from a pre-defined list of phrases. It repeats the prompt-and-respond loop until the program is terminated. The result resembles a back-and-forth ‘conversation’ between the user and the computer. That made ELIZA one of the first programs that could even attempt to pass the famous <strong>Turing Test</strong>, in which ‘artificial intelligence’ is measured by the ability of a machine to convince humans that it is ‘human’ as well.</p><p>ELIZA’s method of processing input keywords and generating output phrases is designed to mimic a <strong>person-centred psychotherapy</strong> approach in the style of Carl Rogers, in which the therapist often reflects the patient’s words to the patient. That’s pretty much the same thing that all modern LLMs do, and they have a keyword list that’s a billion times bigger than ELIZA’s and a much better method for calculating responses. That means they can be much more human-like in their responses and much broader regarding the types of input they can successfully process. They can be so convincing that purveyors of public AI solutions have had to inject more caveats continually, disclaimers, and external references to limit potential harm and liability.</p><p>While today’s publicly available generative AI solutions are far superior to ELIZA in nearly every conceivable way, there is one significant advantage that ELIZA still has – PRIVACY. When you share your most important secrets with your computer-based therapist, and it’s ELIZA, you can be sure that it will keep your input safe (assuming a fully secured or entirely disconnected computing environment).</p><p>ELIZA’s entire codebase is publicly available, making the input-to-output process transparent and understandable. Unfortunately, the same can’t be said if your computer-based therapist is ChatGPT, Bard, Bing, or any other Generative AI offering. With them, you can be sure that the therapist-patient confidentiality agreement WILL be broken when the AI engine adds whatever comments, questions, and secrets you share into its gigantic database of material used to fuel its ongoing learning processes.</p><p>If you want to avoid, or at least minimize, the risks and pitfalls that come along with the potential productivity benefits of public generative AI, remembering past lessons is helpful. ELIZA provided a preview of modern chatbots and other generative AI solutions and served as an excellent example of the main differences between public (external) and private (internal only) artificial intelligence implementations. Y2K showed that it is better to prepare for the worst than to be unpleasantly surprised by it. Mainly when ‘worst’ might someday actually include killer robots from the future.</p>','','full_html'),('featured_article',0,70,628,'en',0,'<p>The level of the negative hype surpassed that of Y2K when the wrong date-handling code embedded in every device was to have been so confused by the rollover from 1999 to 2000 that the world would come crashing to a halt, figuratively if not literally.</p><p>Elevators would drop from the top floors of every building, trains would derail, planes would fall from the sky, and microwave ovens would do who-knows-what to us all. That, or nothing at all, would happen, depending on who was hypothesizing. In hindsight, while it is apparent that the risk of Y2K was mostly overblown, it is helpful to remember that it is at least partly due to the amount of preparation and investment that went towards avoiding the worst potential outcomes.</p><p>We are currently witnessing a significant and rapid growth in the capabilities of AI, in some cases on a near-daily basis. It is driven by huge investments from many top U.S. tech companies and fueled by an unprecedented public interest in heading-grabbing examples like Open AI’s ChatGPT and DALL-E, Google’s Bard, Microsoft’s Bing, and many others.</p><p>These solutions are based on large-language models (LLMs) or large-image models (LIMs), which take vast amounts of text- or image-based data and use it to train a machine-learning model. The resulting LLM or LIM can then be used to generate output in the form of writing or pictures, which can be both beneficial and often convincingly human (aka <strong>Generative AI</strong>)</p><p>There has long been a keen interest in creating machines that can ‘exhibit cognitive capabilities and conversational skills’ to rival human beings. The first functional chatbot was <strong>ELIZA</strong>, a natural language processing program designed at <strong>MIT </strong>by <strong>Joseph Weizenbaum</strong> in the mid-1960s.</p><p>The program prompts the user to enter a comment or question, and ELIZA’s response algorithm looks for specific keywords in the input and pseudo-randomly picks a response from a pre-defined list of phrases. It repeats the prompt-and-respond loop until the program is terminated. The result resembles a back-and-forth ‘conversation’ between the user and the computer. That made ELIZA one of the first programs that could even attempt to pass the famous <strong>Turing Test</strong>, in which ‘artificial intelligence’ is measured by the ability of a machine to convince humans that it is ‘human’ as well.</p><p>ELIZA’s method of processing input keywords and generating output phrases is designed to mimic a <strong>person-centred psychotherapy</strong> approach in the style of Carl Rogers, in which the therapist often reflects the patient’s words to the patient. That’s pretty much the same thing that all modern LLMs do, and they have a keyword list that’s a billion times bigger than ELIZA’s and a much better method for calculating responses. That means they can be much more human-like in their responses and much broader regarding the types of input they can successfully process. They can be so convincing that purveyors of public AI solutions have had to inject more caveats continually, disclaimers, and external references to limit potential harm and liability.</p><p>While today’s publicly available generative AI solutions are far superior to ELIZA in nearly every conceivable way, there is one significant advantage that ELIZA still has – PRIVACY. When you share your most important secrets with your computer-based therapist, and it’s ELIZA, you can be sure that it will keep your input safe (assuming a fully secured or entirely disconnected computing environment).</p><p>ELIZA’s entire codebase is publicly available, making the input-to-output process transparent and understandable. Unfortunately, the same can’t be said if your computer-based therapist is ChatGPT, Bard, Bing, or any other Generative AI offering. With them, you can be sure that the therapist-patient confidentiality agreement WILL be broken when the AI engine adds whatever comments, questions, and secrets you share into its gigantic database of material used to fuel its ongoing learning processes.</p><p>If you want to avoid, or at least minimize, the risks and pitfalls that come along with the potential productivity benefits of public generative AI, remembering past lessons is helpful. ELIZA provided a preview of modern chatbots and other generative AI solutions and served as an excellent example of the main differences between public (external) and private (internal only) artificial intelligence implementations. Y2K showed that it is better to prepare for the worst than to be unpleasantly surprised by it. Mainly when ‘worst’ might someday actually include killer robots from the future.</p>','','full_html'),('featured_article',0,70,852,'en',0,'<p>The level of the negative hype surpassed that of Y2K when the wrong date-handling code embedded in every device was to have been so confused by the rollover from 1999 to 2000 that the world would come crashing to a halt, figuratively if not literally.</p><p>Elevators would drop from the top floors of every building, trains would derail, planes would fall from the sky, and microwave ovens would do who-knows-what to us all. That, or nothing at all, would happen, depending on who was hypothesizing. In hindsight, while it is apparent that the risk of Y2K was mostly overblown, it is helpful to remember that it is at least partly due to the amount of preparation and investment that went towards avoiding the worst potential outcomes.</p><p>We are currently witnessing a significant and rapid growth in the capabilities of AI, in some cases on a near-daily basis. It is driven by huge investments from many top U.S. tech companies and fueled by an unprecedented public interest in heading-grabbing examples like Open AI’s ChatGPT and DALL-E, Google’s Bard, Microsoft’s Bing, and many others.</p><p>These solutions are based on large-language models (LLMs) or large-image models (LIMs), which take vast amounts of text- or image-based data and use it to train a machine-learning model. The resulting LLM or LIM can then be used to generate output in the form of writing or pictures, which can be both beneficial and often convincingly human (aka <strong>Generative AI</strong>)</p><p>There has long been a keen interest in creating machines that can ‘exhibit cognitive capabilities and conversational skills’ to rival human beings. The first functional chatbot was <strong>ELIZA</strong>, a natural language processing program designed at <strong>MIT </strong>by <strong>Joseph Weizenbaum</strong> in the mid-1960s.</p><p>The program prompts the user to enter a comment or question, and ELIZA’s response algorithm looks for specific keywords in the input and pseudo-randomly picks a response from a pre-defined list of phrases. It repeats the prompt-and-respond loop until the program is terminated. The result resembles a back-and-forth ‘conversation’ between the user and the computer. That made ELIZA one of the first programs that could even attempt to pass the famous <strong>Turing Test</strong>, in which ‘artificial intelligence’ is measured by the ability of a machine to convince humans that it is ‘human’ as well.</p><p>ELIZA’s method of processing input keywords and generating output phrases is designed to mimic a <strong>person-centred psychotherapy</strong> approach in the style of Carl Rogers, in which the therapist often reflects the patient’s words to the patient. That’s pretty much the same thing that all modern LLMs do, and they have a keyword list that’s a billion times bigger than ELIZA’s and a much better method for calculating responses. That means they can be much more human-like in their responses and much broader regarding the types of input they can successfully process. They can be so convincing that purveyors of public AI solutions have had to inject more caveats continually, disclaimers, and external references to limit potential harm and liability.</p><p>While today’s publicly available generative AI solutions are far superior to ELIZA in nearly every conceivable way, there is one significant advantage that ELIZA still has – PRIVACY. When you share your most important secrets with your computer-based therapist, and it’s ELIZA, you can be sure that it will keep your input safe (assuming a fully secured or entirely disconnected computing environment).</p><p>ELIZA’s entire codebase is publicly available, making the input-to-output process transparent and understandable. Unfortunately, the same can’t be said if your computer-based therapist is ChatGPT, Bard, Bing, or any other Generative AI offering. With them, you can be sure that the therapist-patient confidentiality agreement WILL be broken when the AI engine adds whatever comments, questions, and secrets you share into its gigantic database of material used to fuel its ongoing learning processes.</p><p>If you want to avoid, or at least minimize, the risks and pitfalls that come along with the potential productivity benefits of public generative AI, remembering past lessons is helpful. ELIZA provided a preview of modern chatbots and other generative AI solutions and served as an excellent example of the main differences between public (external) and private (internal only) artificial intelligence implementations. Y2K showed that it is better to prepare for the worst than to be unpleasantly surprised by it. Mainly when ‘worst’ might someday actually include killer robots from the future.</p>','','full_html'),('sled',0,71,171,'en',0,'<h2>Ordering Information</h2><ul><li>FEIN04-3686496</li><li>SAM UEINJY2E3ATLXJ5</li><li>DUNS121165265</li><li>CAGE58RY7</li></ul><p>NIGP</p><ul><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829 Computer Software Consulting</li><li>NIGP 91830 Computer Network Consulting</li><li>NIGP 91871 IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040 Programming Services, Computer, Including Mobile Device Applications</li><li>NIGP 96426 Computer Programming Personnel</li><li>NIGP 92046 Software Updating and Upgrading Services</li><li>NIGP 92078 Web Site Development</li><li>NIGP 92045 Software Maintenance and Support Services</li></ul><p>NAICS</p><ul><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li><li>541513 – Computer Facilities Management Services</li><li>541519 – Other Computer Related Services</li><li>541618 – Other Management Consulting Services</li><li>541690 – Other Scientific and Technical Consulting Services</li><li>561311 – Employment Placement Agencies</li><li>561320 – Temporary Help Services</li></ul>','','basic_html'),('sled',0,71,172,'en',0,'<h2>Ordering Information</h2><ul><li>FEIN04-3686496</li><li>SAM UEINJY2E3ATLXJ5</li><li>DUNS121165265</li><li>CAGE58RY7</li></ul><p>NIGP</p><ul><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829 Computer Software Consulting</li><li>NIGP 91830 Computer Network Consulting</li><li>NIGP 91871 IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040 Programming Services, Computer, Including Mobile Device Applications</li><li>NIGP 96426 Computer Programming Personnel</li><li>NIGP 92046 Software Updating and Upgrading Services</li><li>NIGP 92078 Web Site Development</li><li>NIGP 92045 Software Maintenance and Support Services</li></ul><p>NAICS</p><ul><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li><li>541513 – Computer Facilities Management Services</li><li>541519 – Other Computer Related Services</li><li>541618 – Other Management Consulting Services</li><li>541690 – Other Scientific and Technical Consulting Services</li><li>561311 – Employment Placement Agencies</li><li>561320 – Temporary Help Services</li></ul>','','basic_html'),('sled',0,71,173,'en',0,'<h2>Ordering Information</h2><ul><li>FEIN04-3686496</li><li>SAM UEINJY2E3ATLXJ5</li><li>DUNS121165265</li><li>CAGE58RY7</li></ul><div class=\"container\"><div class=\"row\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('sled',0,71,174,'en',0,'<h2>Ordering Information</h2><ul><li>FEIN04-3686496</li><li>SAM UEINJY2E3ATLXJ5</li><li>DUNS121165265</li><li>CAGE58RY7</li></ul><div class=\"container\"><div class=\"row\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('sled',0,71,723,'en',0,'<h2>Ordering Information</h2><ul><li>FEIN04-3686496</li><li>SAM UEINJY2E3ATLXJ5</li><li>DUNS121165265</li><li>CAGE58RY7</li></ul><div class=\"container\"><div class=\"row\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('sled',0,71,783,'en',0,'<h2>Ordering Information</h2><ul><li>FEIN04-3686496</li><li>SAM UEINJY2E3ATLXJ5</li><li>DUNS121165265</li><li>CAGE58RY7</li></ul><div class=\"container\"><div class=\"row\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('sled',0,71,784,'en',0,'<h2>Ordering Information</h2><ul><li>FEIN04-3686496</li><li>SAM UEINJY2E3ATLXJ5</li><li>DUNS121165265</li><li>CAGE58RY7</li></ul><div class=\"container\"><div class=\"row\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('sled',0,71,785,'en',0,'<h2>Ordering Information</h2><ul><li>FEIN04-3686496</li><li>SAM UEINJY2E3ATLXJ5</li><li>DUNS121165265</li><li>CAGE58RY7</li></ul><div class=\"container\"><div class=\"row\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('sled',0,71,786,'en',0,'<h2 class=\"small-title\">Ordering Information</h2><ul><li><span>FEIN04-3686496</span></li><li><span>SAM UEINJY2E3ATLXJ5</span></li><li><span>DUNS121165265</span></li><li><span>CAGE58RY7</span></li></ul><div class=\"container\"><div class=\"row g-0\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('sled',0,71,787,'en',0,'<h2 class=\"small-title\">Ordering Information</h2><ul><li><span>FEIN04-3686496</span></li><li><span>SAM UEINJY2E3ATLXJ5</span></li><li><span>DUNS121165265</span></li><li><span>CAGE58RY7</span></li></ul><div class=\"container\"><div class=\"row g-0\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('sled',0,71,788,'en',0,'<h2 class=\"small-title\">Ordering Information</h2><ul><li><span>FEIN04-3686496</span></li><li><span>SAM UEINJY2E3ATLXJ5</span></li><li><span>DUNS121165265</span></li><li><span>CAGE58RY7</span></li></ul><div class=\"container\"><div class=\"row g-0\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('sled',0,71,789,'en',0,'<h2 class=\"small-title\">Ordering Information</h2><ul><li><span>FEIN04-3686496</span></li><li><span>SAM UEINJY2E3ATLXJ5</span></li><li><span>DUNS121165265</span></li><li><span>CAGE58RY7</span></li></ul><div class=\"container\"><div class=\"row g-0\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('sled',0,71,790,'en',0,'<h2 class=\"small-title\">Ordering Information</h2><ul><li><span>FEIN04-3686496</span></li><li><span>SAM UEINJY2E3ATLXJ5</span></li><li><span>DUNS121165265</span></li><li><span>CAGE58RY7</span></li></ul><div class=\"container\"><div class=\"row g-0\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('sled',0,71,795,'en',0,'<h2 class=\"small-title\">Ordering Information</h2><ul><li><span>FEIN04-3686496</span></li><li><span>SAM UEINJY2E3ATLXJ5</span></li><li><span>DUNS121165265</span></li><li><span>CAGE58RY7</span></li></ul><div class=\"container\"><div class=\"row g-0\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('sled',0,71,832,'en',0,'<h2 class=\"small-title\">Ordering Information</h2><ul><li><span>FEIN04-3686496</span></li><li><span>SAM UEINJY2E3ATLXJ5</span></li><li><span>DUNS121165265</span></li><li><span>CAGE58RY7</span></li></ul><div class=\"container\"><div class=\"row g-0\"><!-- NIGP Column --><div class=\"col-md-6\"><h3>NIGP</h3><ul class=\"list-unstyled\"><li>NIGP 208: COMPUTER SOFTWARE FOR MICROCOMPUTERS, SYSTEMS, INCLUDING CLOUD-BASED (PREPROGRAMMED)</li><li>NIGP 209: Computer Software for Mini and Mainframe Computers (Preprogrammed)</li><li>NIGP 918: Consulting Services</li><li>NIGP 920: DATA PROCESSING, COMPUTER, PROGRAMMING, AND SOFTWARE SERVICES</li><li>NIGP 91829: Computer Software Consulting</li><li>NIGP 91830: Computer Network Consulting</li><li>NIGP 91871: IT Consulting, (Not Otherwise Classified)</li><li>NIGP 92040: Programming Services, Computer, Including Mobile Device Applications</li></ul></div><!-- NAICS Column --><div class=\"col-md-6\"><h3>NAICS</h3><ul class=\"list-unstyled\"><li>541511 – Custom Computer Programming Services</li><li>541512 – Computer System Design Services</li></ul></div></div></div>','','full_html'),('blog',0,73,175,'en',0,'<p><strong>DISCLAIMER</strong></p><p>Copyright ©2022 by DivIHN Integration Inc. |<a href=\"mailto:yoursuccess@divihn.com\">yoursuccess@divihn.com.</a></p><p>The creator of the document reserves all rights. Publication Date: July 2022. DivIHN Integration Inc. reserves the right to change the contents of this article, the features or the scope without the obligation to notify anyone of such changes. The content has been adapted using secondary research from various data points via “Google Search”. Infographics and Images used in the document are the property of the respective owners and have been used for indicative purposes only. The author reserves the right to authorize and use the Intellectual Property contained in the document.</p><p><strong>Table of Contents</strong></p><ol><li><a href=\"#introduction\">Introduction</a></li><li><a href=\"#salesforce_community\">What are Salesforce Communities</a></li><li><a href=\"#salesforce_types\">Types of Salesforce Communities</a></li><li><a href=\"#benfits\">How Salesforce Communities Could be Leveraged Beneficially</a></li><li><a href=\"#conclusion\">Concluding Remarks</a></li><li><a href=\"#solution\">DivIHN Salesforce Solutions</a></li></ol><p><strong>Introduction</strong></p><p>The technologies that we use transform into a better alternative continuously. At the same time, various businesses are adopting these technologies and expanding identically in the same way these products grow and evolve. One of these kinds of technologies that are currently assisting businesses is called the Salesforce Community Cloud.</p><p>Salesforce is one of the leading players globally in customer relationship management tools, and it is widely recognised for its ability to bring customers and businesses closer together.</p><p>This integrated CRM platform covers many functions for all your departments, including sales, commerce, marketing, and service, as well as a single common perspective of each consumer, allowing them to contribute to diverse sections of their operations cohesively.</p><p>Businesses in today’s world use Salesforce to understand their customers better, communicate with them on multiple levels, and expand their existing customer base.</p><p>The paradigm shift in the adoption of digital technologies has transformed how internet users interact with one another and the wider world. The human notion of feeling connected with others around us has lost its true meaning due to the rise of automation in the name of efficiency.</p><p>It is essential to support and maintain sales teams and administrative leadership. All parties involved, including consumers, employees, and management, want a genuine relationship with a human being.</p><p>Now, this is why there is such a thing as Salesforce Customer Communities, a fantastic technique to drive relationships that will significantly influence the growth of your organization to produce superior results.</p><p>In today’s age of digital advancement, the capacity to interact and collaborate has become the primary emphasis of all businesses. Every company or organization’s success depends on its ability to interact successfully with its customers, employees, and other consumers.</p><p>An online platform, Salesforce Community Cloud creates branded web portals for engaging customers, employees, and partners in a responsive manner. Primarily, it is a framework that allows companies to rapidly construct branded portals that can be optimized and adapted for mobile devices.</p><p><strong>What Are Salesforce Communities</strong></p><p>The Salesforce community cloud is a social platform developed by Salesforce to enhance the levels of communication and interaction between a company and its various stakeholders, including its employees, partners, and customers. The Salesforce Community Cloud uses a social CRM platform, enabling users to share their screens and communicate with one another. During a conversation already in progress, it allows its users to send and receive photos and data in real-time. Customers can search for information and engage with other customers through these platforms, simplifying customer relationship management (CRM). In addition, the console comes equipped with a button labelled “BUY,” which makes it easier to conduct business online. Employees can use the community cloud for various workplace interactions, including but not limited to human resource management (HRM), troubleshooting, help desk contact, and interactions between teams located in separate geographical areas. Similarly, leadership can utilize it to increase communication with its channel partners and other external parties.</p><img src=\"/sites/default/files/inline-images/5-Powerful-Benefits-of-Salesforce-Communites.png\" data-entity-uuid=\"4b306be0-9f74-40b0-b7ba-db35c31e048f\" data-entity-type=\"file\" width=\"800\" height=\"560\"><p>&nbsp;<strong>Types of Salesforce Communities</strong></p><main class=\"container\" role=\"main\"><p>There are three types of communities that Salesforce cloud offers.</p><ul><li>Customer Communities – a self-service portal that gives assistance and feedback (frequently asked questions, articles, documentation, and interactions with other customers — for example, by using a Salesforce Success Community). Salesforce customer communities enable businesses to more effectively communicate pertinent information with one another, improve the overall customer experience, and boost engagement.</li><li>Internal Workforce Communities – IT department can create a portal for Human Resources and Information technology information for the employees within the organization. It allows employees to connect and offers them a single location for shared files, searchable knowledge databases and training materials, scheduling, project management, and organizational documents or announcements.</li><li>Business Partners Community – Salesforce Communities offers a specialized information hub for B2B organizations. It enables their sales teams and resellers to readily obtain critical data and communicate in real-time to close more deals. It is a place where partners can manage their businesses, learn best practices, receive the help they require, and communicate with Salesforce staff in a completely safe setting.</li></ul></main><p><strong>How Salesforce Communities Could Be Leveraged Beneficially</strong></p><p><strong><u>Building Brand Experiences</u></strong>- Salesforce provides a wide range of options for users to modify the look and feel of their communities. To begin, you can customize the appearance to align with your organization’s branding. Making these adjustments can help to improve y</p><p>our brand’s image and these communities entailing your consumers, staff and business partners can also work as a trust-building platform.</p><p>Not only does a customer community allow them to interact with other clients and staff members of your business, but it also allows them to view interactions that have taken place between other clients and members of your team.</p><p>Customers who join such communities spend 19% more than customers who do not participate in branded communities. They can observe how your employees interact with one another, the quality of customer service that your employees provide, and the level of assistance they anticipate receiving from the community if they experience problems with the product or service you provide.</p><p><strong><u>24x7x365 Connectivity</u></strong>- Connections and collaboration are the two most important factors determining a company’s success. Salesforce communities offer a robust platform that can be used to forge new connections and grow existing ones while ensuring seamless integration between the two.</p><p>Users can communicate, work together, and complete transactions on the go, regardless of where they are. The seamless ability to share information and knowledge significantly impacts the workforce’s productivity. Providing customers with interactive areas in which they can connect will go a long way in resolving issues and answering questions.</p><p>To develop worldwide connections independent of work hours, the various groups that are important to your company are addressed in a tailored manner.</p><p><strong><u>Consumer Research and Insights</u></strong>- With Salesforce communities, you give customers an avenue to express the problems they are experiencing, voice their concerns, and participate candidly with your staff. This is possibly the most valuable aspect of developing a customer community for your business.</p><p>A customer community can be an essential component of your techniques for conducting consumer research. It provides a centralized location where your customers can come to you, ask questions, and gain public confirmation that other customers are having the same problem.</p><p>The Idea Exchange provides a beautiful illustration of this point. In this section, users can offer suggestions for new additions to the platform and modifications to existing features. As a result, thousands of customers are flooding into their community, pointing out problematic areas, offering proposals for additional features, and concurring with the ideas presented by other customers.</p><p>Businesses shell out thousands of dollars for this kind of consumer insight, and Salesforce communities enable you to put these processes on autopilot.</p><p><strong><u>Influencer Marketing</u></strong>- You likely have potential valuable brand ambassadors sitting around waiting for you to start a conversation with them and take your relationships to the next level. This development can be attributed to the fact that you are not constantly engaging in conversations with your customers.</p><p>You will have an easier time determining who the power users and public ambassadors for your product and brand are if you use Salesforce communities. They make their presence known by the amount of time they invest in contributing to your community and the feedback they provide to other clients.</p><p>You’ll be able to bring those individuals closer to your organization and provide them with the resources that will allow them to effectively become true high-level ambassadors for your brand if you make use of Salesforce communities. You can even contract them into the employee side of things, where you can use the collaboration, file sharing, and documentation capabilities to ensure that you are all on the same page.</p><p>A single, straightforward dashboard makes it possible to collaborate on content planning, gather content from social media, and more.</p><img src=\"/sites/default/files/inline-images/5-Powerful-Benefits-of-Salesforce-Communites-1.jpeg\" data-entity-uuid=\"04bf261b-979e-4aa3-a32e-615770a0a5dc\" data-entity-type=\"file\" width=\"638\" height=\"479\"><p>&nbsp;</p><p><strong><u>Optimizing The Supply Chain and costs</u></strong> – Managing a corporate supply chain can be challenging if the appropriate tools are unavailable. When manufacturers participate in Salesforce communities, they receive access to a wide variety of technologies that allow them to improve how they interact with their suppliers and manage their supply chains.</p><p>The distribution of products and monitoring of their placement in stores could be managed through the usage of communities. Any issues in the supply chain management can be identified, and corrective action with the relevant stakeholders can be executed.</p><p>In addition, you can create dashboards for your customers and partners by using extension applications for Salesforce communities. These dashboards will make monitoring and tracking simple for your customers and partners. These communities may be customized, and some apps can be used to increase their functionality, making them an excellent tool for any business that wants to improve its supply chain management by fostering better communication and collaboration among employees.</p><p>Because this Community Cloud has pre-built custom templates and apps provided by third parties, it is possible to cut down on the costs associated with building bespoke in-house solutions.</p><p><strong><u>Employee Empowerment</u></strong> – It is astonishing to know but also a proven fact that 60% of businesses do not have a long-term strategy for managing their internal communications. However, communication is a necessity. When employees at a company are connected and regularly engage in effective forms of internal communication, the productivity of those individuals rises by 25%.</p><p>Organizations can improve their employees’ sense of community by establishing employee communities. Your workers will get to know one another better within the firm and strengthen communication more naturally if you provide a social platform for them to use.</p><p>It can be a practical approach to enhance communication and engagement among your teams to use Salesforce communities as a communication platform for your employees. Through open and public communication, data sharing, and more effective information distribution, it has the potential to bring down barriers and assist in the process of creating alignment among departments.</p><p>Your team members can instantly share their ideas, data, and insights in employee communities. They can assist in connecting others with crucial information that would be difficult to spread across a business via email alone correctly.</p><p>They will have a much simpler time locating specialists working for your company who can offer advice and speedily assist them in finding solutions to challenges. In addition, when these realizations are brought to the public’s attention, it will help other people in the future in finding solutions to the challenges that they are facing.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/5-Powerful-Benefits-of-Salesforce-Communites.jpeg\" data-entity-uuid=\"d0d8d3d7-1083-436d-ad9d-1289726e0ab7\" data-entity-type=\"file\" width=\"638\" height=\"359\"><p>&nbsp;</p><p><strong>Concluding Remarks</strong></p><p>The Salesforce Community Cloud can help in the advancement of your business entity. With the help of these Communities, your clients will have a forum to engage with your company and other customers. They also can benefit from the opportunity of high-quality after-sales service.</p><p>Consider these Salesforce customer communities if you want to increase sales, improve customer satisfaction, boost customer engagement, boost employee connectedness, and have the ability to interact and collaborate with your customers, including the ability to gain data insights from those interactions.</p><p>You can develop a fully functional portal for your customers and thoroughly personalize the experience they have as online customers, regardless of the size of your company.</p><p>These solutions can be seamlessly integrated without noticeable disruption to your existing systems. Since there are many avenues for modification, you may make it as straightforward or as complicated as you choose.</p><p><strong>DivIHN SalesForce Solutions</strong></p><p>DivIHN Integration Inc. can help unleash the Salesforce Cloud’s power and associated development tools. It is the world’s most trusted multi-tenant cloud platform. We can help to design and develop business strategy-driven solutions that integrate Salesforce with enterprise applications. To know more, please write to <a href=\"mailto:kannan@divihn.com\">kannan@divihn.com.</a></p>','','full_html'),('blog',0,73,176,'en',0,'<p><strong>DISCLAIMER</strong></p><p>Copyright ©2022 by DivIHN Integration Inc. |<a href=\"mailto:yoursuccess@divihn.com\">yoursuccess@divihn.com.</a></p><p>The creator of the document reserves all rights. Publication Date: July 2022. DivIHN Integration Inc. reserves the right to change the contents of this article, the features or the scope without the obligation to notify anyone of such changes. The content has been adapted using secondary research from various data points via “Google Search”. Infographics and Images used in the document are the property of the respective owners and have been used for indicative purposes only. The author reserves the right to authorize and use the Intellectual Property contained in the document.</p><p><strong>Table of Contents</strong></p><ol><li><a href=\"#introduction\">Introduction</a></li><li><a href=\"#salesforce_community\">What are Salesforce Communities</a></li><li><a href=\"#salesforce_types\">Types of Salesforce Communities</a></li><li><a href=\"#benfits\">How Salesforce Communities Could be Leveraged Beneficially</a></li><li><a href=\"#conclusion\">Concluding Remarks</a></li><li><a href=\"#solution\">DivIHN Salesforce Solutions</a></li></ol><p><strong>Introduction</strong></p><p>The technologies that we use transform into a better alternative continuously. At the same time, various businesses are adopting these technologies and expanding identically in the same way these products grow and evolve. One of these kinds of technologies that are currently assisting businesses is called the Salesforce Community Cloud.</p><p>Salesforce is one of the leading players globally in customer relationship management tools, and it is widely recognised for its ability to bring customers and businesses closer together.</p><p>This integrated CRM platform covers many functions for all your departments, including sales, commerce, marketing, and service, as well as a single common perspective of each consumer, allowing them to contribute to diverse sections of their operations cohesively.</p><p>Businesses in today’s world use Salesforce to understand their customers better, communicate with them on multiple levels, and expand their existing customer base.</p><p>The paradigm shift in the adoption of digital technologies has transformed how internet users interact with one another and the wider world. The human notion of feeling connected with others around us has lost its true meaning due to the rise of automation in the name of efficiency.</p><p>It is essential to support and maintain sales teams and administrative leadership. All parties involved, including consumers, employees, and management, want a genuine relationship with a human being.</p><p>Now, this is why there is such a thing as Salesforce Customer Communities, a fantastic technique to drive relationships that will significantly influence the growth of your organization to produce superior results.</p><p>In today’s age of digital advancement, the capacity to interact and collaborate has become the primary emphasis of all businesses. Every company or organization’s success depends on its ability to interact successfully with its customers, employees, and other consumers.</p><p>An online platform, Salesforce Community Cloud creates branded web portals for engaging customers, employees, and partners in a responsive manner. Primarily, it is a framework that allows companies to rapidly construct branded portals that can be optimized and adapted for mobile devices.</p><p><strong>What Are Salesforce Communities</strong></p><p>The Salesforce community cloud is a social platform developed by Salesforce to enhance the levels of communication and interaction between a company and its various stakeholders, including its employees, partners, and customers. The Salesforce Community Cloud uses a social CRM platform, enabling users to share their screens and communicate with one another. During a conversation already in progress, it allows its users to send and receive photos and data in real-time. Customers can search for information and engage with other customers through these platforms, simplifying customer relationship management (CRM). In addition, the console comes equipped with a button labelled “BUY,” which makes it easier to conduct business online. Employees can use the community cloud for various workplace interactions, including but not limited to human resource management (HRM), troubleshooting, help desk contact, and interactions between teams located in separate geographical areas. Similarly, leadership can utilize it to increase communication with its channel partners and other external parties.</p><img src=\"/sites/default/files/inline-images/5-Powerful-Benefits-of-Salesforce-Communites.png\" data-entity-uuid=\"4b306be0-9f74-40b0-b7ba-db35c31e048f\" data-entity-type=\"file\" width=\"800\" height=\"560\"><p>&nbsp;</p><p>&nbsp;<strong>Types of Salesforce Communities</strong></p><main class=\"container\" role=\"main\"><p>There are three types of communities that Salesforce cloud offers.</p><ul><li>Customer Communities – a self-service portal that gives assistance and feedback (frequently asked questions, articles, documentation, and interactions with other customers — for example, by using a Salesforce Success Community). Salesforce customer communities enable businesses to more effectively communicate pertinent information with one another, improve the overall customer experience, and boost engagement.</li><li>Internal Workforce Communities – IT department can create a portal for Human Resources and Information technology information for the employees within the organization. It allows employees to connect and offers them a single location for shared files, searchable knowledge databases and training materials, scheduling, project management, and organizational documents or announcements.</li><li>Business Partners Community – Salesforce Communities offers a specialized information hub for B2B organizations. It enables their sales teams and resellers to readily obtain critical data and communicate in real-time to close more deals. It is a place where partners can manage their businesses, learn best practices, receive the help they require, and communicate with Salesforce staff in a completely safe setting.</li></ul></main><p>&nbsp;</p><p><strong>How Salesforce Communities Could Be Leveraged Beneficially</strong></p><p><strong><u>Building Brand Experiences</u></strong>- Salesforce provides a wide range of options for users to modify the look and feel of their communities. To begin, you can customize the appearance to align with your organization’s branding. Making these adjustments can help to improve y</p><p>our brand’s image and these communities entailing your consumers, staff and business partners can also work as a trust-building platform.</p><p>Not only does a customer community allow them to interact with other clients and staff members of your business, but it also allows them to view interactions that have taken place between other clients and members of your team.</p><p>Customers who join such communities spend 19% more than customers who do not participate in branded communities. They can observe how your employees interact with one another, the quality of customer service that your employees provide, and the level of assistance they anticipate receiving from the community if they experience problems with the product or service you provide.</p><p><strong><u>24x7x365 Connectivity</u></strong>- Connections and collaboration are the two most important factors determining a company’s success. Salesforce communities offer a robust platform that can be used to forge new connections and grow existing ones while ensuring seamless integration between the two.</p><p>Users can communicate, work together, and complete transactions on the go, regardless of where they are. The seamless ability to share information and knowledge significantly impacts the workforce’s productivity. Providing customers with interactive areas in which they can connect will go a long way in resolving issues and answering questions.</p><p>To develop worldwide connections independent of work hours, the various groups that are important to your company are addressed in a tailored manner.</p><p><strong><u>Consumer Research and Insights</u></strong>- With Salesforce communities, you give customers an avenue to express the problems they are experiencing, voice their concerns, and participate candidly with your staff. This is possibly the most valuable aspect of developing a customer community for your business.</p><p>A customer community can be an essential component of your techniques for conducting consumer research. It provides a centralized location where your customers can come to you, ask questions, and gain public confirmation that other customers are having the same problem.</p><p>The Idea Exchange provides a beautiful illustration of this point. In this section, users can offer suggestions for new additions to the platform and modifications to existing features. As a result, thousands of customers are flooding into their community, pointing out problematic areas, offering proposals for additional features, and concurring with the ideas presented by other customers.</p><p>Businesses shell out thousands of dollars for this kind of consumer insight, and Salesforce communities enable you to put these processes on autopilot.</p><p><strong><u>Influencer Marketing</u></strong>- You likely have potential valuable brand ambassadors sitting around waiting for you to start a conversation with them and take your relationships to the next level. This development can be attributed to the fact that you are not constantly engaging in conversations with your customers.</p><p>You will have an easier time determining who the power users and public ambassadors for your product and brand are if you use Salesforce communities. They make their presence known by the amount of time they invest in contributing to your community and the feedback they provide to other clients.</p><p>You’ll be able to bring those individuals closer to your organization and provide them with the resources that will allow them to effectively become true high-level ambassadors for your brand if you make use of Salesforce communities. You can even contract them into the employee side of things, where you can use the collaboration, file sharing, and documentation capabilities to ensure that you are all on the same page.</p><p>A single, straightforward dashboard makes it possible to collaborate on content planning, gather content from social media, and more.</p><img src=\"/sites/default/files/inline-images/5-Powerful-Benefits-of-Salesforce-Communites-1.jpeg\" data-entity-uuid=\"04bf261b-979e-4aa3-a32e-615770a0a5dc\" data-entity-type=\"file\" width=\"638\" height=\"479\"><p>&nbsp;</p><p><strong><u>Optimizing The Supply Chain and costs</u></strong> – Managing a corporate supply chain can be challenging if the appropriate tools are unavailable. When manufacturers participate in Salesforce communities, they receive access to a wide variety of technologies that allow them to improve how they interact with their suppliers and manage their supply chains.</p><p>The distribution of products and monitoring of their placement in stores could be managed through the usage of communities. Any issues in the supply chain management can be identified, and corrective action with the relevant stakeholders can be executed.</p><p>In addition, you can create dashboards for your customers and partners by using extension applications for Salesforce communities. These dashboards will make monitoring and tracking simple for your customers and partners. These communities may be customized, and some apps can be used to increase their functionality, making them an excellent tool for any business that wants to improve its supply chain management by fostering better communication and collaboration among employees.</p><p>Because this Community Cloud has pre-built custom templates and apps provided by third parties, it is possible to cut down on the costs associated with building bespoke in-house solutions.</p><p><strong><u>Employee Empowerment</u></strong> – It is astonishing to know but also a proven fact that 60% of businesses do not have a long-term strategy for managing their internal communications. However, communication is a necessity. When employees at a company are connected and regularly engage in effective forms of internal communication, the productivity of those individuals rises by 25%.</p><p>Organizations can improve their employees’ sense of community by establishing employee communities. Your workers will get to know one another better within the firm and strengthen communication more naturally if you provide a social platform for them to use.</p><p>It can be a practical approach to enhance communication and engagement among your teams to use Salesforce communities as a communication platform for your employees. Through open and public communication, data sharing, and more effective information distribution, it has the potential to bring down barriers and assist in the process of creating alignment among departments.</p><p>Your team members can instantly share their ideas, data, and insights in employee communities. They can assist in connecting others with crucial information that would be difficult to spread across a business via email alone correctly.</p><p>They will have a much simpler time locating specialists working for your company who can offer advice and speedily assist them in finding solutions to challenges. In addition, when these realizations are brought to the public’s attention, it will help other people in the future in finding solutions to the challenges that they are facing.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/5-Powerful-Benefits-of-Salesforce-Communites.jpeg\" data-entity-uuid=\"d0d8d3d7-1083-436d-ad9d-1289726e0ab7\" data-entity-type=\"file\" width=\"638\" height=\"359\"><p>&nbsp;</p><p><strong>Concluding Remarks</strong></p><p>The Salesforce Community Cloud can help in the advancement of your business entity. With the help of these Communities, your clients will have a forum to engage with your company and other customers. They also can benefit from the opportunity of high-quality after-sales service.</p><p>Consider these Salesforce customer communities if you want to increase sales, improve customer satisfaction, boost customer engagement, boost employee connectedness, and have the ability to interact and collaborate with your customers, including the ability to gain data insights from those interactions.</p><p>You can develop a fully functional portal for your customers and thoroughly personalize the experience they have as online customers, regardless of the size of your company.</p><p>These solutions can be seamlessly integrated without noticeable disruption to your existing systems. Since there are many avenues for modification, you may make it as straightforward or as complicated as you choose.</p><p><strong>DivIHN SalesForce Solutions</strong></p><p>DivIHN Integration Inc. can help unleash the Salesforce Cloud’s power and associated development tools. It is the world’s most trusted multi-tenant cloud platform. We can help to design and develop business strategy-driven solutions that integrate Salesforce with enterprise applications. To know more, please write to <a href=\"mailto:kannan@divihn.com\">kannan@divihn.com.</a></p>','','full_html'),('blog',0,73,177,'en',0,'<p><strong>DISCLAIMER</strong></p><p>Copyright ©2022 by DivIHN Integration Inc. |<a href=\"mailto:yoursuccess@divihn.com\">yoursuccess@divihn.com.</a></p><p>The creator of the document reserves all rights. Publication Date: July 2022. DivIHN Integration Inc. reserves the right to change the contents of this article, the features or the scope without the obligation to notify anyone of such changes. The content has been adapted using secondary research from various data points via “Google Search”. Infographics and Images used in the document are the property of the respective owners and have been used for indicative purposes only. The author reserves the right to authorize and use the Intellectual Property contained in the document.</p><p><strong>Table of Contents</strong></p><ol><li><a href=\"#introduction\">Introduction</a></li><li><a href=\"#salesforce_community\">What are Salesforce Communities</a></li><li><a href=\"#salesforce_types\">Types of Salesforce Communities</a></li><li><a href=\"#benfits\">How Salesforce Communities Could be Leveraged Beneficially</a></li><li><a href=\"#conclusion\">Concluding Remarks</a></li><li><a href=\"#solution\">DivIHN Salesforce Solutions</a></li></ol><p><strong>Introduction</strong></p><p>The technologies that we use transform into a better alternative continuously. At the same time, various businesses are adopting these technologies and expanding identically in the same way these products grow and evolve. One of these kinds of technologies that are currently assisting businesses is called the Salesforce Community Cloud.</p><p>Salesforce is one of the leading players globally in customer relationship management tools, and it is widely recognised for its ability to bring customers and businesses closer together.</p><p>This integrated CRM platform covers many functions for all your departments, including sales, commerce, marketing, and service, as well as a single common perspective of each consumer, allowing them to contribute to diverse sections of their operations cohesively.</p><p>Businesses in today’s world use Salesforce to understand their customers better, communicate with them on multiple levels, and expand their existing customer base.</p><p>The paradigm shift in the adoption of digital technologies has transformed how internet users interact with one another and the wider world. The human notion of feeling connected with others around us has lost its true meaning due to the rise of automation in the name of efficiency.</p><p>It is essential to support and maintain sales teams and administrative leadership. All parties involved, including consumers, employees, and management, want a genuine relationship with a human being.</p><p>Now, this is why there is such a thing as Salesforce Customer Communities, a fantastic technique to drive relationships that will significantly influence the growth of your organization to produce superior results.</p><p>In today’s age of digital advancement, the capacity to interact and collaborate has become the primary emphasis of all businesses. Every company or organization’s success depends on its ability to interact successfully with its customers, employees, and other consumers.</p><p>An online platform, Salesforce Community Cloud creates branded web portals for engaging customers, employees, and partners in a responsive manner. Primarily, it is a framework that allows companies to rapidly construct branded portals that can be optimized and adapted for mobile devices.</p><p><strong>What Are Salesforce Communities</strong></p><p>The Salesforce community cloud is a social platform developed by Salesforce to enhance the levels of communication and interaction between a company and its various stakeholders, including its employees, partners, and customers. The Salesforce Community Cloud uses a social CRM platform, enabling users to share their screens and communicate with one another. During a conversation already in progress, it allows its users to send and receive photos and data in real-time. Customers can search for information and engage with other customers through these platforms, simplifying customer relationship management (CRM). In addition, the console comes equipped with a button labelled “BUY,” which makes it easier to conduct business online. Employees can use the community cloud for various workplace interactions, including but not limited to human resource management (HRM), troubleshooting, help desk contact, and interactions between teams located in separate geographical areas. Similarly, leadership can utilize it to increase communication with its channel partners and other external parties.</p><img src=\"/sites/default/files/inline-images/5-Powerful-Benefits-of-Salesforce-Communites.png\" data-entity-uuid=\"4b306be0-9f74-40b0-b7ba-db35c31e048f\" data-entity-type=\"file\" width=\"800\" height=\"560\"><p>&nbsp;</p><p>&nbsp;<strong>Types of Salesforce Communities</strong></p><main class=\"container\" role=\"main\"><p>There are three types of communities that Salesforce cloud offers.</p><ul><li>Customer Communities – a self-service portal that gives assistance and feedback (frequently asked questions, articles, documentation, and interactions with other customers — for example, by using a Salesforce Success Community). Salesforce customer communities enable businesses to more effectively communicate pertinent information with one another, improve the overall customer experience, and boost engagement.</li><li>Internal Workforce Communities – IT department can create a portal for Human Resources and Information technology information for the employees within the organization. It allows employees to connect and offers them a single location for shared files, searchable knowledge databases and training materials, scheduling, project management, and organizational documents or announcements.</li><li>Business Partners Community – Salesforce Communities offers a specialized information hub for B2B organizations. It enables their sales teams and resellers to readily obtain critical data and communicate in real-time to close more deals. It is a place where partners can manage their businesses, learn best practices, receive the help they require, and communicate with Salesforce staff in a completely safe setting.</li></ul></main><p>&nbsp;</p><p><strong>How Salesforce Communities Could Be Leveraged Beneficially</strong></p><p><strong><u>Building Brand Experiences</u></strong>- Salesforce provides a wide range of options for users to modify the look and feel of their communities. To begin, you can customize the appearance to align with your organization’s branding. Making these adjustments can help to improve y</p><p>our brand’s image and these communities entailing your consumers, staff and business partners can also work as a trust-building platform.</p><p>Not only does a customer community allow them to interact with other clients and staff members of your business, but it also allows them to view interactions that have taken place between other clients and members of your team.</p><p>Customers who join such communities spend 19% more than customers who do not participate in branded communities. They can observe how your employees interact with one another, the quality of customer service that your employees provide, and the level of assistance they anticipate receiving from the community if they experience problems with the product or service you provide.</p><p><strong><u>24x7x365 Connectivity</u></strong>- Connections and collaboration are the two most important factors determining a company’s success. Salesforce communities offer a robust platform that can be used to forge new connections and grow existing ones while ensuring seamless integration between the two.</p><p>Users can communicate, work together, and complete transactions on the go, regardless of where they are. The seamless ability to share information and knowledge significantly impacts the workforce’s productivity. Providing customers with interactive areas in which they can connect will go a long way in resolving issues and answering questions.</p><p>To develop worldwide connections independent of work hours, the various groups that are important to your company are addressed in a tailored manner.</p><p><strong><u>Consumer Research and Insights</u></strong>- With Salesforce communities, you give customers an avenue to express the problems they are experiencing, voice their concerns, and participate candidly with your staff. This is possibly the most valuable aspect of developing a customer community for your business.</p><p>A customer community can be an essential component of your techniques for conducting consumer research. It provides a centralized location where your customers can come to you, ask questions, and gain public confirmation that other customers are having the same problem.</p><p>The Idea Exchange provides a beautiful illustration of this point. In this section, users can offer suggestions for new additions to the platform and modifications to existing features. As a result, thousands of customers are flooding into their community, pointing out problematic areas, offering proposals for additional features, and concurring with the ideas presented by other customers.</p><p>Businesses shell out thousands of dollars for this kind of consumer insight, and Salesforce communities enable you to put these processes on autopilot.</p><p><strong><u>Influencer Marketing</u></strong>- You likely have potential valuable brand ambassadors sitting around waiting for you to start a conversation with them and take your relationships to the next level. This development can be attributed to the fact that you are not constantly engaging in conversations with your customers.</p><p>You will have an easier time determining who the power users and public ambassadors for your product and brand are if you use Salesforce communities. They make their presence known by the amount of time they invest in contributing to your community and the feedback they provide to other clients.</p><p>You’ll be able to bring those individuals closer to your organization and provide them with the resources that will allow them to effectively become true high-level ambassadors for your brand if you make use of Salesforce communities. You can even contract them into the employee side of things, where you can use the collaboration, file sharing, and documentation capabilities to ensure that you are all on the same page.</p><p>A single, straightforward dashboard makes it possible to collaborate on content planning, gather content from social media, and more.</p><img src=\"/sites/default/files/inline-images/5-Powerful-Benefits-of-Salesforce-Communites-1.jpeg\" data-entity-uuid=\"04bf261b-979e-4aa3-a32e-615770a0a5dc\" data-entity-type=\"file\" width=\"638\" height=\"479\"><p>&nbsp;</p><p><strong><u>Optimizing The Supply Chain and costs</u></strong> – Managing a corporate supply chain can be challenging if the appropriate tools are unavailable. When manufacturers participate in Salesforce communities, they receive access to a wide variety of technologies that allow them to improve how they interact with their suppliers and manage their supply chains.</p><p>The distribution of products and monitoring of their placement in stores could be managed through the usage of communities. Any issues in the supply chain management can be identified, and corrective action with the relevant stakeholders can be executed.</p><p>In addition, you can create dashboards for your customers and partners by using extension applications for Salesforce communities. These dashboards will make monitoring and tracking simple for your customers and partners. These communities may be customized, and some apps can be used to increase their functionality, making them an excellent tool for any business that wants to improve its supply chain management by fostering better communication and collaboration among employees.</p><p>Because this Community Cloud has pre-built custom templates and apps provided by third parties, it is possible to cut down on the costs associated with building bespoke in-house solutions.</p><p><strong><u>Employee Empowerment</u></strong> – It is astonishing to know but also a proven fact that 60% of businesses do not have a long-term strategy for managing their internal communications. However, communication is a necessity. When employees at a company are connected and regularly engage in effective forms of internal communication, the productivity of those individuals rises by 25%.</p><p>Organizations can improve their employees’ sense of community by establishing employee communities. Your workers will get to know one another better within the firm and strengthen communication more naturally if you provide a social platform for them to use.</p><p>It can be a practical approach to enhance communication and engagement among your teams to use Salesforce communities as a communication platform for your employees. Through open and public communication, data sharing, and more effective information distribution, it has the potential to bring down barriers and assist in the process of creating alignment among departments.</p><p>Your team members can instantly share their ideas, data, and insights in employee communities. They can assist in connecting others with crucial information that would be difficult to spread across a business via email alone correctly.</p><p>They will have a much simpler time locating specialists working for your company who can offer advice and speedily assist them in finding solutions to challenges. In addition, when these realizations are brought to the public’s attention, it will help other people in the future in finding solutions to the challenges that they are facing.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/5-Powerful-Benefits-of-Salesforce-Communites.jpeg\" data-entity-uuid=\"d0d8d3d7-1083-436d-ad9d-1289726e0ab7\" data-entity-type=\"file\" width=\"638\" height=\"359\"><p>&nbsp;</p><p><strong>Concluding Remarks</strong></p><p>The Salesforce Community Cloud can help in the advancement of your business entity. With the help of these Communities, your clients will have a forum to engage with your company and other customers. They also can benefit from the opportunity of high-quality after-sales service.</p><p>Consider these Salesforce customer communities if you want to increase sales, improve customer satisfaction, boost customer engagement, boost employee connectedness, and have the ability to interact and collaborate with your customers, including the ability to gain data insights from those interactions.</p><p>You can develop a fully functional portal for your customers and thoroughly personalize the experience they have as online customers, regardless of the size of your company.</p><p>These solutions can be seamlessly integrated without noticeable disruption to your existing systems. Since there are many avenues for modification, you may make it as straightforward or as complicated as you choose.</p><p><strong>DivIHN SalesForce Solutions</strong></p><p>DivIHN Integration Inc. can help unleash the Salesforce Cloud’s power and associated development tools. It is the world’s most trusted multi-tenant cloud platform. We can help to design and develop business strategy-driven solutions that integrate Salesforce with enterprise applications. To know more, please write to <a href=\"mailto:kannan@divihn.com\">kannan@divihn.com.</a></p>','','full_html'),('blog',0,73,178,'en',0,'<p><strong>DISCLAIMER</strong></p><p>Copyright ©2022 by DivIHN Integration Inc. |<a href=\"mailto:yoursuccess@divihn.com\">yoursuccess@divihn.com.</a></p><p>The creator of the document reserves all rights. Publication Date: July 2022. DivIHN Integration Inc. reserves the right to change the contents of this article, the features or the scope without the obligation to notify anyone of such changes. The content has been adapted using secondary research from various data points via “Google Search”. Infographics and Images used in the document are the property of the respective owners and have been used for indicative purposes only. The author reserves the right to authorize and use the Intellectual Property contained in the document.</p><p><strong>Table of Contents</strong></p><ol><li><a href=\"#introduction\">Introduction</a></li><li><a href=\"#salesforce_community\">What are Salesforce Communities</a></li><li><a href=\"#salesforce_types\">Types of Salesforce Communities</a></li><li><a href=\"#benfits\">How Salesforce Communities Could be Leveraged Beneficially</a></li><li><a href=\"#conclusion\">Concluding Remarks</a></li><li><a href=\"#solution\">DivIHN Salesforce Solutions</a></li></ol><p><strong>Introduction</strong></p><p>The technologies that we use transform into a better alternative continuously. At the same time, various businesses are adopting these technologies and expanding identically in the same way these products grow and evolve. One of these kinds of technologies that are currently assisting businesses is called the Salesforce Community Cloud.</p><p>Salesforce is one of the leading players globally in customer relationship management tools, and it is widely recognised for its ability to bring customers and businesses closer together.</p><p>This integrated CRM platform covers many functions for all your departments, including sales, commerce, marketing, and service, as well as a single common perspective of each consumer, allowing them to contribute to diverse sections of their operations cohesively.</p><p>Businesses in today’s world use Salesforce to understand their customers better, communicate with them on multiple levels, and expand their existing customer base.</p><p>The paradigm shift in the adoption of digital technologies has transformed how internet users interact with one another and the wider world. The human notion of feeling connected with others around us has lost its true meaning due to the rise of automation in the name of efficiency.</p><p>It is essential to support and maintain sales teams and administrative leadership. All parties involved, including consumers, employees, and management, want a genuine relationship with a human being.</p><p>Now, this is why there is such a thing as Salesforce Customer Communities, a fantastic technique to drive relationships that will significantly influence the growth of your organization to produce superior results.</p><p>In today’s age of digital advancement, the capacity to interact and collaborate has become the primary emphasis of all businesses. Every company or organization’s success depends on its ability to interact successfully with its customers, employees, and other consumers.</p><p>An online platform, Salesforce Community Cloud creates branded web portals for engaging customers, employees, and partners in a responsive manner. Primarily, it is a framework that allows companies to rapidly construct branded portals that can be optimized and adapted for mobile devices.</p><p><strong>What Are Salesforce Communities</strong></p><p>The Salesforce community cloud is a social platform developed by Salesforce to enhance the levels of communication and interaction between a company and its various stakeholders, including its employees, partners, and customers. The Salesforce Community Cloud uses a social CRM platform, enabling users to share their screens and communicate with one another. During a conversation already in progress, it allows its users to send and receive photos and data in real-time. Customers can search for information and engage with other customers through these platforms, simplifying customer relationship management (CRM). In addition, the console comes equipped with a button labelled “BUY,” which makes it easier to conduct business online. Employees can use the community cloud for various workplace interactions, including but not limited to human resource management (HRM), troubleshooting, help desk contact, and interactions between teams located in separate geographical areas. Similarly, leadership can utilize it to increase communication with its channel partners and other external parties.</p><img src=\"/sites/default/files/inline-images/5-Powerful-Benefits-of-Salesforce-Communites.png\" data-entity-uuid=\"4b306be0-9f74-40b0-b7ba-db35c31e048f\" data-entity-type=\"file\" width=\"800\" height=\"560\"><p>&nbsp;</p><p>&nbsp;<strong>Types of Salesforce Communities</strong></p><main class=\"container\" role=\"main\"><p>There are three types of communities that Salesforce cloud offers.</p><ul><li>Customer Communities – a self-service portal that gives assistance and feedback (frequently asked questions, articles, documentation, and interactions with other customers — for example, by using a Salesforce Success Community). Salesforce customer communities enable businesses to more effectively communicate pertinent information with one another, improve the overall customer experience, and boost engagement.</li><li>Internal Workforce Communities – IT department can create a portal for Human Resources and Information technology information for the employees within the organization. It allows employees to connect and offers them a single location for shared files, searchable knowledge databases and training materials, scheduling, project management, and organizational documents or announcements.</li><li>Business Partners Community – Salesforce Communities offers a specialized information hub for B2B organizations. It enables their sales teams and resellers to readily obtain critical data and communicate in real-time to close more deals. It is a place where partners can manage their businesses, learn best practices, receive the help they require, and communicate with Salesforce staff in a completely safe setting.</li></ul></main><p>&nbsp;</p><p><strong>How Salesforce Communities Could Be Leveraged Beneficially</strong></p><p><strong><u>Building Brand Experiences</u></strong>- Salesforce provides a wide range of options for users to modify the look and feel of their communities. To begin, you can customize the appearance to align with your organization’s branding. Making these adjustments can help to improve y</p><p>our brand’s image and these communities entailing your consumers, staff and business partners can also work as a trust-building platform.</p><p>Not only does a customer community allow them to interact with other clients and staff members of your business, but it also allows them to view interactions that have taken place between other clients and members of your team.</p><p>Customers who join such communities spend 19% more than customers who do not participate in branded communities. They can observe how your employees interact with one another, the quality of customer service that your employees provide, and the level of assistance they anticipate receiving from the community if they experience problems with the product or service you provide.</p><p><strong><u>24x7x365 Connectivity</u></strong>- Connections and collaboration are the two most important factors determining a company’s success. Salesforce communities offer a robust platform that can be used to forge new connections and grow existing ones while ensuring seamless integration between the two.</p><p>Users can communicate, work together, and complete transactions on the go, regardless of where they are. The seamless ability to share information and knowledge significantly impacts the workforce’s productivity. Providing customers with interactive areas in which they can connect will go a long way in resolving issues and answering questions.</p><p>To develop worldwide connections independent of work hours, the various groups that are important to your company are addressed in a tailored manner.</p><p><strong><u>Consumer Research and Insights</u></strong>- With Salesforce communities, you give customers an avenue to express the problems they are experiencing, voice their concerns, and participate candidly with your staff. This is possibly the most valuable aspect of developing a customer community for your business.</p><p>A customer community can be an essential component of your techniques for conducting consumer research. It provides a centralized location where your customers can come to you, ask questions, and gain public confirmation that other customers are having the same problem.</p><p>The Idea Exchange provides a beautiful illustration of this point. In this section, users can offer suggestions for new additions to the platform and modifications to existing features. As a result, thousands of customers are flooding into their community, pointing out problematic areas, offering proposals for additional features, and concurring with the ideas presented by other customers.</p><p>Businesses shell out thousands of dollars for this kind of consumer insight, and Salesforce communities enable you to put these processes on autopilot.</p><p><strong><u>Influencer Marketing</u></strong>- You likely have potential valuable brand ambassadors sitting around waiting for you to start a conversation with them and take your relationships to the next level. This development can be attributed to the fact that you are not constantly engaging in conversations with your customers.</p><p>You will have an easier time determining who the power users and public ambassadors for your product and brand are if you use Salesforce communities. They make their presence known by the amount of time they invest in contributing to your community and the feedback they provide to other clients.</p><p>You’ll be able to bring those individuals closer to your organization and provide them with the resources that will allow them to effectively become true high-level ambassadors for your brand if you make use of Salesforce communities. You can even contract them into the employee side of things, where you can use the collaboration, file sharing, and documentation capabilities to ensure that you are all on the same page.</p><p>A single, straightforward dashboard makes it possible to collaborate on content planning, gather content from social media, and more.</p><img src=\"/sites/default/files/inline-images/5-Powerful-Benefits-of-Salesforce-Communites-1.jpeg\" data-entity-uuid=\"04bf261b-979e-4aa3-a32e-615770a0a5dc\" data-entity-type=\"file\" width=\"638\" height=\"479\"><p>&nbsp;</p><p><strong><u>Optimizing The Supply Chain and costs</u></strong> – Managing a corporate supply chain can be challenging if the appropriate tools are unavailable. When manufacturers participate in Salesforce communities, they receive access to a wide variety of technologies that allow them to improve how they interact with their suppliers and manage their supply chains.</p><p>The distribution of products and monitoring of their placement in stores could be managed through the usage of communities. Any issues in the supply chain management can be identified, and corrective action with the relevant stakeholders can be executed.</p><p>In addition, you can create dashboards for your customers and partners by using extension applications for Salesforce communities. These dashboards will make monitoring and tracking simple for your customers and partners. These communities may be customized, and some apps can be used to increase their functionality, making them an excellent tool for any business that wants to improve its supply chain management by fostering better communication and collaboration among employees.</p><p>Because this Community Cloud has pre-built custom templates and apps provided by third parties, it is possible to cut down on the costs associated with building bespoke in-house solutions.</p><p><strong><u>Employee Empowerment</u></strong> – It is astonishing to know but also a proven fact that 60% of businesses do not have a long-term strategy for managing their internal communications. However, communication is a necessity. When employees at a company are connected and regularly engage in effective forms of internal communication, the productivity of those individuals rises by 25%.</p><p>Organizations can improve their employees’ sense of community by establishing employee communities. Your workers will get to know one another better within the firm and strengthen communication more naturally if you provide a social platform for them to use.</p><p>It can be a practical approach to enhance communication and engagement among your teams to use Salesforce communities as a communication platform for your employees. Through open and public communication, data sharing, and more effective information distribution, it has the potential to bring down barriers and assist in the process of creating alignment among departments.</p><p>Your team members can instantly share their ideas, data, and insights in employee communities. They can assist in connecting others with crucial information that would be difficult to spread across a business via email alone correctly.</p><p>They will have a much simpler time locating specialists working for your company who can offer advice and speedily assist them in finding solutions to challenges. In addition, when these realizations are brought to the public’s attention, it will help other people in the future in finding solutions to the challenges that they are facing.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/5-Powerful-Benefits-of-Salesforce-Communites.jpeg\" data-entity-uuid=\"d0d8d3d7-1083-436d-ad9d-1289726e0ab7\" data-entity-type=\"file\" width=\"638\" height=\"359\"><p>&nbsp;</p><p><strong>Concluding Remarks</strong></p><p>The Salesforce Community Cloud can help in the advancement of your business entity. With the help of these Communities, your clients will have a forum to engage with your company and other customers. They also can benefit from the opportunity of high-quality after-sales service.</p><p>Consider these Salesforce customer communities if you want to increase sales, improve customer satisfaction, boost customer engagement, boost employee connectedness, and have the ability to interact and collaborate with your customers, including the ability to gain data insights from those interactions.</p><p>You can develop a fully functional portal for your customers and thoroughly personalize the experience they have as online customers, regardless of the size of your company.</p><p>These solutions can be seamlessly integrated without noticeable disruption to your existing systems. Since there are many avenues for modification, you may make it as straightforward or as complicated as you choose.</p><p><strong>DivIHN SalesForce Solutions</strong></p><p>DivIHN Integration Inc. can help unleash the Salesforce Cloud’s power and associated development tools. It is the world’s most trusted multi-tenant cloud platform. We can help to design and develop business strategy-driven solutions that integrate Salesforce with enterprise applications. To know more, please write to <a href=\"mailto:kannan@divihn.com\">kannan@divihn.com.</a></p>','','full_html'),