('featured_article',0,51,520,'en',0,'<!-- Headline with stylized first letter --><div class=\"headline\"><span class=\"first-letter\">N</span>ever trust, always verify.</div><!-- Body Paragraph --><p>The traditional idea of the well-defined network perimeter is outdated in a world where organizations are increasingly moving applications and data to cloud services, embracing a highly mobile remote workforce, and dealing with a significantly growing number of devices attaching to the corporate network. Many digital transformation initiatives are forcing businesses to rethink their enterprise security architecture. As organizations go through these changes, security concerns are paramount with cyber attacks on the rise.</p><!-- Quoted statistic --><p class=\"quote\"><em>“In March, there was a 30,000% increase in COVID-19 related attacks and malware.”(Source: Zscaler)</em></p><!-- Follow-up content --><p>&nbsp;</p><p>Today’s new reality in an increasingly perimeter-less world begs the question: how does an organization protect itself? The Zero Trust framework presumes bad actors are already in the network. The approach deploys multiple strategies such as (a) identity and access management, (b) multifactor authentication, (c) encryption, (d) risk scoring, and (e)role-based access controls to enforce strict governance policies. These policies provide user access to specific applications and resources aligned with their roles and responsibilities. This limits not only <em>north-south</em> movement in the network, but also <em>east-west</em> lateral movement across the network.</p><p><strong>Four (4) Things You Need To Know</strong></p><p>The methodologies that enable Zero Trust accomplish five (5) core tasks:</p><ol><li><p><strong>Micro-segmentation.</strong> Micro-segmentation is a method of creating secure zones in data centers, cloud deployments, and even applications, allowing organizations to isolate workloads from one another and secure them individually. It is aimed at making network security more granular. Using micro-segmentation, files in a network can be placed in separate secure zones. A user or program with access to one of those zones will not be able to access any of the other zones without separate authorization, tying security to individual workloads.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust_0.png\" data-entity-uuid=\"64a65fd7-9658-44dd-8310-feaeb8c99e1c\" data-entity-type=\"file\" width=\"300\" height=\"249\"></p></li><li><strong>Least Privilege Access</strong>. Zero-Trust is based on granting least privilege access. However, the access is only granted on verification of multiple contextual environmental variables at each request, such as: (a) who is requesting access, (b) what is the context of the request, and (c) what is the risk of access to the environment. Zero-trust no longer provides trust to anyone or anything connecting to valued systems. It treats equally traffic originating from within the network as well traffic arriving externally – users, devices, even API’s are all treated the same. This enables minimization of the attack surface, it improves audit, and reduces the risk and costs of security breaches.</li><li><strong>Multi-factor Authentication (MFA)</strong>. MFA is a core value of zero trust security. It means simply requiring more than one piece of evidence to authenticate a user, entering a password alone is not enough to gain access. The use of two-factor authorization—the addition of a code sent to another device — is now widely used and accepted by consumers and stakeholders. Other forms of authentication — biometrics — are emerging to bolster identity verification.</li><li><p><strong>Application Behavior and Visibility</strong>. A benefit of micro-segmentation is the enablement of application security that builds in policies defining allowed behavior and protection for each individual build. As example, ideation through development occurs in an environment isolated from the rest of the network so that any breach of an application will be contained and prevented from spreading into the rest of the network. Visibility into application behavior on devices that access applications also needs to be taken into account so anomalous activity can be detected and action can be taken more quickly.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust-2png.png\" data-entity-uuid=\"556637b5-cc8f-496e-b4c5-0ed550ac54b1\" data-entity-type=\"file\" width=\"918\" height=\"522\"></p></li></ol><p><strong>Designing and Building</strong></p><p>Use a five (5) step model for implementing and maintaining a Zero Trust network:</p><ol><li><strong>Define the protect surface.</strong> In the Zero Trust defining the scope of the protect surface in manageable portions is critically important. The protect surface should include the critical</li><li><strong>Map the transactions flows.</strong> How traffic moves across a network should define how it is protected. Therefore it is essential to gain contextual insight on the interdependencies of your data, application, assets and services – the DAAS. Documenting the interaction between specific resources allows the ability to properly enforce controls. It also provides valuable context to ensure the controls help protect the data.</li><li><strong>Architect a Zero Trust network.</strong> Zero Trust networks are built from the ground up, architected and customized around specific requirements for the protect surfaces. However it is imperative that the protect surface and transaction flow maps be completed first.</li><li><strong>Create the Zero Trust policy.</strong> Once the Zero Trust network has been architected, the next step is to define and whitelist which resources should have access to the others. The questions of “who, what, when, where, why and how” work well here.</li><li><strong>Monitor and maintain the network.</strong> Lastly, the final step is to ensure logging is enabled, all logs are reviewed (both internal and external) and data is analyzed in a timely manner. Visibility should be all way through Layer 7 of the OSI model.</li></ol><p>Upon completing the first protect surface for your organization, this model can be iteratively and easily expanded to other data sets, applications, assets and services from legacy or modern systems. It can be implemented in a cost-effective and non-destructive way.</p><p><strong>Zero Trust and the Future of Work</strong></p><p>Security objectives and best practices to keep mind while designing and building a Zero Trust environment that serves today’s needs and into the future should include these considerations:</p><ul class=\"BlogPreventList\"><li><strong>Think Anytime, Anywhere. </strong>Secure applications, data, users, devices and network traffic through persistent protection, all with the same degree of effectiveness regardless of location. The user experience should be frictionless and easy to deploy.</li><li><strong>Build for Resilience. </strong>As organizations mature their continuity of operations and crisis management plans, a Zero Trust architecture allows organizations to adapt and move quickly to changing environments and realities, in addition to providing strong cybersecurity best practices.</li></ul><p>Zero Trust means different things to different organizations. It is an approach, a framework. Zero Trust is not a specific tool or set of tools. It can be adapted to many use cases, particularly for remote work, teleworking, and BYOD (Bring Your Own Device) typically a practice still not considered secure, and it can be implement one defined protect surface at a time.</p><p>As senior leaders we are asked to be more strategic and drive revenue through technologies and integration as the business goals and needs expand. At the same time, cybersecurity is an incredibly complex problem to solve from both the end user side and in the data center as attack surfaces become even broader. It’s no longer a question of “if” a breach will happen but “when.” Zero Trust provides a scalable adaptive solution.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('featured_article',0,51,536,'en',0,'<!-- Headline with stylized first letter --><div class=\"headline\"><span class=\"first-letter\">N</span>ever trust, always verify.</div><!-- Body Paragraph --><p>The traditional idea of the well-defined network perimeter is outdated in a world where organizations are increasingly moving applications and data to cloud services, embracing a highly mobile remote workforce, and dealing with a significantly growing number of devices attaching to the corporate network. Many digital transformation initiatives are forcing businesses to rethink their enterprise security architecture. As organizations go through these changes, security concerns are paramount with cyber attacks on the rise.</p><!-- Quoted statistic --><p class=\"quote\"><em>“In March, there was a 30,000% increase in COVID-19 related attacks and malware.”(Source: Zscaler)</em></p><!-- Follow-up content --><p>&nbsp;</p><p>Today’s new reality in an increasingly perimeter-less world begs the question: how does an organization protect itself? The Zero Trust framework presumes bad actors are already in the network. The approach deploys multiple strategies such as (a) identity and access management, (b) multifactor authentication, (c) encryption, (d) risk scoring, and (e)role-based access controls to enforce strict governance policies. These policies provide user access to specific applications and resources aligned with their roles and responsibilities. This limits not only <em>north-south</em> movement in the network, but also <em>east-west</em> lateral movement across the network.</p><p><strong>Four (4) Things You Need To Know</strong></p><p>The methodologies that enable Zero Trust accomplish five (5) core tasks:</p><ol><li><p><strong>Micro-segmentation.</strong> Micro-segmentation is a method of creating secure zones in data centers, cloud deployments, and even applications, allowing organizations to isolate workloads from one another and secure them individually. It is aimed at making network security more granular. Using micro-segmentation, files in a network can be placed in separate secure zones. A user or program with access to one of those zones will not be able to access any of the other zones without separate authorization, tying security to individual workloads.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust_0.png\" data-entity-uuid=\"64a65fd7-9658-44dd-8310-feaeb8c99e1c\" data-entity-type=\"file\" width=\"300\" height=\"249\"></p></li><li><strong>Least Privilege Access</strong>. Zero-Trust is based on granting least privilege access. However, the access is only granted on verification of multiple contextual environmental variables at each request, such as: (a) who is requesting access, (b) what is the context of the request, and (c) what is the risk of access to the environment. Zero-trust no longer provides trust to anyone or anything connecting to valued systems. It treats equally traffic originating from within the network as well traffic arriving externally – users, devices, even API’s are all treated the same. This enables minimization of the attack surface, it improves audit, and reduces the risk and costs of security breaches.</li><li><strong>Multi-factor Authentication (MFA)</strong>. MFA is a core value of zero trust security. It means simply requiring more than one piece of evidence to authenticate a user, entering a password alone is not enough to gain access. The use of two-factor authorization—the addition of a code sent to another device — is now widely used and accepted by consumers and stakeholders. Other forms of authentication — biometrics — are emerging to bolster identity verification.</li><li><p><strong>Application Behavior and Visibility</strong>. A benefit of micro-segmentation is the enablement of application security that builds in policies defining allowed behavior and protection for each individual build. As example, ideation through development occurs in an environment isolated from the rest of the network so that any breach of an application will be contained and prevented from spreading into the rest of the network. Visibility into application behavior on devices that access applications also needs to be taken into account so anomalous activity can be detected and action can be taken more quickly.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust-2png.png\" data-entity-uuid=\"556637b5-cc8f-496e-b4c5-0ed550ac54b1\" data-entity-type=\"file\" width=\"918\" height=\"522\"></p></li></ol><p><strong>Designing and Building</strong></p><p>Use a five (5) step model for implementing and maintaining a Zero Trust network:</p><ol><li><strong>Define the protect surface.</strong> In the Zero Trust defining the scope of the protect surface in manageable portions is critically important. The protect surface should include the critical</li><li><strong>Map the transactions flows.</strong> How traffic moves across a network should define how it is protected. Therefore it is essential to gain contextual insight on the interdependencies of your data, application, assets and services – the DAAS. Documenting the interaction between specific resources allows the ability to properly enforce controls. It also provides valuable context to ensure the controls help protect the data.</li><li><strong>Architect a Zero Trust network.</strong> Zero Trust networks are built from the ground up, architected and customized around specific requirements for the protect surfaces. However it is imperative that the protect surface and transaction flow maps be completed first.</li><li><strong>Create the Zero Trust policy.</strong> Once the Zero Trust network has been architected, the next step is to define and whitelist which resources should have access to the others. The questions of “who, what, when, where, why and how” work well here.</li><li><strong>Monitor and maintain the network.</strong> Lastly, the final step is to ensure logging is enabled, all logs are reviewed (both internal and external) and data is analyzed in a timely manner. Visibility should be all way through Layer 7 of the OSI model.</li></ol><p>Upon completing the first protect surface for your organization, this model can be iteratively and easily expanded to other data sets, applications, assets and services from legacy or modern systems. It can be implemented in a cost-effective and non-destructive way.</p><p><strong>Zero Trust and the Future of Work</strong></p><p>Security objectives and best practices to keep mind while designing and building a Zero Trust environment that serves today’s needs and into the future should include these considerations:</p><ul class=\"BlogPreventList\"><li><strong>Think Anytime, Anywhere. </strong>Secure applications, data, users, devices and network traffic through persistent protection, all with the same degree of effectiveness regardless of location. The user experience should be frictionless and easy to deploy.</li><li><strong>Build for Resilience. </strong>As organizations mature their continuity of operations and crisis management plans, a Zero Trust architecture allows organizations to adapt and move quickly to changing environments and realities, in addition to providing strong cybersecurity best practices.</li></ul><p>Zero Trust means different things to different organizations. It is an approach, a framework. Zero Trust is not a specific tool or set of tools. It can be adapted to many use cases, particularly for remote work, teleworking, and BYOD (Bring Your Own Device) typically a practice still not considered secure, and it can be implement one defined protect surface at a time.</p><p>As senior leaders we are asked to be more strategic and drive revenue through technologies and integration as the business goals and needs expand. At the same time, cybersecurity is an incredibly complex problem to solve from both the end user side and in the data center as attack surfaces become even broader. It’s no longer a question of “if” a breach will happen but “when.” Zero Trust provides a scalable adaptive solution.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('featured_article',0,51,611,'en',0,'<!-- Headline with stylized first letter --><div class=\"headline\"><span class=\"first-letter\">N</span>ever trust, always verify.</div><!-- Body Paragraph --><p>The traditional idea of the well-defined network perimeter is outdated in a world where organizations are increasingly moving applications and data to cloud services, embracing a highly mobile remote workforce, and dealing with a significantly growing number of devices attaching to the corporate network. Many digital transformation initiatives are forcing businesses to rethink their enterprise security architecture. As organizations go through these changes, security concerns are paramount with cyber attacks on the rise.</p><!-- Quoted statistic --><p class=\"quote\"><em>“In March, there was a 30,000% increase in COVID-19 related attacks and malware.”(Source: Zscaler)</em></p><!-- Follow-up content --><p>&nbsp;</p><p>Today’s new reality in an increasingly perimeter-less world begs the question: how does an organization protect itself? The Zero Trust framework presumes bad actors are already in the network. The approach deploys multiple strategies such as (a) identity and access management, (b) multifactor authentication, (c) encryption, (d) risk scoring, and (e)role-based access controls to enforce strict governance policies. These policies provide user access to specific applications and resources aligned with their roles and responsibilities. This limits not only <em>north-south</em> movement in the network, but also <em>east-west</em> lateral movement across the network.</p><p><strong>Four (4) Things You Need To Know</strong></p><p>The methodologies that enable Zero Trust accomplish five (5) core tasks:</p><ol><li><p><strong>Micro-segmentation.</strong> Micro-segmentation is a method of creating secure zones in data centers, cloud deployments, and even applications, allowing organizations to isolate workloads from one another and secure them individually. It is aimed at making network security more granular. Using micro-segmentation, files in a network can be placed in separate secure zones. A user or program with access to one of those zones will not be able to access any of the other zones without separate authorization, tying security to individual workloads.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust_0.png\" data-entity-uuid=\"64a65fd7-9658-44dd-8310-feaeb8c99e1c\" data-entity-type=\"file\" width=\"300\" height=\"249\"></p></li><li><strong>Least Privilege Access</strong>. Zero-Trust is based on granting least privilege access. However, the access is only granted on verification of multiple contextual environmental variables at each request, such as: (a) who is requesting access, (b) what is the context of the request, and (c) what is the risk of access to the environment. Zero-trust no longer provides trust to anyone or anything connecting to valued systems. It treats equally traffic originating from within the network as well traffic arriving externally – users, devices, even API’s are all treated the same. This enables minimization of the attack surface, it improves audit, and reduces the risk and costs of security breaches.</li><li><strong>Multi-factor Authentication (MFA)</strong>. MFA is a core value of zero trust security. It means simply requiring more than one piece of evidence to authenticate a user, entering a password alone is not enough to gain access. The use of two-factor authorization—the addition of a code sent to another device — is now widely used and accepted by consumers and stakeholders. Other forms of authentication — biometrics — are emerging to bolster identity verification.</li><li><p><strong>Application Behavior and Visibility</strong>. A benefit of micro-segmentation is the enablement of application security that builds in policies defining allowed behavior and protection for each individual build. As example, ideation through development occurs in an environment isolated from the rest of the network so that any breach of an application will be contained and prevented from spreading into the rest of the network. Visibility into application behavior on devices that access applications also needs to be taken into account so anomalous activity can be detected and action can be taken more quickly.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust-2png.png\" data-entity-uuid=\"556637b5-cc8f-496e-b4c5-0ed550ac54b1\" data-entity-type=\"file\" width=\"918\" height=\"522\"></p></li></ol><p><strong>Designing and Building</strong></p><p>Use a five (5) step model for implementing and maintaining a Zero Trust network:</p><ol><li><strong>Define the protect surface.</strong> In the Zero Trust defining the scope of the protect surface in manageable portions is critically important. The protect surface should include the critical</li><li><strong>Map the transactions flows.</strong> How traffic moves across a network should define how it is protected. Therefore it is essential to gain contextual insight on the interdependencies of your data, application, assets and services – the DAAS. Documenting the interaction between specific resources allows the ability to properly enforce controls. It also provides valuable context to ensure the controls help protect the data.</li><li><strong>Architect a Zero Trust network.</strong> Zero Trust networks are built from the ground up, architected and customized around specific requirements for the protect surfaces. However it is imperative that the protect surface and transaction flow maps be completed first.</li><li><strong>Create the Zero Trust policy.</strong> Once the Zero Trust network has been architected, the next step is to define and whitelist which resources should have access to the others. The questions of “who, what, when, where, why and how” work well here.</li><li><strong>Monitor and maintain the network.</strong> Lastly, the final step is to ensure logging is enabled, all logs are reviewed (both internal and external) and data is analyzed in a timely manner. Visibility should be all way through Layer 7 of the OSI model.</li></ol><p>Upon completing the first protect surface for your organization, this model can be iteratively and easily expanded to other data sets, applications, assets and services from legacy or modern systems. It can be implemented in a cost-effective and non-destructive way.</p><p><strong>Zero Trust and the Future of Work</strong></p><p>Security objectives and best practices to keep mind while designing and building a Zero Trust environment that serves today’s needs and into the future should include these considerations:</p><ul class=\"BlogPreventList\"><li><strong>Think Anytime, Anywhere. </strong>Secure applications, data, users, devices and network traffic through persistent protection, all with the same degree of effectiveness regardless of location. The user experience should be frictionless and easy to deploy.</li><li><strong>Build for Resilience. </strong>As organizations mature their continuity of operations and crisis management plans, a Zero Trust architecture allows organizations to adapt and move quickly to changing environments and realities, in addition to providing strong cybersecurity best practices.</li></ul><p>Zero Trust means different things to different organizations. It is an approach, a framework. Zero Trust is not a specific tool or set of tools. It can be adapted to many use cases, particularly for remote work, teleworking, and BYOD (Bring Your Own Device) typically a practice still not considered secure, and it can be implement one defined protect surface at a time.</p><p>As senior leaders we are asked to be more strategic and drive revenue through technologies and integration as the business goals and needs expand. At the same time, cybersecurity is an incredibly complex problem to solve from both the end user side and in the data center as attack surfaces become even broader. It’s no longer a question of “if” a breach will happen but “when.” Zero Trust provides a scalable adaptive solution.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('client_success',0,52,99,'en',0,'<p>Our client, a leading independent producer of high-quality, specialty hydrocarbon products, agreed to sell a 50,000 barrel per day refinery, associated delivery terminals, and related assets to an unaffiliated energy company for $435 million.</p>','','full_html'),('client_success',0,52,679,'en',0,'<p>Our client, a leading independent producer of high-quality, specialty hydrocarbon products, agreed to sell a 50,000 barrel per day refinery, associated delivery terminals, and related assets to an unaffiliated energy company for $435 million.</p>','','full_html'),('featured_article',0,53,100,'en',0,'<div style=\"font-family:Arial, sans-serif;font-size:16px;white-space:pre-wrap;\">\r\n                                                                                    T\r\n                                                                                    he California Consumer Privacy Act (CCPA) is a new regulation on the horizon that organizations must understand and, if applicable, take action to comply. CCPA becomes effective January 1, 2020 and time is running out.\r\n                                                                                      \r\n</div><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Overview</title><p>Some have compared CCPA to General Data Protection Regulation (GDPR) and, in reality, there is some overlap but there are also several differences. Similar to GDPR, CCPA reinforces a key principle: privacy is a fundamental right and individuals must be able to control the collection and use of their personal data.</p><p>CCPA is focused on giving the consumer rights to know what personal information is collected, to whom it’s sold or disclosed to, and the ability to exercise rights without fearing discrimination. The regulation also imposes responsibility on organizations to process consumer requests, manage risk to consumer personal information, and respond to breaches in a timely manner. The CCPA holds organizations accountable by enforcing fines for violations when they haven’t taken proper steps to protect consumers’ personal information.</p><p>The core consumer rights granted by CCPA are described below. As with any regulation, caveats are in place to promote fairness to both the consumer and organizations collecting and processing their personal information. For example, the right to deletion is granted but there are nine exceptions in place that enable organizations to retain consumers personal information (regulation section 1798.105(d)).</p><p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Consumer Rights under CCPA</title></p><p>Consumer Rights</p><ul><li><strong>Right To Disclosure –</strong> Consumers have a right to know what personal information is collected and whether it’s sold or disclosed and to whom. The Right to disclosure also enables the consumer to receive a copy of their personal data in a standard format.</li><li><strong>Right To Deletion –</strong> Consumers may present a request to delete their personal information retained by the organization.</li><li><strong>Right To Opt-out –</strong> Consumers may exercise the right to say no to the sale of their personal information.</li><li><strong>Right To Nondiscrimination –</strong> When consumers exercise rights enabled by the CCPA, organizations must not apply financial penalties, deny goods and services, or provide an unequal service as a result of their requests.</li></ul><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Applicability</title><p>CCPA is applicable to for profit organizations collecting personal information from California residents and determining what is done with the data. Additionally, one or more of the following must apply for organizations to be subject to CCPA:</p><ul><li>Annual gross revenue is greater than $25mil</li><li>Personal information from &gt;50k consumers, households, or devices</li><li>Derive greater than 50% of annual revenue generated from the sale of consumer’s personal information</li></ul><p>As with any regulation, the definition of personal information influences the impact on organizations need to comply. CCPA defines personal information as information that identifies, describes, or could be reasonably linked to a consumer or household (regulation section 1798.140(o)). Personal information includes the items listed below. The list is not definitive and can change at any time.</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Personal Information under CCPA</title><p>&nbsp;Personal Information</p><ul><li><strong>Identifiers:</strong> real name, social security number, driver’s license number, email address, postal address, IP address, account ID or online identifier.</li><li><strong>Commercial Information:</strong> personal property records, purchase history and patterns</li><li><strong>Biometric Information:</strong> DNA, fingerprint data, and iris scan data</li><li><strong>Electronic Activity:</strong> search history, browsing history, and cookie data</li><li><strong>Geolocation:</strong> GPS data</li><li><strong>Inferences/Profiling:</strong> behavior, personal preferences, psychological state</li></ul><p>Now that we’ve established what CCPA is and how it applies, the question becomes what do you have to do to prepare for compliance. Those organizations familiar with GDPR will notice these steps.</p><p>&nbsp;</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Key Considerations For CCPA Compliance</title><p>&nbsp;Key Considerations For CCPA Compliance</p><p>Assess Applicability – Identify the California residents, devices, and households targeted by the organization. Determine whether the organization must comply with the CCPA.</p><p>Perform Data and Processing Inventory – Understand what personal data collected and processed. Additionally, identify the third parties the data is sold to. This critical step will require significant effort if the data inventory and flows don’t exist. The effort is worth it because the output can be used for other privacy initiatives and improves the organization’s ability to protect the data.</p><p>Assess Policies – Include a description of consumer’s rights in the organization’s privacy policy.</p><p>Update Website – The CCPA requires all web sites to contain a link labeled “Do Not Sell My Information”. This link must be conspicuously placed on the web site home page and must enable the consumer to opt out of the sale of their personal information.</p><p>Support Consumer Rights – Make available two methods to allow consumers to submit requests: toll free number and form on website is acceptable. Additionally, implement processes to intake and satisfy requests in a timely manner (45 days from receipt of verifiable request). The process must include a preliminary assessment to verify the request before fulfillment.</p><p>Apply Technical Measures and Controls – Organizations must implement practices to understand the privacy impact as new software is introduced, scope of data collected changes, or processing of personal data changes. Furthermore, leadings practices must be established to protect personal data in the possession of the organization. Data Protection Impact Assessments (DPIAs) are used to assess privacy implications and establish appropriate security controls to manage risk. This is followed up with leading practices such as encryption to protect the personal data of California consumers. This is important to limit the organization and consumer exposure in the event of a breach or data leakage. Additionally, the CCPA allows the California Attorney General to impose significant penalties if breached or leaked data is unencrypted or not redacted. There are many additional considerations for data protection but we’ll stop here for now.</p><p>The CCPA is primarily focused on privacy but the impact is felt throughout many departments in the organization. Understanding what personal information you have, how it’s processed (including the sale of the data), and how it’s protected is on the critical path to establishing CCPA compliance. The first two items are needed to establish the right processes to support consumer rights. The latter item is needed to ensure personal data is handled responsibly – reasonable measures.</p><p>This post provides a basic understanding of the CCPA and what organizations must do to prepare for compliance. The regulation is comprehensive and requires a deeper dive to understand how it applies to your organization and the specific next steps needed to achieve compliance.</p><p>Additional CCPA information can be referenced on the State of California Department of Justice or the Californian’s Consumer Privacy website.</p><p>Before the draft of this post was completed the state of Nevada passed its own privacy law advancing the privacy rights of consumers. The regulation is more narrow than CCPA but will become effective on October 1, 2019. The message here is privacy laws will continue to be passed and organizations will be pressed to comply. Get ahead of the wave and develop a strong privacy framework that enables reasonable consumer/data subject/individual rights based on your business model, and enforce it by adopting privacy by design methods and effective security program to protect the organization’s data and technology assets.</p>','','full_html'),('featured_article',0,53,132,'en',0,'<div style=\"font-family:Arial, sans-serif;font-size:16px;white-space:pre-wrap;\">\r\n                                                                                    T\r\n                                                                                    he California Consumer Privacy Act (CCPA) is a new regulation on the horizon that organizations must understand and, if applicable, take action to comply. CCPA becomes effective January 1, 2020 and time is running out.\r\n                                                                                      \r\n</div><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Overview</title><p>Some have compared CCPA to General Data Protection Regulation (GDPR) and, in reality, there is some overlap but there are also several differences. Similar to GDPR, CCPA reinforces a key principle: privacy is a fundamental right and individuals must be able to control the collection and use of their personal data.</p><p>CCPA is focused on giving the consumer rights to know what personal information is collected, to whom it’s sold or disclosed to, and the ability to exercise rights without fearing discrimination. The regulation also imposes responsibility on organizations to process consumer requests, manage risk to consumer personal information, and respond to breaches in a timely manner. The CCPA holds organizations accountable by enforcing fines for violations when they haven’t taken proper steps to protect consumers’ personal information.</p><p>The core consumer rights granted by CCPA are described below. As with any regulation, caveats are in place to promote fairness to both the consumer and organizations collecting and processing their personal information. For example, the right to deletion is granted but there are nine exceptions in place that enable organizations to retain consumers personal information (regulation section 1798.105(d)).</p><p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Consumer Rights under CCPA</title></p><p>Consumer Rights</p><ul><li><strong>Right To Disclosure –</strong> Consumers have a right to know what personal information is collected and whether it’s sold or disclosed and to whom. The Right to disclosure also enables the consumer to receive a copy of their personal data in a standard format.</li><li><strong>Right To Deletion –</strong> Consumers may present a request to delete their personal information retained by the organization.</li><li><strong>Right To Opt-out –</strong> Consumers may exercise the right to say no to the sale of their personal information.</li><li><strong>Right To Nondiscrimination –</strong> When consumers exercise rights enabled by the CCPA, organizations must not apply financial penalties, deny goods and services, or provide an unequal service as a result of their requests.</li></ul><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Applicability</title><p>CCPA is applicable to for profit organizations collecting personal information from California residents and determining what is done with the data. Additionally, one or more of the following must apply for organizations to be subject to CCPA:</p><ul><li>Annual gross revenue is greater than $25mil</li><li>Personal information from &gt;50k consumers, households, or devices</li><li>Derive greater than 50% of annual revenue generated from the sale of consumer’s personal information</li></ul><p>As with any regulation, the definition of personal information influences the impact on organizations need to comply. CCPA defines personal information as information that identifies, describes, or could be reasonably linked to a consumer or household (regulation section 1798.140(o)). Personal information includes the items listed below. The list is not definitive and can change at any time.</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Personal Information under CCPA</title><p>&nbsp;Personal Information</p><ul><li><strong>Identifiers:</strong> real name, social security number, driver’s license number, email address, postal address, IP address, account ID or online identifier.</li><li><strong>Commercial Information:</strong> personal property records, purchase history and patterns</li><li><strong>Biometric Information:</strong> DNA, fingerprint data, and iris scan data</li><li><strong>Electronic Activity:</strong> search history, browsing history, and cookie data</li><li><strong>Geolocation:</strong> GPS data</li><li><strong>Inferences/Profiling:</strong> behavior, personal preferences, psychological state</li></ul><p>Now that we’ve established what CCPA is and how it applies, the question becomes what do you have to do to prepare for compliance. Those organizations familiar with GDPR will notice these steps.</p><p>&nbsp;</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Key Considerations For CCPA Compliance</title><p>&nbsp;Key Considerations For CCPA Compliance</p><p>Assess Applicability – Identify the California residents, devices, and households targeted by the organization. Determine whether the organization must comply with the CCPA.</p><p>Perform Data and Processing Inventory – Understand what personal data collected and processed. Additionally, identify the third parties the data is sold to. This critical step will require significant effort if the data inventory and flows don’t exist. The effort is worth it because the output can be used for other privacy initiatives and improves the organization’s ability to protect the data.</p><p>Assess Policies – Include a description of consumer’s rights in the organization’s privacy policy.</p><p>Update Website – The CCPA requires all web sites to contain a link labeled “Do Not Sell My Information”. This link must be conspicuously placed on the web site home page and must enable the consumer to opt out of the sale of their personal information.</p><p>Support Consumer Rights – Make available two methods to allow consumers to submit requests: toll free number and form on website is acceptable. Additionally, implement processes to intake and satisfy requests in a timely manner (45 days from receipt of verifiable request). The process must include a preliminary assessment to verify the request before fulfillment.</p><p>Apply Technical Measures and Controls – Organizations must implement practices to understand the privacy impact as new software is introduced, scope of data collected changes, or processing of personal data changes. Furthermore, leadings practices must be established to protect personal data in the possession of the organization. Data Protection Impact Assessments (DPIAs) are used to assess privacy implications and establish appropriate security controls to manage risk. This is followed up with leading practices such as encryption to protect the personal data of California consumers. This is important to limit the organization and consumer exposure in the event of a breach or data leakage. Additionally, the CCPA allows the California Attorney General to impose significant penalties if breached or leaked data is unencrypted or not redacted. There are many additional considerations for data protection but we’ll stop here for now.</p><p>The CCPA is primarily focused on privacy but the impact is felt throughout many departments in the organization. Understanding what personal information you have, how it’s processed (including the sale of the data), and how it’s protected is on the critical path to establishing CCPA compliance. The first two items are needed to establish the right processes to support consumer rights. The latter item is needed to ensure personal data is handled responsibly – reasonable measures.</p><p>This post provides a basic understanding of the CCPA and what organizations must do to prepare for compliance. The regulation is comprehensive and requires a deeper dive to understand how it applies to your organization and the specific next steps needed to achieve compliance.</p><p>Additional CCPA information can be referenced on the State of California Department of Justice or the Californian’s Consumer Privacy website.</p><p>Before the draft of this post was completed the state of Nevada passed its own privacy law advancing the privacy rights of consumers. The regulation is more narrow than CCPA but will become effective on October 1, 2019. The message here is privacy laws will continue to be passed and organizations will be pressed to comply. Get ahead of the wave and develop a strong privacy framework that enables reasonable consumer/data subject/individual rights based on your business model, and enforce it by adopting privacy by design methods and effective security program to protect the organization’s data and technology assets.</p>','','full_html'),('featured_article',0,53,268,'en',0,'<div style=\"font-family:Arial, sans-serif;font-size:16px;white-space:pre-wrap;\">\r\n                                                                                    T\r\n                                                                                    he California Consumer Privacy Act (CCPA) is a new regulation on the horizon that organizations must understand and, if applicable, take action to comply. CCPA becomes effective January 1, 2020 and time is running out.\r\n                                                                                      \r\n</div><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Overview</title><p>Some have compared CCPA to General Data Protection Regulation (GDPR) and, in reality, there is some overlap but there are also several differences. Similar to GDPR, CCPA reinforces a key principle: privacy is a fundamental right and individuals must be able to control the collection and use of their personal data.</p><p>CCPA is focused on giving the consumer rights to know what personal information is collected, to whom it’s sold or disclosed to, and the ability to exercise rights without fearing discrimination. The regulation also imposes responsibility on organizations to process consumer requests, manage risk to consumer personal information, and respond to breaches in a timely manner. The CCPA holds organizations accountable by enforcing fines for violations when they haven’t taken proper steps to protect consumers’ personal information.</p><p>The core consumer rights granted by CCPA are described below. As with any regulation, caveats are in place to promote fairness to both the consumer and organizations collecting and processing their personal information. For example, the right to deletion is granted but there are nine exceptions in place that enable organizations to retain consumers personal information (regulation section 1798.105(d)).</p><p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Consumer Rights under CCPA</title></p><p>Consumer Rights</p><ul><li><strong>Right To Disclosure –</strong> Consumers have a right to know what personal information is collected and whether it’s sold or disclosed and to whom. The Right to disclosure also enables the consumer to receive a copy of their personal data in a standard format.</li><li><strong>Right To Deletion –</strong> Consumers may present a request to delete their personal information retained by the organization.</li><li><strong>Right To Opt-out –</strong> Consumers may exercise the right to say no to the sale of their personal information.</li><li><strong>Right To Nondiscrimination –</strong> When consumers exercise rights enabled by the CCPA, organizations must not apply financial penalties, deny goods and services, or provide an unequal service as a result of their requests.</li></ul><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Applicability</title><p>CCPA is applicable to for profit organizations collecting personal information from California residents and determining what is done with the data. Additionally, one or more of the following must apply for organizations to be subject to CCPA:</p><ul><li>Annual gross revenue is greater than $25mil</li><li>Personal information from &gt;50k consumers, households, or devices</li><li>Derive greater than 50% of annual revenue generated from the sale of consumer’s personal information</li></ul><p>As with any regulation, the definition of personal information influences the impact on organizations need to comply. CCPA defines personal information as information that identifies, describes, or could be reasonably linked to a consumer or household (regulation section 1798.140(o)). Personal information includes the items listed below. The list is not definitive and can change at any time.</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Personal Information under CCPA</title><p>&nbsp;Personal Information</p><ul><li><strong>Identifiers:</strong> real name, social security number, driver’s license number, email address, postal address, IP address, account ID or online identifier.</li><li><strong>Commercial Information:</strong> personal property records, purchase history and patterns</li><li><strong>Biometric Information:</strong> DNA, fingerprint data, and iris scan data</li><li><strong>Electronic Activity:</strong> search history, browsing history, and cookie data</li><li><strong>Geolocation:</strong> GPS data</li><li><strong>Inferences/Profiling:</strong> behavior, personal preferences, psychological state</li></ul><p>Now that we’ve established what CCPA is and how it applies, the question becomes what do you have to do to prepare for compliance. Those organizations familiar with GDPR will notice these steps.</p><p>&nbsp;</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Key Considerations For CCPA Compliance</title><p>&nbsp;Key Considerations For CCPA Compliance</p><p>Assess Applicability – Identify the California residents, devices, and households targeted by the organization. Determine whether the organization must comply with the CCPA.</p><p>Perform Data and Processing Inventory – Understand what personal data collected and processed. Additionally, identify the third parties the data is sold to. This critical step will require significant effort if the data inventory and flows don’t exist. The effort is worth it because the output can be used for other privacy initiatives and improves the organization’s ability to protect the data.</p><p>Assess Policies – Include a description of consumer’s rights in the organization’s privacy policy.</p><p>Update Website – The CCPA requires all web sites to contain a link labeled “Do Not Sell My Information”. This link must be conspicuously placed on the web site home page and must enable the consumer to opt out of the sale of their personal information.</p><p>Support Consumer Rights – Make available two methods to allow consumers to submit requests: toll free number and form on website is acceptable. Additionally, implement processes to intake and satisfy requests in a timely manner (45 days from receipt of verifiable request). The process must include a preliminary assessment to verify the request before fulfillment.</p><p>Apply Technical Measures and Controls – Organizations must implement practices to understand the privacy impact as new software is introduced, scope of data collected changes, or processing of personal data changes. Furthermore, leadings practices must be established to protect personal data in the possession of the organization. Data Protection Impact Assessments (DPIAs) are used to assess privacy implications and establish appropriate security controls to manage risk. This is followed up with leading practices such as encryption to protect the personal data of California consumers. This is important to limit the organization and consumer exposure in the event of a breach or data leakage. Additionally, the CCPA allows the California Attorney General to impose significant penalties if breached or leaked data is unencrypted or not redacted. There are many additional considerations for data protection but we’ll stop here for now.</p><p>The CCPA is primarily focused on privacy but the impact is felt throughout many departments in the organization. Understanding what personal information you have, how it’s processed (including the sale of the data), and how it’s protected is on the critical path to establishing CCPA compliance. The first two items are needed to establish the right processes to support consumer rights. The latter item is needed to ensure personal data is handled responsibly – reasonable measures.</p><p>This post provides a basic understanding of the CCPA and what organizations must do to prepare for compliance. The regulation is comprehensive and requires a deeper dive to understand how it applies to your organization and the specific next steps needed to achieve compliance.</p><p>Additional CCPA information can be referenced on the State of California Department of Justice or the Californian’s Consumer Privacy website.</p><p>Before the draft of this post was completed the state of Nevada passed its own privacy law advancing the privacy rights of consumers. The regulation is more narrow than CCPA but will become effective on October 1, 2019. The message here is privacy laws will continue to be passed and organizations will be pressed to comply. Get ahead of the wave and develop a strong privacy framework that enables reasonable consumer/data subject/individual rights based on your business model, and enforce it by adopting privacy by design methods and effective security program to protect the organization’s data and technology assets.</p>','','full_html'),('featured_article',0,53,388,'en',0,'<div style=\"font-family:Arial, sans-serif;font-size:16px;white-space:pre-wrap;\">\r\n                                                                                    T\r\n                                                                                    he California Consumer Privacy Act (CCPA) is a new regulation on the horizon that organizations must understand and, if applicable, take action to comply. CCPA becomes effective January 1, 2020 and time is running out.\r\n                                                                                      \r\n</div><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Overview</title><p>Some have compared CCPA to General Data Protection Regulation (GDPR) and, in reality, there is some overlap but there are also several differences. Similar to GDPR, CCPA reinforces a key principle: privacy is a fundamental right and individuals must be able to control the collection and use of their personal data.</p><p>CCPA is focused on giving the consumer rights to know what personal information is collected, to whom it’s sold or disclosed to, and the ability to exercise rights without fearing discrimination. The regulation also imposes responsibility on organizations to process consumer requests, manage risk to consumer personal information, and respond to breaches in a timely manner. The CCPA holds organizations accountable by enforcing fines for violations when they haven’t taken proper steps to protect consumers’ personal information.</p><p>The core consumer rights granted by CCPA are described below. As with any regulation, caveats are in place to promote fairness to both the consumer and organizations collecting and processing their personal information. For example, the right to deletion is granted but there are nine exceptions in place that enable organizations to retain consumers personal information (regulation section 1798.105(d)).</p><p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Consumer Rights under CCPA</title></p><p>Consumer Rights</p><ul><li><strong>Right To Disclosure –</strong> Consumers have a right to know what personal information is collected and whether it’s sold or disclosed and to whom. The Right to disclosure also enables the consumer to receive a copy of their personal data in a standard format.</li><li><strong>Right To Deletion –</strong> Consumers may present a request to delete their personal information retained by the organization.</li><li><strong>Right To Opt-out –</strong> Consumers may exercise the right to say no to the sale of their personal information.</li><li><strong>Right To Nondiscrimination –</strong> When consumers exercise rights enabled by the CCPA, organizations must not apply financial penalties, deny goods and services, or provide an unequal service as a result of their requests.</li></ul><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Applicability</title><p>CCPA is applicable to for profit organizations collecting personal information from California residents and determining what is done with the data. Additionally, one or more of the following must apply for organizations to be subject to CCPA:</p><ul><li>Annual gross revenue is greater than $25mil</li><li>Personal information from &gt;50k consumers, households, or devices</li><li>Derive greater than 50% of annual revenue generated from the sale of consumer’s personal information</li></ul><p>As with any regulation, the definition of personal information influences the impact on organizations need to comply. CCPA defines personal information as information that identifies, describes, or could be reasonably linked to a consumer or household (regulation section 1798.140(o)). Personal information includes the items listed below. The list is not definitive and can change at any time.</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Personal Information under CCPA</title><p>&nbsp;Personal Information</p><ul><li><strong>Identifiers:</strong> real name, social security number, driver’s license number, email address, postal address, IP address, account ID or online identifier.</li><li><strong>Commercial Information:</strong> personal property records, purchase history and patterns</li><li><strong>Biometric Information:</strong> DNA, fingerprint data, and iris scan data</li><li><strong>Electronic Activity:</strong> search history, browsing history, and cookie data</li><li><strong>Geolocation:</strong> GPS data</li><li><strong>Inferences/Profiling:</strong> behavior, personal preferences, psychological state</li></ul><p>Now that we’ve established what CCPA is and how it applies, the question becomes what do you have to do to prepare for compliance. Those organizations familiar with GDPR will notice these steps.</p><p>&nbsp;</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Key Considerations For CCPA Compliance</title><p>&nbsp;Key Considerations For CCPA Compliance</p><p>Assess Applicability – Identify the California residents, devices, and households targeted by the organization. Determine whether the organization must comply with the CCPA.</p><p>Perform Data and Processing Inventory – Understand what personal data collected and processed. Additionally, identify the third parties the data is sold to. This critical step will require significant effort if the data inventory and flows don’t exist. The effort is worth it because the output can be used for other privacy initiatives and improves the organization’s ability to protect the data.</p><p>Assess Policies – Include a description of consumer’s rights in the organization’s privacy policy.</p><p>Update Website – The CCPA requires all web sites to contain a link labeled “Do Not Sell My Information”. This link must be conspicuously placed on the web site home page and must enable the consumer to opt out of the sale of their personal information.</p><p>Support Consumer Rights – Make available two methods to allow consumers to submit requests: toll free number and form on website is acceptable. Additionally, implement processes to intake and satisfy requests in a timely manner (45 days from receipt of verifiable request). The process must include a preliminary assessment to verify the request before fulfillment.</p><p>Apply Technical Measures and Controls – Organizations must implement practices to understand the privacy impact as new software is introduced, scope of data collected changes, or processing of personal data changes. Furthermore, leadings practices must be established to protect personal data in the possession of the organization. Data Protection Impact Assessments (DPIAs) are used to assess privacy implications and establish appropriate security controls to manage risk. This is followed up with leading practices such as encryption to protect the personal data of California consumers. This is important to limit the organization and consumer exposure in the event of a breach or data leakage. Additionally, the CCPA allows the California Attorney General to impose significant penalties if breached or leaked data is unencrypted or not redacted. There are many additional considerations for data protection but we’ll stop here for now.</p><p>The CCPA is primarily focused on privacy but the impact is felt throughout many departments in the organization. Understanding what personal information you have, how it’s processed (including the sale of the data), and how it’s protected is on the critical path to establishing CCPA compliance. The first two items are needed to establish the right processes to support consumer rights. The latter item is needed to ensure personal data is handled responsibly – reasonable measures.</p><p>This post provides a basic understanding of the CCPA and what organizations must do to prepare for compliance. The regulation is comprehensive and requires a deeper dive to understand how it applies to your organization and the specific next steps needed to achieve compliance.</p><p>Additional CCPA information can be referenced on the State of California Department of Justice or the Californian’s Consumer Privacy website.</p><p>Before the draft of this post was completed the state of Nevada passed its own privacy law advancing the privacy rights of consumers. The regulation is more narrow than CCPA but will become effective on October 1, 2019. The message here is privacy laws will continue to be passed and organizations will be pressed to comply. Get ahead of the wave and develop a strong privacy framework that enables reasonable consumer/data subject/individual rights based on your business model, and enforce it by adopting privacy by design methods and effective security program to protect the organization’s data and technology assets.</p>','','full_html'),('featured_article',0,53,454,'en',0,'<div style=\"font-family:Arial, sans-serif;font-size:16px;white-space:pre-wrap;\">\r\n                                                                                    T\r\n                                                                                    he California Consumer Privacy Act (CCPA) is a new regulation on the horizon that organizations must understand and, if applicable, take action to comply. CCPA becomes effective January 1, 2020 and time is running out.\r\n                                                                                      \r\n</div><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Overview</title><p>Some have compared CCPA to General Data Protection Regulation (GDPR) and, in reality, there is some overlap but there are also several differences. Similar to GDPR, CCPA reinforces a key principle: privacy is a fundamental right and individuals must be able to control the collection and use of their personal data.</p><p>CCPA is focused on giving the consumer rights to know what personal information is collected, to whom it’s sold or disclosed to, and the ability to exercise rights without fearing discrimination. The regulation also imposes responsibility on organizations to process consumer requests, manage risk to consumer personal information, and respond to breaches in a timely manner. The CCPA holds organizations accountable by enforcing fines for violations when they haven’t taken proper steps to protect consumers’ personal information.</p><p>The core consumer rights granted by CCPA are described below. As with any regulation, caveats are in place to promote fairness to both the consumer and organizations collecting and processing their personal information. For example, the right to deletion is granted but there are nine exceptions in place that enable organizations to retain consumers personal information (regulation section 1798.105(d)).</p><p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Consumer Rights under CCPA</title></p><p>Consumer Rights</p><ul><li><strong>Right To Disclosure –</strong> Consumers have a right to know what personal information is collected and whether it’s sold or disclosed and to whom. The Right to disclosure also enables the consumer to receive a copy of their personal data in a standard format.</li><li><strong>Right To Deletion –</strong> Consumers may present a request to delete their personal information retained by the organization.</li><li><strong>Right To Opt-out –</strong> Consumers may exercise the right to say no to the sale of their personal information.</li><li><strong>Right To Nondiscrimination –</strong> When consumers exercise rights enabled by the CCPA, organizations must not apply financial penalties, deny goods and services, or provide an unequal service as a result of their requests.</li></ul><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Applicability</title><p>CCPA is applicable to for profit organizations collecting personal information from California residents and determining what is done with the data. Additionally, one or more of the following must apply for organizations to be subject to CCPA:</p><ul><li>Annual gross revenue is greater than $25mil</li><li>Personal information from &gt;50k consumers, households, or devices</li><li>Derive greater than 50% of annual revenue generated from the sale of consumer’s personal information</li></ul><p>As with any regulation, the definition of personal information influences the impact on organizations need to comply. CCPA defines personal information as information that identifies, describes, or could be reasonably linked to a consumer or household (regulation section 1798.140(o)). Personal information includes the items listed below. The list is not definitive and can change at any time.</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Personal Information under CCPA</title><p>&nbsp;Personal Information</p><ul><li><strong>Identifiers:</strong> real name, social security number, driver’s license number, email address, postal address, IP address, account ID or online identifier.</li><li><strong>Commercial Information:</strong> personal property records, purchase history and patterns</li><li><strong>Biometric Information:</strong> DNA, fingerprint data, and iris scan data</li><li><strong>Electronic Activity:</strong> search history, browsing history, and cookie data</li><li><strong>Geolocation:</strong> GPS data</li><li><strong>Inferences/Profiling:</strong> behavior, personal preferences, psychological state</li></ul><p>Now that we’ve established what CCPA is and how it applies, the question becomes what do you have to do to prepare for compliance. Those organizations familiar with GDPR will notice these steps.</p><p>&nbsp;</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Key Considerations For CCPA Compliance</title><p>&nbsp;Key Considerations For CCPA Compliance</p><p>Assess Applicability – Identify the California residents, devices, and households targeted by the organization. Determine whether the organization must comply with the CCPA.</p><p>Perform Data and Processing Inventory – Understand what personal data collected and processed. Additionally, identify the third parties the data is sold to. This critical step will require significant effort if the data inventory and flows don’t exist. The effort is worth it because the output can be used for other privacy initiatives and improves the organization’s ability to protect the data.</p><p>Assess Policies – Include a description of consumer’s rights in the organization’s privacy policy.</p><p>Update Website – The CCPA requires all web sites to contain a link labeled “Do Not Sell My Information”. This link must be conspicuously placed on the web site home page and must enable the consumer to opt out of the sale of their personal information.</p><p>Support Consumer Rights – Make available two methods to allow consumers to submit requests: toll free number and form on website is acceptable. Additionally, implement processes to intake and satisfy requests in a timely manner (45 days from receipt of verifiable request). The process must include a preliminary assessment to verify the request before fulfillment.</p><p>Apply Technical Measures and Controls – Organizations must implement practices to understand the privacy impact as new software is introduced, scope of data collected changes, or processing of personal data changes. Furthermore, leadings practices must be established to protect personal data in the possession of the organization. Data Protection Impact Assessments (DPIAs) are used to assess privacy implications and establish appropriate security controls to manage risk. This is followed up with leading practices such as encryption to protect the personal data of California consumers. This is important to limit the organization and consumer exposure in the event of a breach or data leakage. Additionally, the CCPA allows the California Attorney General to impose significant penalties if breached or leaked data is unencrypted or not redacted. There are many additional considerations for data protection but we’ll stop here for now.</p><p>The CCPA is primarily focused on privacy but the impact is felt throughout many departments in the organization. Understanding what personal information you have, how it’s processed (including the sale of the data), and how it’s protected is on the critical path to establishing CCPA compliance. The first two items are needed to establish the right processes to support consumer rights. The latter item is needed to ensure personal data is handled responsibly – reasonable measures.</p><p>This post provides a basic understanding of the CCPA and what organizations must do to prepare for compliance. The regulation is comprehensive and requires a deeper dive to understand how it applies to your organization and the specific next steps needed to achieve compliance.</p><p>Additional CCPA information can be referenced on the State of California Department of Justice or the Californian’s Consumer Privacy website.</p><p>Before the draft of this post was completed the state of Nevada passed its own privacy law advancing the privacy rights of consumers. The regulation is more narrow than CCPA but will become effective on October 1, 2019. The message here is privacy laws will continue to be passed and organizations will be pressed to comply. Get ahead of the wave and develop a strong privacy framework that enables reasonable consumer/data subject/individual rights based on your business model, and enforce it by adopting privacy by design methods and effective security program to protect the organization’s data and technology assets.</p>','','full_html'),('featured_article',0,53,521,'en',0,'<div style=\"font-family:Arial, sans-serif;font-size:16px;white-space:pre-wrap;\">\r\n                                                                                    T\r\n                                                                                    he California Consumer Privacy Act (CCPA) is a new regulation on the horizon that organizations must understand and, if applicable, take action to comply. CCPA becomes effective January 1, 2020 and time is running out.\r\n                                                                                      \r\n</div><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Overview</title><p>Some have compared CCPA to General Data Protection Regulation (GDPR) and, in reality, there is some overlap but there are also several differences. Similar to GDPR, CCPA reinforces a key principle: privacy is a fundamental right and individuals must be able to control the collection and use of their personal data.</p><p>CCPA is focused on giving the consumer rights to know what personal information is collected, to whom it’s sold or disclosed to, and the ability to exercise rights without fearing discrimination. The regulation also imposes responsibility on organizations to process consumer requests, manage risk to consumer personal information, and respond to breaches in a timely manner. The CCPA holds organizations accountable by enforcing fines for violations when they haven’t taken proper steps to protect consumers’ personal information.</p><p>The core consumer rights granted by CCPA are described below. As with any regulation, caveats are in place to promote fairness to both the consumer and organizations collecting and processing their personal information. For example, the right to deletion is granted but there are nine exceptions in place that enable organizations to retain consumers personal information (regulation section 1798.105(d)).</p><p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Consumer Rights under CCPA</title></p><p>Consumer Rights</p><ul><li><strong>Right To Disclosure –</strong> Consumers have a right to know what personal information is collected and whether it’s sold or disclosed and to whom. The Right to disclosure also enables the consumer to receive a copy of their personal data in a standard format.</li><li><strong>Right To Deletion –</strong> Consumers may present a request to delete their personal information retained by the organization.</li><li><strong>Right To Opt-out –</strong> Consumers may exercise the right to say no to the sale of their personal information.</li><li><strong>Right To Nondiscrimination –</strong> When consumers exercise rights enabled by the CCPA, organizations must not apply financial penalties, deny goods and services, or provide an unequal service as a result of their requests.</li></ul><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Applicability</title><p>CCPA is applicable to for profit organizations collecting personal information from California residents and determining what is done with the data. Additionally, one or more of the following must apply for organizations to be subject to CCPA:</p><ul><li>Annual gross revenue is greater than $25mil</li><li>Personal information from &gt;50k consumers, households, or devices</li><li>Derive greater than 50% of annual revenue generated from the sale of consumer’s personal information</li></ul><p>As with any regulation, the definition of personal information influences the impact on organizations need to comply. CCPA defines personal information as information that identifies, describes, or could be reasonably linked to a consumer or household (regulation section 1798.140(o)). Personal information includes the items listed below. The list is not definitive and can change at any time.</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Personal Information under CCPA</title><p>&nbsp;Personal Information</p><ul><li><strong>Identifiers:</strong> real name, social security number, driver’s license number, email address, postal address, IP address, account ID or online identifier.</li><li><strong>Commercial Information:</strong> personal property records, purchase history and patterns</li><li><strong>Biometric Information:</strong> DNA, fingerprint data, and iris scan data</li><li><strong>Electronic Activity:</strong> search history, browsing history, and cookie data</li><li><strong>Geolocation:</strong> GPS data</li><li><strong>Inferences/Profiling:</strong> behavior, personal preferences, psychological state</li></ul><p>Now that we’ve established what CCPA is and how it applies, the question becomes what do you have to do to prepare for compliance. Those organizations familiar with GDPR will notice these steps.</p><p>&nbsp;</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Key Considerations For CCPA Compliance</title><p>&nbsp;Key Considerations For CCPA Compliance</p><p>Assess Applicability – Identify the California residents, devices, and households targeted by the organization. Determine whether the organization must comply with the CCPA.</p><p>Perform Data and Processing Inventory – Understand what personal data collected and processed. Additionally, identify the third parties the data is sold to. This critical step will require significant effort if the data inventory and flows don’t exist. The effort is worth it because the output can be used for other privacy initiatives and improves the organization’s ability to protect the data.</p><p>Assess Policies – Include a description of consumer’s rights in the organization’s privacy policy.</p><p>Update Website – The CCPA requires all web sites to contain a link labeled “Do Not Sell My Information”. This link must be conspicuously placed on the web site home page and must enable the consumer to opt out of the sale of their personal information.</p><p>Support Consumer Rights – Make available two methods to allow consumers to submit requests: toll free number and form on website is acceptable. Additionally, implement processes to intake and satisfy requests in a timely manner (45 days from receipt of verifiable request). The process must include a preliminary assessment to verify the request before fulfillment.</p><p>Apply Technical Measures and Controls – Organizations must implement practices to understand the privacy impact as new software is introduced, scope of data collected changes, or processing of personal data changes. Furthermore, leadings practices must be established to protect personal data in the possession of the organization. Data Protection Impact Assessments (DPIAs) are used to assess privacy implications and establish appropriate security controls to manage risk. This is followed up with leading practices such as encryption to protect the personal data of California consumers. This is important to limit the organization and consumer exposure in the event of a breach or data leakage. Additionally, the CCPA allows the California Attorney General to impose significant penalties if breached or leaked data is unencrypted or not redacted. There are many additional considerations for data protection but we’ll stop here for now.</p><p>The CCPA is primarily focused on privacy but the impact is felt throughout many departments in the organization. Understanding what personal information you have, how it’s processed (including the sale of the data), and how it’s protected is on the critical path to establishing CCPA compliance. The first two items are needed to establish the right processes to support consumer rights. The latter item is needed to ensure personal data is handled responsibly – reasonable measures.</p><p>This post provides a basic understanding of the CCPA and what organizations must do to prepare for compliance. The regulation is comprehensive and requires a deeper dive to understand how it applies to your organization and the specific next steps needed to achieve compliance.</p><p>Additional CCPA information can be referenced on the State of California Department of Justice or the Californian’s Consumer Privacy website.</p><p>Before the draft of this post was completed the state of Nevada passed its own privacy law advancing the privacy rights of consumers. The regulation is more narrow than CCPA but will become effective on October 1, 2019. The message here is privacy laws will continue to be passed and organizations will be pressed to comply. Get ahead of the wave and develop a strong privacy framework that enables reasonable consumer/data subject/individual rights based on your business model, and enforce it by adopting privacy by design methods and effective security program to protect the organization’s data and technology assets.</p>','','full_html'),('featured_article',0,53,537,'en',0,'<div style=\"font-family:Arial, sans-serif;font-size:16px;white-space:pre-wrap;\">\r\n                                                                                    T\r\n                                                                                    he California Consumer Privacy Act (CCPA) is a new regulation on the horizon that organizations must understand and, if applicable, take action to comply. CCPA becomes effective January 1, 2020 and time is running out.\r\n                                                                                      \r\n</div><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Overview</title><p>Some have compared CCPA to General Data Protection Regulation (GDPR) and, in reality, there is some overlap but there are also several differences. Similar to GDPR, CCPA reinforces a key principle: privacy is a fundamental right and individuals must be able to control the collection and use of their personal data.</p><p>CCPA is focused on giving the consumer rights to know what personal information is collected, to whom it’s sold or disclosed to, and the ability to exercise rights without fearing discrimination. The regulation also imposes responsibility on organizations to process consumer requests, manage risk to consumer personal information, and respond to breaches in a timely manner. The CCPA holds organizations accountable by enforcing fines for violations when they haven’t taken proper steps to protect consumers’ personal information.</p><p>The core consumer rights granted by CCPA are described below. As with any regulation, caveats are in place to promote fairness to both the consumer and organizations collecting and processing their personal information. For example, the right to deletion is granted but there are nine exceptions in place that enable organizations to retain consumers personal information (regulation section 1798.105(d)).</p><p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Consumer Rights under CCPA</title></p><p>Consumer Rights</p><ul><li><strong>Right To Disclosure –</strong> Consumers have a right to know what personal information is collected and whether it’s sold or disclosed and to whom. The Right to disclosure also enables the consumer to receive a copy of their personal data in a standard format.</li><li><strong>Right To Deletion –</strong> Consumers may present a request to delete their personal information retained by the organization.</li><li><strong>Right To Opt-out –</strong> Consumers may exercise the right to say no to the sale of their personal information.</li><li><strong>Right To Nondiscrimination –</strong> When consumers exercise rights enabled by the CCPA, organizations must not apply financial penalties, deny goods and services, or provide an unequal service as a result of their requests.</li></ul><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Applicability</title><p>CCPA is applicable to for profit organizations collecting personal information from California residents and determining what is done with the data. Additionally, one or more of the following must apply for organizations to be subject to CCPA:</p><ul><li>Annual gross revenue is greater than $25mil</li><li>Personal information from &gt;50k consumers, households, or devices</li><li>Derive greater than 50% of annual revenue generated from the sale of consumer’s personal information</li></ul><p>As with any regulation, the definition of personal information influences the impact on organizations need to comply. CCPA defines personal information as information that identifies, describes, or could be reasonably linked to a consumer or household (regulation section 1798.140(o)). Personal information includes the items listed below. The list is not definitive and can change at any time.</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Personal Information under CCPA</title><p>&nbsp;Personal Information</p><ul><li><strong>Identifiers:</strong> real name, social security number, driver’s license number, email address, postal address, IP address, account ID or online identifier.</li><li><strong>Commercial Information:</strong> personal property records, purchase history and patterns</li><li><strong>Biometric Information:</strong> DNA, fingerprint data, and iris scan data</li><li><strong>Electronic Activity:</strong> search history, browsing history, and cookie data</li><li><strong>Geolocation:</strong> GPS data</li><li><strong>Inferences/Profiling:</strong> behavior, personal preferences, psychological state</li></ul><p>Now that we’ve established what CCPA is and how it applies, the question becomes what do you have to do to prepare for compliance. Those organizations familiar with GDPR will notice these steps.</p><p>&nbsp;</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Key Considerations For CCPA Compliance</title><p>&nbsp;Key Considerations For CCPA Compliance</p><p>Assess Applicability – Identify the California residents, devices, and households targeted by the organization. Determine whether the organization must comply with the CCPA.</p><p>Perform Data and Processing Inventory – Understand what personal data collected and processed. Additionally, identify the third parties the data is sold to. This critical step will require significant effort if the data inventory and flows don’t exist. The effort is worth it because the output can be used for other privacy initiatives and improves the organization’s ability to protect the data.</p><p>Assess Policies – Include a description of consumer’s rights in the organization’s privacy policy.</p><p>Update Website – The CCPA requires all web sites to contain a link labeled “Do Not Sell My Information”. This link must be conspicuously placed on the web site home page and must enable the consumer to opt out of the sale of their personal information.</p><p>Support Consumer Rights – Make available two methods to allow consumers to submit requests: toll free number and form on website is acceptable. Additionally, implement processes to intake and satisfy requests in a timely manner (45 days from receipt of verifiable request). The process must include a preliminary assessment to verify the request before fulfillment.</p><p>Apply Technical Measures and Controls – Organizations must implement practices to understand the privacy impact as new software is introduced, scope of data collected changes, or processing of personal data changes. Furthermore, leadings practices must be established to protect personal data in the possession of the organization. Data Protection Impact Assessments (DPIAs) are used to assess privacy implications and establish appropriate security controls to manage risk. This is followed up with leading practices such as encryption to protect the personal data of California consumers. This is important to limit the organization and consumer exposure in the event of a breach or data leakage. Additionally, the CCPA allows the California Attorney General to impose significant penalties if breached or leaked data is unencrypted or not redacted. There are many additional considerations for data protection but we’ll stop here for now.</p><p>The CCPA is primarily focused on privacy but the impact is felt throughout many departments in the organization. Understanding what personal information you have, how it’s processed (including the sale of the data), and how it’s protected is on the critical path to establishing CCPA compliance. The first two items are needed to establish the right processes to support consumer rights. The latter item is needed to ensure personal data is handled responsibly – reasonable measures.</p><p>This post provides a basic understanding of the CCPA and what organizations must do to prepare for compliance. The regulation is comprehensive and requires a deeper dive to understand how it applies to your organization and the specific next steps needed to achieve compliance.</p><p>Additional CCPA information can be referenced on the State of California Department of Justice or the Californian’s Consumer Privacy website.</p><p>Before the draft of this post was completed the state of Nevada passed its own privacy law advancing the privacy rights of consumers. The regulation is more narrow than CCPA but will become effective on October 1, 2019. The message here is privacy laws will continue to be passed and organizations will be pressed to comply. Get ahead of the wave and develop a strong privacy framework that enables reasonable consumer/data subject/individual rights based on your business model, and enforce it by adopting privacy by design methods and effective security program to protect the organization’s data and technology assets.</p>','','full_html'),('featured_article',0,53,612,'en',0,'<div style=\"font-family:Arial, sans-serif;font-size:16px;white-space:pre-wrap;\">\r\n                                                                                    T\r\n                                                                                    he California Consumer Privacy Act (CCPA) is a new regulation on the horizon that organizations must understand and, if applicable, take action to comply. CCPA becomes effective January 1, 2020 and time is running out.\r\n                                                                                      \r\n</div><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Overview</title><p>Some have compared CCPA to General Data Protection Regulation (GDPR) and, in reality, there is some overlap but there are also several differences. Similar to GDPR, CCPA reinforces a key principle: privacy is a fundamental right and individuals must be able to control the collection and use of their personal data.</p><p>CCPA is focused on giving the consumer rights to know what personal information is collected, to whom it’s sold or disclosed to, and the ability to exercise rights without fearing discrimination. The regulation also imposes responsibility on organizations to process consumer requests, manage risk to consumer personal information, and respond to breaches in a timely manner. The CCPA holds organizations accountable by enforcing fines for violations when they haven’t taken proper steps to protect consumers’ personal information.</p><p>The core consumer rights granted by CCPA are described below. As with any regulation, caveats are in place to promote fairness to both the consumer and organizations collecting and processing their personal information. For example, the right to deletion is granted but there are nine exceptions in place that enable organizations to retain consumers personal information (regulation section 1798.105(d)).</p><p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Consumer Rights under CCPA</title></p><p>Consumer Rights</p><ul><li><strong>Right To Disclosure –</strong> Consumers have a right to know what personal information is collected and whether it’s sold or disclosed and to whom. The Right to disclosure also enables the consumer to receive a copy of their personal data in a standard format.</li><li><strong>Right To Deletion –</strong> Consumers may present a request to delete their personal information retained by the organization.</li><li><strong>Right To Opt-out –</strong> Consumers may exercise the right to say no to the sale of their personal information.</li><li><strong>Right To Nondiscrimination –</strong> When consumers exercise rights enabled by the CCPA, organizations must not apply financial penalties, deny goods and services, or provide an unequal service as a result of their requests.</li></ul><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>CCPA Applicability</title><p>CCPA is applicable to for profit organizations collecting personal information from California residents and determining what is done with the data. Additionally, one or more of the following must apply for organizations to be subject to CCPA:</p><ul><li>Annual gross revenue is greater than $25mil</li><li>Personal information from &gt;50k consumers, households, or devices</li><li>Derive greater than 50% of annual revenue generated from the sale of consumer’s personal information</li></ul><p>As with any regulation, the definition of personal information influences the impact on organizations need to comply. CCPA defines personal information as information that identifies, describes, or could be reasonably linked to a consumer or household (regulation section 1798.140(o)). Personal information includes the items listed below. The list is not definitive and can change at any time.</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Personal Information under CCPA</title><p>&nbsp;Personal Information</p><ul><li><strong>Identifiers:</strong> real name, social security number, driver’s license number, email address, postal address, IP address, account ID or online identifier.</li><li><strong>Commercial Information:</strong> personal property records, purchase history and patterns</li><li><strong>Biometric Information:</strong> DNA, fingerprint data, and iris scan data</li><li><strong>Electronic Activity:</strong> search history, browsing history, and cookie data</li><li><strong>Geolocation:</strong> GPS data</li><li><strong>Inferences/Profiling:</strong> behavior, personal preferences, psychological state</li></ul><p>Now that we’ve established what CCPA is and how it applies, the question becomes what do you have to do to prepare for compliance. Those organizations familiar with GDPR will notice these steps.</p><p>&nbsp;</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Key Considerations For CCPA Compliance</title><p>&nbsp;Key Considerations For CCPA Compliance</p><p>Assess Applicability – Identify the California residents, devices, and households targeted by the organization. Determine whether the organization must comply with the CCPA.</p><p>Perform Data and Processing Inventory – Understand what personal data collected and processed. Additionally, identify the third parties the data is sold to. This critical step will require significant effort if the data inventory and flows don’t exist. The effort is worth it because the output can be used for other privacy initiatives and improves the organization’s ability to protect the data.</p><p>Assess Policies – Include a description of consumer’s rights in the organization’s privacy policy.</p><p>Update Website – The CCPA requires all web sites to contain a link labeled “Do Not Sell My Information”. This link must be conspicuously placed on the web site home page and must enable the consumer to opt out of the sale of their personal information.</p><p>Support Consumer Rights – Make available two methods to allow consumers to submit requests: toll free number and form on website is acceptable. Additionally, implement processes to intake and satisfy requests in a timely manner (45 days from receipt of verifiable request). The process must include a preliminary assessment to verify the request before fulfillment.</p><p>Apply Technical Measures and Controls – Organizations must implement practices to understand the privacy impact as new software is introduced, scope of data collected changes, or processing of personal data changes. Furthermore, leadings practices must be established to protect personal data in the possession of the organization. Data Protection Impact Assessments (DPIAs) are used to assess privacy implications and establish appropriate security controls to manage risk. This is followed up with leading practices such as encryption to protect the personal data of California consumers. This is important to limit the organization and consumer exposure in the event of a breach or data leakage. Additionally, the CCPA allows the California Attorney General to impose significant penalties if breached or leaked data is unencrypted or not redacted. There are many additional considerations for data protection but we’ll stop here for now.</p><p>The CCPA is primarily focused on privacy but the impact is felt throughout many departments in the organization. Understanding what personal information you have, how it’s processed (including the sale of the data), and how it’s protected is on the critical path to establishing CCPA compliance. The first two items are needed to establish the right processes to support consumer rights. The latter item is needed to ensure personal data is handled responsibly – reasonable measures.</p><p>This post provides a basic understanding of the CCPA and what organizations must do to prepare for compliance. The regulation is comprehensive and requires a deeper dive to understand how it applies to your organization and the specific next steps needed to achieve compliance.</p><p>Additional CCPA information can be referenced on the State of California Department of Justice or the Californian’s Consumer Privacy website.</p><p>Before the draft of this post was completed the state of Nevada passed its own privacy law advancing the privacy rights of consumers. The regulation is more narrow than CCPA but will become effective on October 1, 2019. The message here is privacy laws will continue to be passed and organizations will be pressed to comply. Get ahead of the wave and develop a strong privacy framework that enables reasonable consumer/data subject/individual rights based on your business model, and enforce it by adopting privacy by design methods and effective security program to protect the organization’s data and technology assets.</p>','','full_html'),('client_success',0,54,101,'en',0,'<p>DivIHN\'s solution fostered innovation in addition to objectively quantifying project priorities. This helped the CISO improve Service Levels while managing expectations of user/business communities.</p>','','full_html'),('client_success',0,54,680,'en',0,'<p>DivIHN\'s solution fostered innovation in addition to objectively quantifying project priorities. This helped the CISO improve Service Levels while managing expectations of user/business communities.</p>','','full_html'),('featured_article',0,55,102,'en',0,'<p>O pen Source Software (OSS) is freely distributed code and/or binaries that can be used, modified, and redistributed in accordance with its licensing terms.</p><p>The use of open source in the development process is pervasive and will continue to grow over time. Results from the Synopsys 2020 Open Source Security &amp; Risk Analysis Report demonstrates the dependency on open source.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Managing-Risk-in-Open-Source.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"Download PDF button\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,55,135,'en',0,'<p>O pen Source Software (OSS) is freely distributed code and/or binaries that can be used, modified, and redistributed in accordance with its licensing terms.</p><p>The use of open source in the development process is pervasive and will continue to grow over time. Results from the Synopsys 2020 Open Source Security &amp; Risk Analysis Report demonstrates the dependency on open source.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Managing-Risk-in-Open-Source.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"Download PDF button\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,55,266,'en',0,'<p>O pen Source Software (OSS) is freely distributed code and/or binaries that can be used, modified, and redistributed in accordance with its licensing terms.</p><p>The use of open source in the development process is pervasive and will continue to grow over time. Results from the Synopsys 2020 Open Source Security &amp; Risk Analysis Report demonstrates the dependency on open source.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Managing-Risk-in-Open-Source.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"Download PDF button\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,55,389,'en',0,'<p>O pen Source Software (OSS) is freely distributed code and/or binaries that can be used, modified, and redistributed in accordance with its licensing terms.</p><p>The use of open source in the development process is pervasive and will continue to grow over time. Results from the Synopsys 2020 Open Source Security &amp; Risk Analysis Report demonstrates the dependency on open source.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Managing-Risk-in-Open-Source.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"Download PDF button\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,55,455,'en',0,'<p>O pen Source Software (OSS) is freely distributed code and/or binaries that can be used, modified, and redistributed in accordance with its licensing terms.</p><p>The use of open source in the development process is pervasive and will continue to grow over time. Results from the Synopsys 2020 Open Source Security &amp; Risk Analysis Report demonstrates the dependency on open source.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Managing-Risk-in-Open-Source.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"Download PDF button\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,55,522,'en',0,'<p>O pen Source Software (OSS) is freely distributed code and/or binaries that can be used, modified, and redistributed in accordance with its licensing terms.</p><p>The use of open source in the development process is pervasive and will continue to grow over time. Results from the Synopsys 2020 Open Source Security &amp; Risk Analysis Report demonstrates the dependency on open source.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Managing-Risk-in-Open-Source.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"Download PDF button\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,55,538,'en',0,'<p>O pen Source Software (OSS) is freely distributed code and/or binaries that can be used, modified, and redistributed in accordance with its licensing terms.</p><p>The use of open source in the development process is pervasive and will continue to grow over time. Results from the Synopsys 2020 Open Source Security &amp; Risk Analysis Report demonstrates the dependency on open source.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Managing-Risk-in-Open-Source.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"Download PDF button\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,55,613,'en',0,'<p>O pen Source Software (OSS) is freely distributed code and/or binaries that can be used, modified, and redistributed in accordance with its licensing terms.</p><p>The use of open source in the development process is pervasive and will continue to grow over time. Results from the Synopsys 2020 Open Source Security &amp; Risk Analysis Report demonstrates the dependency on open source.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Managing-Risk-in-Open-Source.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"Download PDF button\" width=\"236\" height=\"63\"></a></p>','','full_html'),('client_success',0,56,103,'en',0,'<p>Our customer is a large County Government on the west coast of USA. The Cybersecurity Architecture work was carried out in the context of the overall review of the Technology Assets of the county.</p>','','full_html'),('client_success',0,56,681,'en',0,'<p>Our customer is a large County Government on the west coast of USA. The Cybersecurity Architecture work was carried out in the context of the overall review of the Technology Assets of the county.</p>','','full_html'),('featured_article',0,57,104,'en',0,'<p>R ansomware continues to be a real threat to business operations across all industries, no organization is safe from this threat.</p><p>The combination of widely available exploit kits on the dark web, limited resources and skills needed to execute attacks, and potential financial gain makes ransomware attractive to bad actors.</p><p>The intent of this guidance is to provide insight into the ransomware threat and the actions that should be taken to reduce it.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Ransomware-Threat-Management.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,57,133,'en',0,'<p>R ansomware continues to be a real threat to business operations across all industries, no organization is safe from this threat.</p><p>The combination of widely available exploit kits on the dark web, limited resources and skills needed to execute attacks, and potential financial gain makes ransomware attractive to bad actors.</p><p>The intent of this guidance is to provide insight into the ransomware threat and the actions that should be taken to reduce it.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Ransomware-Threat-Management.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,57,134,'en',0,'<p>R ansomware continues to be a real threat to business operations across all industries, no organization is safe from this threat.</p><p>The combination of widely available exploit kits on the dark web, limited resources and skills needed to execute attacks, and potential financial gain makes ransomware attractive to bad actors.</p><p>The intent of this guidance is to provide insight into the ransomware threat and the actions that should be taken to reduce it.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Ransomware-Threat-Management.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,57,267,'en',0,'<p>R ansomware continues to be a real threat to business operations across all industries, no organization is safe from this threat.</p><p>The combination of widely available exploit kits on the dark web, limited resources and skills needed to execute attacks, and potential financial gain makes ransomware attractive to bad actors.</p><p>The intent of this guidance is to provide insight into the ransomware threat and the actions that should be taken to reduce it.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Ransomware-Threat-Management.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,57,390,'en',0,'<p>R ansomware continues to be a real threat to business operations across all industries, no organization is safe from this threat.</p><p>The combination of widely available exploit kits on the dark web, limited resources and skills needed to execute attacks, and potential financial gain makes ransomware attractive to bad actors.</p><p>The intent of this guidance is to provide insight into the ransomware threat and the actions that should be taken to reduce it.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Ransomware-Threat-Management.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,57,393,'en',0,'<p>R ansomware continues to be a real threat to business operations across all industries, no organization is safe from this threat.</p><p>The combination of widely available exploit kits on the dark web, limited resources and skills needed to execute attacks, and potential financial gain makes ransomware attractive to bad actors.</p><p>The intent of this guidance is to provide insight into the ransomware threat and the actions that should be taken to reduce it.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Ransomware-Threat-Management.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,57,456,'en',0,'<p>R ansomware continues to be a real threat to business operations across all industries, no organization is safe from this threat.</p><p>The combination of widely available exploit kits on the dark web, limited resources and skills needed to execute attacks, and potential financial gain makes ransomware attractive to bad actors.</p><p>The intent of this guidance is to provide insight into the ransomware threat and the actions that should be taken to reduce it.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Ransomware-Threat-Management.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,57,523,'en',0,'<p>R ansomware continues to be a real threat to business operations across all industries, no organization is safe from this threat.</p><p>The combination of widely available exploit kits on the dark web, limited resources and skills needed to execute attacks, and potential financial gain makes ransomware attractive to bad actors.</p><p>The intent of this guidance is to provide insight into the ransomware threat and the actions that should be taken to reduce it.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Ransomware-Threat-Management.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,57,539,'en',0,'<p>R ansomware continues to be a real threat to business operations across all industries, no organization is safe from this threat.</p><p>The combination of widely available exploit kits on the dark web, limited resources and skills needed to execute attacks, and potential financial gain makes ransomware attractive to bad actors.</p><p>The intent of this guidance is to provide insight into the ransomware threat and the actions that should be taken to reduce it.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Ransomware-Threat-Management.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,57,601,'en',0,'<p>R ansomware continues to be a real threat to business operations across all industries, no organization is safe from this threat.</p><p>The combination of widely available exploit kits on the dark web, limited resources and skills needed to execute attacks, and potential financial gain makes ransomware attractive to bad actors.</p><p>The intent of this guidance is to provide insight into the ransomware threat and the actions that should be taken to reduce it.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Ransomware-Threat-Management.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"\" width=\"236\" height=\"63\"></a></p>','','full_html'),('featured_article',0,57,614,'en',0,'<p>R ansomware continues to be a real threat to business operations across all industries, no organization is safe from this threat.</p><p>The combination of widely available exploit kits on the dark web, limited resources and skills needed to execute attacks, and potential financial gain makes ransomware attractive to bad actors.</p><p>The intent of this guidance is to provide insight into the ransomware threat and the actions that should be taken to reduce it.</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p><a href=\"https://cms.divihn.com/sites/default/files/2024-03/Ransomware-Threat-Management.pdf\" target=\"_self\"><img src=\"https://cms.divihn.com/sites/default/files/2024-03/Download-PDF-Button-James-Alexander-Michie-1.png\" alt=\"\" width=\"236\" height=\"63\"></a></p>','','full_html'),('webinar',0,60,111,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p><strong>Meet the speakers</strong></p>','','full_html'),('webinar',0,60,114,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p><strong>Meet the speakers</strong></p>','','full_html'),('webinar',0,60,115,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p><strong>Meet the speakers</strong></p>','','full_html'),('webinar',0,60,116,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p><strong>Meet the speakers</strong></p>','','full_html'),('webinar',0,60,117,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p><strong>Meet the speakers</strong></p>','','full_html'),('webinar',0,60,118,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p>&nbsp;</p>','','full_html'),('webinar',0,60,119,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p>&nbsp;</p>','','full_html'),('webinar',0,60,123,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p>&nbsp;</p>','','full_html'),('webinar',0,60,146,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p>&nbsp;</p>','','full_html'),('webinar',0,60,264,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p>&nbsp;</p>','','full_html'),('webinar',0,60,461,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p>&nbsp;</p>','','full_html'),('webinar',0,60,462,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p>&nbsp;</p>','','full_html'),('webinar',0,60,528,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p>&nbsp;</p>','','full_html'),('webinar',0,60,529,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p>&nbsp;</p>','','full_html'),('webinar',0,60,543,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p>&nbsp;</p>','','full_html'),('webinar',0,60,618,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul><p>&nbsp;</p>','','full_html'),('featured_article',0,61,120,'en',0,'<p>C ybersecurity can be a complex and overwhelming discipline.</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>Cybersecurity Rationalization</title><style>\r\n    body { font-family: Arial, sans-serif; line-height: 1.6; padding: 2rem; background-color: #f9f9f9; color: #111; }\r\n    .container { max-width: 800px; margin: 0 auto; background: #fff; padding: 1.5rem 2rem; border-radius: 8px; box-shadow: 0 2px 6px rgba(0,0,0,0.08); }\r\n    p { margin-bottom: 1rem; }\r\n  </style><div class=\"container\"><p>There is much written about every aspect ranging from how to effectively train your workforce to the re-identification of anonymized data to threat detection. Adding to the cybersecurity fog is complex technology environments that constantly change to accommodate the pace of business and digital transformation needed to remain competitive.</p><p>The intent of this post is to share thoughts on how to rationalize cybersecurity (governance, technical controls, and processes) and focus on what’s important to your business while blocking out the noise. Management of cyber risk is at the center of cybersecurity. Understanding the cyber threats to your business, the likelihood of them materializing, and their potential impact (financial, reputational) is fundamental. Casinos, steel manufacturers, hospitals, research organizations all face cyber threats. Granted, some of the threats may be more pronounced and the impact more catastrophic, but they all must understand the risk technology brings to their business.</p><p>The Cybersecurity Rationalization diagram describes the rationalization process at a high-level. Thoughtfully addressing these areas will help you effectively manage risk. Does this guarantee there will be no cybersecurity incidents or breaches? Absolutely not. Technology environments are too complicated, some technologies (e.g., TCP/IP) are inherently insecure, and humans, well, are humans. Taking these steps will reduce the number of incidents and their impact on your business.</p></div><p><em>Cybersecurity Rationalization</em></p><img src=\"/sites/default/files/inline-images/cybersecurity-taxonomy-2.png\" data-entity-uuid=\"c28835cb-fb21-44c2-9476-d6785b33f992\" data-entity-type=\"file\" width=\"900\" height=\"391\"><p>&nbsp;</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>Cyber Risk Understanding</title><style>\r\n    body { font-family: Arial, sans-serif; line-height: 1.6; padding: 2rem; background-color: #f9f9f9; color: #111; }\r\n    .container { max-width: 900px; margin: 0 auto; background: #fff; padding: 1.5rem 2rem; border-radius: 8px; box-shadow: 0 2px 6px rgba(0,0,0,0.08); }\r\n    ol { padding-left: 1.5rem; }\r\n    li { margin-bottom: 1rem; }\r\n  </style><div class=\"container\"><ol><li>To understand cyber risk we must first identify the data collected and technology services provided. The sensitivity of data collected and critical nature of services influence business risk tolerance.</li><li>Business leaders must determine their business risk tolerance. Will a breach or cybersecurity incident lead to reputational damage and significant loss of revenue? Will a breach result in significant harm to individuals (e.g., expose extremely sensitive information)? If so, the business risk tolerance should be low.</li><li>Business risk tolerance influences the level of cybersecurity controls implemented. Cybersecurity controls range from identity and access management to endpoint protection to cloud security. Security monitoring (threat detection) and incident response is also included in the scope of cybersecurity controls. Risk averse organizations may require more extensive cybersecurity controls to reduce cyber risk.</li><li>Threats to data and technology services are another factor that influence cybersecurity controls. A reasonable understanding of bad actors and associated threats to your business is required. This is important because it helps to identify blind spots.</li><li>Vulnerabilities increase cyber risk. The importance of vulnerability management can’t be overstated. Bad actors exploit some type of weakness be it technical or human-based to accomplish their goal. Identifying, prioritizing, and remediating vulnerabilities is critical. Proactively addressing technical debt reduces the vulnerability management challenge.</li><li>Regulatory (e.g., HIPAA) and customer contractual requirements contribute to business risk as non-compliance can result in fines and other damages. These requirements must be considered but should not drive definition of cybersecurity controls. Leading practices, relevant threats and risk tolerance should guide effective cybersecurity.</li><li>If the disciplines outlined above are addressed in a thoughtful manner, the outcome is effective cyber risk management. A continual focus on threats, vulnerabilities, and effectiveness of controls while considering business risk tolerance will create the right culture. Combining this with cybersecurity governance will ensure alignment as the business needs change.</li></ol></div><p>This is a high-level view into how to approach cybersecurity and manage cyber risk. In reality, each one of these disciplines (e.g, threat management, vulnerability management) require a focused effort to implement the needed capability. The challenge is balancing cybersecurity with cost, productivity, and user experience to reasonably protect data and services, and minimize the risk to people, society, and business. There is no easy answer to meeting this challenge, it’s a journey not a destination.</p><p>We live in a hyper-digital age and technology is critical in all aspects of our lives. Effective cybersecurity is more important than ever!</p>','','full_html'),('featured_article',0,61,121,'en',0,'<p>C ybersecurity can be a complex and overwhelming discipline.</p><p>There is much written about every aspect ranging from how to effectively train your workforce to the re-identification of anonymized data to threat detection. Adding to the cybersecurity fog is complex technology environments that constantly change to accommodate the pace of business and digital transformation needed to remain competitive.</p><p>The intent of this post is to share thoughts on how to rationalize cybersecurity (governance, technical controls, and processes) and focus on what’s important to your business while blocking out the noise. Management of cyber risk is at the center of cybersecurity. Understanding the cyber threats to your business, the likelihood of them materializing, and their potential impact (financial, reputational) is fundamental. Casinos, steel manufacturers, hospitals, research organizations all face cyber threats. Granted, some of the threats may be more pronounced and the impact more catastrophic, but they all must understand the risk technology brings to their business.</p><p>The Cybersecurity Rationalization diagram describes the rationalization process at a high-level. Thoughtfully addressing these areas will help you effectively manage risk. Does this guarantee there will be no cybersecurity incidents or breaches? Absolutely not. Technology environments are too complicated, some technologies (e.g., TCP/IP) are inherently insecure, and humans, well, are humans. Taking these steps will reduce the number of incidents and their impact on your business.</p><p><em>Cybersecurity Rationalization</em></p><img src=\"/sites/default/files/inline-images/cybersecurity-taxonomy-2.png\" data-entity-uuid=\"c28835cb-fb21-44c2-9476-d6785b33f992\" data-entity-type=\"file\" width=\"900\" height=\"391\"><p>&nbsp;</p><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>Cyber Risk Understanding</title><style>\r\n    body { font-family: Arial, sans-serif; line-height: 1.6; padding: 2rem; background-color: #f9f9f9; color: #111; }\r\n    .container { max-width: 900px; margin: 0 auto; background: #fff; padding: 1.5rem 2rem; border-radius: 8px; box-shadow: 0 2px 6px rgba(0,0,0,0.08); }\r\n    ol { padding-left: 1.5rem; }\r\n    li { margin-bottom: 1rem; }\r\n  </style><div class=\"container\"><ol><li>To understand cyber risk we must first identify the data collected and technology services provided. The sensitivity of data collected and critical nature of services influence business risk tolerance.</li><li>Business leaders must determine their business risk tolerance. Will a breach or cybersecurity incident lead to reputational damage and significant loss of revenue? Will a breach result in significant harm to individuals (e.g., expose extremely sensitive information)? If so, the business risk tolerance should be low.</li><li>Business risk tolerance influences the level of cybersecurity controls implemented. Cybersecurity controls range from identity and access management to endpoint protection to cloud security. Security monitoring (threat detection) and incident response is also included in the scope of cybersecurity controls. Risk averse organizations may require more extensive cybersecurity controls to reduce cyber risk.</li><li>Threats to data and technology services are another factor that influence cybersecurity controls. A reasonable understanding of bad actors and associated threats to your business is required. This is important because it helps to identify blind spots.</li><li>Vulnerabilities increase cyber risk. The importance of vulnerability management can’t be overstated. Bad actors exploit some type of weakness be it technical or human-based to accomplish their goal. Identifying, prioritizing, and remediating vulnerabilities is critical. Proactively addressing technical debt reduces the vulnerability management challenge.</li><li>Regulatory (e.g., HIPAA) and customer contractual requirements contribute to business risk as non-compliance can result in fines and other damages. These requirements must be considered but should not drive definition of cybersecurity controls. Leading practices, relevant threats and risk tolerance should guide effective cybersecurity.</li><li>If the disciplines outlined above are addressed in a thoughtful manner, the outcome is effective cyber risk management. A continual focus on threats, vulnerabilities, and effectiveness of controls while considering business risk tolerance will create the right culture. Combining this with cybersecurity governance will ensure alignment as the business needs change.</li></ol></div><p>This is a high-level view into how to approach cybersecurity and manage cyber risk. In reality, each one of these disciplines (e.g, threat management, vulnerability management) require a focused effort to implement the needed capability. The challenge is balancing cybersecurity with cost, productivity, and user experience to reasonably protect data and services, and minimize the risk to people, society, and business. There is no easy answer to meeting this challenge, it’s a journey not a destination.</p><p>We live in a hyper-digital age and technology is critical in all aspects of our lives. Effective cybersecurity is more important than ever!</p>','','full_html'),('featured_article',0,61,122,'en',0,'<p>C ybersecurity can be a complex and overwhelming discipline.</p><p>There is much written about every aspect ranging from how to effectively train your workforce to the re-identification of anonymized data to threat detection. Adding to the cybersecurity fog is complex technology environments that constantly change to accommodate the pace of business and digital transformation needed to remain competitive.</p><p>The intent of this post is to share thoughts on how to rationalize cybersecurity (governance, technical controls, and processes) and focus on what’s important to your business while blocking out the noise. Management of cyber risk is at the center of cybersecurity. Understanding the cyber threats to your business, the likelihood of them materializing, and their potential impact (financial, reputational) is fundamental. Casinos, steel manufacturers, hospitals, research organizations all face cyber threats. Granted, some of the threats may be more pronounced and the impact more catastrophic, but they all must understand the risk technology brings to their business.</p><p>The Cybersecurity Rationalization diagram describes the rationalization process at a high-level. Thoughtfully addressing these areas will help you effectively manage risk. Does this guarantee there will be no cybersecurity incidents or breaches? Absolutely not. Technology environments are too complicated, some technologies (e.g., TCP/IP) are inherently insecure, and humans, well, are humans. Taking these steps will reduce the number of incidents and their impact on your business.</p><p><em>Cybersecurity Rationalization</em></p><img src=\"/sites/default/files/inline-images/cybersecurity-taxonomy-2.png\" data-entity-uuid=\"c28835cb-fb21-44c2-9476-d6785b33f992\" data-entity-type=\"file\" width=\"900\" height=\"391\"><p>&nbsp;</p><ol><li>To understand cyber risk we must first identify the data collected and technology services provided. The sensitivity of data collected and critical nature of services influence business risk tolerance.</li><li>Business leaders must determine their business risk tolerance. Will a breach or cybersecurity incident lead to reputational damage and significant loss of revenue? Will a breach result in significant harm to individuals (e.g., expose extremely sensitive information)? If so, the business risk tolerance should be low.</li><li>Business risk tolerance influences the level of cybersecurity controls implemented. Cybersecurity controls range from identity and access management to endpoint protection to cloud security. Security monitoring (threat detection) and incident response is also included in the scope of cybersecurity controls. Risk averse organizations may require more extensive cybersecurity controls to reduce cyber risk.</li><li>Threats to data and technology services are another factor that influence cybersecurity controls. A reasonable understanding of bad actors and associated threats to your business is required. This is important because it helps to identify blind spots.</li><li>Vulnerabilities increase cyber risk. The importance of vulnerability management can’t be overstated. Bad actors exploit some type of weakness be it technical or human-based to accomplish their goal. Identifying, prioritizing, and remediating vulnerabilities is critical. Proactively addressing technical debt reduces the vulnerability management challenge.</li><li>Regulatory (e.g., HIPAA) and customer contractual requirements contribute to business risk as non-compliance can result in fines and other damages. These requirements must be considered but should not drive definition of cybersecurity controls. Leading practices, relevant threats and risk tolerance should guide effective cybersecurity.</li><li>If the disciplines outlined above are addressed in a thoughtful manner, the outcome is effective cyber risk management. A continual focus on threats, vulnerabilities, and effectiveness of controls while considering business risk tolerance will create the right culture. Combining this with cybersecurity governance will ensure alignment as the business needs change.</li></ol><p>This is a high-level view into how to approach cybersecurity and manage cyber risk. In reality, each one of these disciplines (e.g, threat management, vulnerability management) require a focused effort to implement the needed capability. The challenge is balancing cybersecurity with cost, productivity, and user experience to reasonably protect data and services, and minimize the risk to people, society, and business. There is no easy answer to meeting this challenge, it’s a journey not a destination.</p><p>We live in a hyper-digital age and technology is critical in all aspects of our lives. Effective cybersecurity is more important than ever!</p>','','full_html'),('featured_article',0,61,136,'en',0,'<p>C ybersecurity can be a complex and overwhelming discipline.</p><p>There is much written about every aspect ranging from how to effectively train your workforce to the re-identification of anonymized data to threat detection. Adding to the cybersecurity fog is complex technology environments that constantly change to accommodate the pace of business and digital transformation needed to remain competitive.</p><p>The intent of this post is to share thoughts on how to rationalize cybersecurity (governance, technical controls, and processes) and focus on what’s important to your business while blocking out the noise. Management of cyber risk is at the center of cybersecurity. Understanding the cyber threats to your business, the likelihood of them materializing, and their potential impact (financial, reputational) is fundamental. Casinos, steel manufacturers, hospitals, research organizations all face cyber threats. Granted, some of the threats may be more pronounced and the impact more catastrophic, but they all must understand the risk technology brings to their business.</p><p>The Cybersecurity Rationalization diagram describes the rationalization process at a high-level. Thoughtfully addressing these areas will help you effectively manage risk. Does this guarantee there will be no cybersecurity incidents or breaches? Absolutely not. Technology environments are too complicated, some technologies (e.g., TCP/IP) are inherently insecure, and humans, well, are humans. Taking these steps will reduce the number of incidents and their impact on your business.</p><p><em>Cybersecurity Rationalization</em></p><img src=\"/sites/default/files/inline-images/cybersecurity-taxonomy-2.png\" data-entity-uuid=\"c28835cb-fb21-44c2-9476-d6785b33f992\" data-entity-type=\"file\" width=\"900\" height=\"391\"><p>&nbsp;</p><ol><li>To understand cyber risk we must first identify the data collected and technology services provided. The sensitivity of data collected and critical nature of services influence business risk tolerance.</li><li>Business leaders must determine their business risk tolerance. Will a breach or cybersecurity incident lead to reputational damage and significant loss of revenue? Will a breach result in significant harm to individuals (e.g., expose extremely sensitive information)? If so, the business risk tolerance should be low.</li><li>Business risk tolerance influences the level of cybersecurity controls implemented. Cybersecurity controls range from identity and access management to endpoint protection to cloud security. Security monitoring (threat detection) and incident response is also included in the scope of cybersecurity controls. Risk averse organizations may require more extensive cybersecurity controls to reduce cyber risk.</li><li>Threats to data and technology services are another factor that influence cybersecurity controls. A reasonable understanding of bad actors and associated threats to your business is required. This is important because it helps to identify blind spots.</li><li>Vulnerabilities increase cyber risk. The importance of vulnerability management can’t be overstated. Bad actors exploit some type of weakness be it technical or human-based to accomplish their goal. Identifying, prioritizing, and remediating vulnerabilities is critical. Proactively addressing technical debt reduces the vulnerability management challenge.</li><li>Regulatory (e.g., HIPAA) and customer contractual requirements contribute to business risk as non-compliance can result in fines and other damages. These requirements must be considered but should not drive definition of cybersecurity controls. Leading practices, relevant threats and risk tolerance should guide effective cybersecurity.</li><li>If the disciplines outlined above are addressed in a thoughtful manner, the outcome is effective cyber risk management. A continual focus on threats, vulnerabilities, and effectiveness of controls while considering business risk tolerance will create the right culture. Combining this with cybersecurity governance will ensure alignment as the business needs change.</li></ol><p>This is a high-level view into how to approach cybersecurity and manage cyber risk. In reality, each one of these disciplines (e.g, threat management, vulnerability management) require a focused effort to implement the needed capability. The challenge is balancing cybersecurity with cost, productivity, and user experience to reasonably protect data and services, and minimize the risk to people, society, and business. There is no easy answer to meeting this challenge, it’s a journey not a destination.</p><p>We live in a hyper-digital age and technology is critical in all aspects of our lives. Effective cybersecurity is more important than ever!</p>','','full_html'),('featured_article',0,61,265,'en',0,'<p>C ybersecurity can be a complex and overwhelming discipline.</p><p>There is much written about every aspect ranging from how to effectively train your workforce to the re-identification of anonymized data to threat detection. Adding to the cybersecurity fog is complex technology environments that constantly change to accommodate the pace of business and digital transformation needed to remain competitive.</p><p>The intent of this post is to share thoughts on how to rationalize cybersecurity (governance, technical controls, and processes) and focus on what’s important to your business while blocking out the noise. Management of cyber risk is at the center of cybersecurity. Understanding the cyber threats to your business, the likelihood of them materializing, and their potential impact (financial, reputational) is fundamental. Casinos, steel manufacturers, hospitals, research organizations all face cyber threats. Granted, some of the threats may be more pronounced and the impact more catastrophic, but they all must understand the risk technology brings to their business.</p><p>The Cybersecurity Rationalization diagram describes the rationalization process at a high-level. Thoughtfully addressing these areas will help you effectively manage risk. Does this guarantee there will be no cybersecurity incidents or breaches? Absolutely not. Technology environments are too complicated, some technologies (e.g., TCP/IP) are inherently insecure, and humans, well, are humans. Taking these steps will reduce the number of incidents and their impact on your business.</p><p><em>Cybersecurity Rationalization</em></p><img src=\"/sites/default/files/inline-images/cybersecurity-taxonomy-2.png\" data-entity-uuid=\"c28835cb-fb21-44c2-9476-d6785b33f992\" data-entity-type=\"file\" width=\"900\" height=\"391\"><p>&nbsp;</p><ol><li>To understand cyber risk we must first identify the data collected and technology services provided. The sensitivity of data collected and critical nature of services influence business risk tolerance.</li><li>Business leaders must determine their business risk tolerance. Will a breach or cybersecurity incident lead to reputational damage and significant loss of revenue? Will a breach result in significant harm to individuals (e.g., expose extremely sensitive information)? If so, the business risk tolerance should be low.</li><li>Business risk tolerance influences the level of cybersecurity controls implemented. Cybersecurity controls range from identity and access management to endpoint protection to cloud security. Security monitoring (threat detection) and incident response is also included in the scope of cybersecurity controls. Risk averse organizations may require more extensive cybersecurity controls to reduce cyber risk.</li><li>Threats to data and technology services are another factor that influence cybersecurity controls. A reasonable understanding of bad actors and associated threats to your business is required. This is important because it helps to identify blind spots.</li><li>Vulnerabilities increase cyber risk. The importance of vulnerability management can’t be overstated. Bad actors exploit some type of weakness be it technical or human-based to accomplish their goal. Identifying, prioritizing, and remediating vulnerabilities is critical. Proactively addressing technical debt reduces the vulnerability management challenge.</li><li>Regulatory (e.g., HIPAA) and customer contractual requirements contribute to business risk as non-compliance can result in fines and other damages. These requirements must be considered but should not drive definition of cybersecurity controls. Leading practices, relevant threats and risk tolerance should guide effective cybersecurity.</li><li>If the disciplines outlined above are addressed in a thoughtful manner, the outcome is effective cyber risk management. A continual focus on threats, vulnerabilities, and effectiveness of controls while considering business risk tolerance will create the right culture. Combining this with cybersecurity governance will ensure alignment as the business needs change.</li></ol><p>This is a high-level view into how to approach cybersecurity and manage cyber risk. In reality, each one of these disciplines (e.g, threat management, vulnerability management) require a focused effort to implement the needed capability. The challenge is balancing cybersecurity with cost, productivity, and user experience to reasonably protect data and services, and minimize the risk to people, society, and business. There is no easy answer to meeting this challenge, it’s a journey not a destination.</p><p>We live in a hyper-digital age and technology is critical in all aspects of our lives. Effective cybersecurity is more important than ever!</p>','','full_html'),('featured_article',0,61,394,'en',0,'<p>C ybersecurity can be a complex and overwhelming discipline.</p><p>There is much written about every aspect ranging from how to effectively train your workforce to the re-identification of anonymized data to threat detection. Adding to the cybersecurity fog is complex technology environments that constantly change to accommodate the pace of business and digital transformation needed to remain competitive.</p><p>The intent of this post is to share thoughts on how to rationalize cybersecurity (governance, technical controls, and processes) and focus on what’s important to your business while blocking out the noise. Management of cyber risk is at the center of cybersecurity. Understanding the cyber threats to your business, the likelihood of them materializing, and their potential impact (financial, reputational) is fundamental. Casinos, steel manufacturers, hospitals, research organizations all face cyber threats. Granted, some of the threats may be more pronounced and the impact more catastrophic, but they all must understand the risk technology brings to their business.</p><p>The Cybersecurity Rationalization diagram describes the rationalization process at a high-level. Thoughtfully addressing these areas will help you effectively manage risk. Does this guarantee there will be no cybersecurity incidents or breaches? Absolutely not. Technology environments are too complicated, some technologies (e.g., TCP/IP) are inherently insecure, and humans, well, are humans. Taking these steps will reduce the number of incidents and their impact on your business.</p><p><em>Cybersecurity Rationalization</em></p><img src=\"/sites/default/files/inline-images/cybersecurity-taxonomy-2.png\" data-entity-uuid=\"c28835cb-fb21-44c2-9476-d6785b33f992\" data-entity-type=\"file\" width=\"900\" height=\"391\"><p>&nbsp;</p><ol><li>To understand cyber risk we must first identify the data collected and technology services provided. The sensitivity of data collected and critical nature of services influence business risk tolerance.</li><li>Business leaders must determine their business risk tolerance. Will a breach or cybersecurity incident lead to reputational damage and significant loss of revenue? Will a breach result in significant harm to individuals (e.g., expose extremely sensitive information)? If so, the business risk tolerance should be low.</li><li>Business risk tolerance influences the level of cybersecurity controls implemented. Cybersecurity controls range from identity and access management to endpoint protection to cloud security. Security monitoring (threat detection) and incident response is also included in the scope of cybersecurity controls. Risk averse organizations may require more extensive cybersecurity controls to reduce cyber risk.</li><li>Threats to data and technology services are another factor that influence cybersecurity controls. A reasonable understanding of bad actors and associated threats to your business is required. This is important because it helps to identify blind spots.</li><li>Vulnerabilities increase cyber risk. The importance of vulnerability management can’t be overstated. Bad actors exploit some type of weakness be it technical or human-based to accomplish their goal. Identifying, prioritizing, and remediating vulnerabilities is critical. Proactively addressing technical debt reduces the vulnerability management challenge.</li><li>Regulatory (e.g., HIPAA) and customer contractual requirements contribute to business risk as non-compliance can result in fines and other damages. These requirements must be considered but should not drive definition of cybersecurity controls. Leading practices, relevant threats and risk tolerance should guide effective cybersecurity.</li><li>If the disciplines outlined above are addressed in a thoughtful manner, the outcome is effective cyber risk management. A continual focus on threats, vulnerabilities, and effectiveness of controls while considering business risk tolerance will create the right culture. Combining this with cybersecurity governance will ensure alignment as the business needs change.</li></ol><p>This is a high-level view into how to approach cybersecurity and manage cyber risk. In reality, each one of these disciplines (e.g, threat management, vulnerability management) require a focused effort to implement the needed capability. The challenge is balancing cybersecurity with cost, productivity, and user experience to reasonably protect data and services, and minimize the risk to people, society, and business. There is no easy answer to meeting this challenge, it’s a journey not a destination.</p><p>We live in a hyper-digital age and technology is critical in all aspects of our lives. Effective cybersecurity is more important than ever!</p>','','full_html'),('featured_article',0,61,464,'en',0,'<p>C ybersecurity can be a complex and overwhelming discipline.</p><p>There is much written about every aspect ranging from how to effectively train your workforce to the re-identification of anonymized data to threat detection. Adding to the cybersecurity fog is complex technology environments that constantly change to accommodate the pace of business and digital transformation needed to remain competitive.</p><p>The intent of this post is to share thoughts on how to rationalize cybersecurity (governance, technical controls, and processes) and focus on what’s important to your business while blocking out the noise. Management of cyber risk is at the center of cybersecurity. Understanding the cyber threats to your business, the likelihood of them materializing, and their potential impact (financial, reputational) is fundamental. Casinos, steel manufacturers, hospitals, research organizations all face cyber threats. Granted, some of the threats may be more pronounced and the impact more catastrophic, but they all must understand the risk technology brings to their business.</p><p>The Cybersecurity Rationalization diagram describes the rationalization process at a high-level. Thoughtfully addressing these areas will help you effectively manage risk. Does this guarantee there will be no cybersecurity incidents or breaches? Absolutely not. Technology environments are too complicated, some technologies (e.g., TCP/IP) are inherently insecure, and humans, well, are humans. Taking these steps will reduce the number of incidents and their impact on your business.</p><p><em>Cybersecurity Rationalization</em></p><img src=\"/sites/default/files/inline-images/cybersecurity-taxonomy-2.png\" data-entity-uuid=\"c28835cb-fb21-44c2-9476-d6785b33f992\" data-entity-type=\"file\" width=\"900\" height=\"391\"><p>&nbsp;</p><ol><li>To understand cyber risk we must first identify the data collected and technology services provided. The sensitivity of data collected and critical nature of services influence business risk tolerance.</li><li>Business leaders must determine their business risk tolerance. Will a breach or cybersecurity incident lead to reputational damage and significant loss of revenue? Will a breach result in significant harm to individuals (e.g., expose extremely sensitive information)? If so, the business risk tolerance should be low.</li><li>Business risk tolerance influences the level of cybersecurity controls implemented. Cybersecurity controls range from identity and access management to endpoint protection to cloud security. Security monitoring (threat detection) and incident response is also included in the scope of cybersecurity controls. Risk averse organizations may require more extensive cybersecurity controls to reduce cyber risk.</li><li>Threats to data and technology services are another factor that influence cybersecurity controls. A reasonable understanding of bad actors and associated threats to your business is required. This is important because it helps to identify blind spots.</li><li>Vulnerabilities increase cyber risk. The importance of vulnerability management can’t be overstated. Bad actors exploit some type of weakness be it technical or human-based to accomplish their goal. Identifying, prioritizing, and remediating vulnerabilities is critical. Proactively addressing technical debt reduces the vulnerability management challenge.</li><li>Regulatory (e.g., HIPAA) and customer contractual requirements contribute to business risk as non-compliance can result in fines and other damages. These requirements must be considered but should not drive definition of cybersecurity controls. Leading practices, relevant threats and risk tolerance should guide effective cybersecurity.</li><li>If the disciplines outlined above are addressed in a thoughtful manner, the outcome is effective cyber risk management. A continual focus on threats, vulnerabilities, and effectiveness of controls while considering business risk tolerance will create the right culture. Combining this with cybersecurity governance will ensure alignment as the business needs change.</li></ol><p>This is a high-level view into how to approach cybersecurity and manage cyber risk. In reality, each one of these disciplines (e.g, threat management, vulnerability management) require a focused effort to implement the needed capability. The challenge is balancing cybersecurity with cost, productivity, and user experience to reasonably protect data and services, and minimize the risk to people, society, and business. There is no easy answer to meeting this challenge, it’s a journey not a destination.</p><p>We live in a hyper-digital age and technology is critical in all aspects of our lives. Effective cybersecurity is more important than ever!</p>','','full_html'),('featured_article',0,61,545,'en',0,'<p>C ybersecurity can be a complex and overwhelming discipline.</p><p>There is much written about every aspect ranging from how to effectively train your workforce to the re-identification of anonymized data to threat detection. Adding to the cybersecurity fog is complex technology environments that constantly change to accommodate the pace of business and digital transformation needed to remain competitive.</p><p>The intent of this post is to share thoughts on how to rationalize cybersecurity (governance, technical controls, and processes) and focus on what’s important to your business while blocking out the noise. Management of cyber risk is at the center of cybersecurity. Understanding the cyber threats to your business, the likelihood of them materializing, and their potential impact (financial, reputational) is fundamental. Casinos, steel manufacturers, hospitals, research organizations all face cyber threats. Granted, some of the threats may be more pronounced and the impact more catastrophic, but they all must understand the risk technology brings to their business.</p><p>The Cybersecurity Rationalization diagram describes the rationalization process at a high-level. Thoughtfully addressing these areas will help you effectively manage risk. Does this guarantee there will be no cybersecurity incidents or breaches? Absolutely not. Technology environments are too complicated, some technologies (e.g., TCP/IP) are inherently insecure, and humans, well, are humans. Taking these steps will reduce the number of incidents and their impact on your business.</p><p><em>Cybersecurity Rationalization</em></p><img src=\"/sites/default/files/inline-images/cybersecurity-taxonomy-2.png\" data-entity-uuid=\"c28835cb-fb21-44c2-9476-d6785b33f992\" data-entity-type=\"file\" width=\"900\" height=\"391\"><p>&nbsp;</p><ol><li>To understand cyber risk we must first identify the data collected and technology services provided. The sensitivity of data collected and critical nature of services influence business risk tolerance.</li><li>Business leaders must determine their business risk tolerance. Will a breach or cybersecurity incident lead to reputational damage and significant loss of revenue? Will a breach result in significant harm to individuals (e.g., expose extremely sensitive information)? If so, the business risk tolerance should be low.</li><li>Business risk tolerance influences the level of cybersecurity controls implemented. Cybersecurity controls range from identity and access management to endpoint protection to cloud security. Security monitoring (threat detection) and incident response is also included in the scope of cybersecurity controls. Risk averse organizations may require more extensive cybersecurity controls to reduce cyber risk.</li><li>Threats to data and technology services are another factor that influence cybersecurity controls. A reasonable understanding of bad actors and associated threats to your business is required. This is important because it helps to identify blind spots.</li><li>Vulnerabilities increase cyber risk. The importance of vulnerability management can’t be overstated. Bad actors exploit some type of weakness be it technical or human-based to accomplish their goal. Identifying, prioritizing, and remediating vulnerabilities is critical. Proactively addressing technical debt reduces the vulnerability management challenge.</li><li>Regulatory (e.g., HIPAA) and customer contractual requirements contribute to business risk as non-compliance can result in fines and other damages. These requirements must be considered but should not drive definition of cybersecurity controls. Leading practices, relevant threats and risk tolerance should guide effective cybersecurity.</li><li>If the disciplines outlined above are addressed in a thoughtful manner, the outcome is effective cyber risk management. A continual focus on threats, vulnerabilities, and effectiveness of controls while considering business risk tolerance will create the right culture. Combining this with cybersecurity governance will ensure alignment as the business needs change.</li></ol><p>This is a high-level view into how to approach cybersecurity and manage cyber risk. In reality, each one of these disciplines (e.g, threat management, vulnerability management) require a focused effort to implement the needed capability. The challenge is balancing cybersecurity with cost, productivity, and user experience to reasonably protect data and services, and minimize the risk to people, society, and business. There is no easy answer to meeting this challenge, it’s a journey not a destination.</p><p>We live in a hyper-digital age and technology is critical in all aspects of our lives. Effective cybersecurity is more important than ever!</p>','','full_html'),('featured_article',0,61,620,'en',0,'<p>C ybersecurity can be a complex and overwhelming discipline.</p><p>There is much written about every aspect ranging from how to effectively train your workforce to the re-identification of anonymized data to threat detection. Adding to the cybersecurity fog is complex technology environments that constantly change to accommodate the pace of business and digital transformation needed to remain competitive.</p><p>The intent of this post is to share thoughts on how to rationalize cybersecurity (governance, technical controls, and processes) and focus on what’s important to your business while blocking out the noise. Management of cyber risk is at the center of cybersecurity. Understanding the cyber threats to your business, the likelihood of them materializing, and their potential impact (financial, reputational) is fundamental. Casinos, steel manufacturers, hospitals, research organizations all face cyber threats. Granted, some of the threats may be more pronounced and the impact more catastrophic, but they all must understand the risk technology brings to their business.</p><p>The Cybersecurity Rationalization diagram describes the rationalization process at a high-level. Thoughtfully addressing these areas will help you effectively manage risk. Does this guarantee there will be no cybersecurity incidents or breaches? Absolutely not. Technology environments are too complicated, some technologies (e.g., TCP/IP) are inherently insecure, and humans, well, are humans. Taking these steps will reduce the number of incidents and their impact on your business.</p><p><em>Cybersecurity Rationalization</em></p><img src=\"/sites/default/files/inline-images/cybersecurity-taxonomy-2.png\" data-entity-uuid=\"c28835cb-fb21-44c2-9476-d6785b33f992\" data-entity-type=\"file\" width=\"900\" height=\"391\"><p>&nbsp;</p><ol><li>To understand cyber risk we must first identify the data collected and technology services provided. The sensitivity of data collected and critical nature of services influence business risk tolerance.</li><li>Business leaders must determine their business risk tolerance. Will a breach or cybersecurity incident lead to reputational damage and significant loss of revenue? Will a breach result in significant harm to individuals (e.g., expose extremely sensitive information)? If so, the business risk tolerance should be low.</li><li>Business risk tolerance influences the level of cybersecurity controls implemented. Cybersecurity controls range from identity and access management to endpoint protection to cloud security. Security monitoring (threat detection) and incident response is also included in the scope of cybersecurity controls. Risk averse organizations may require more extensive cybersecurity controls to reduce cyber risk.</li><li>Threats to data and technology services are another factor that influence cybersecurity controls. A reasonable understanding of bad actors and associated threats to your business is required. This is important because it helps to identify blind spots.</li><li>Vulnerabilities increase cyber risk. The importance of vulnerability management can’t be overstated. Bad actors exploit some type of weakness be it technical or human-based to accomplish their goal. Identifying, prioritizing, and remediating vulnerabilities is critical. Proactively addressing technical debt reduces the vulnerability management challenge.</li><li>Regulatory (e.g., HIPAA) and customer contractual requirements contribute to business risk as non-compliance can result in fines and other damages. These requirements must be considered but should not drive definition of cybersecurity controls. Leading practices, relevant threats and risk tolerance should guide effective cybersecurity.</li><li>If the disciplines outlined above are addressed in a thoughtful manner, the outcome is effective cyber risk management. A continual focus on threats, vulnerabilities, and effectiveness of controls while considering business risk tolerance will create the right culture. Combining this with cybersecurity governance will ensure alignment as the business needs change.</li></ol><p>This is a high-level view into how to approach cybersecurity and manage cyber risk. In reality, each one of these disciplines (e.g, threat management, vulnerability management) require a focused effort to implement the needed capability. The challenge is balancing cybersecurity with cost, productivity, and user experience to reasonably protect data and services, and minimize the risk to people, society, and business. There is no easy answer to meeting this challenge, it’s a journey not a destination.</p><p>We live in a hyper-digital age and technology is critical in all aspects of our lives. Effective cybersecurity is more important than ever!</p>','','full_html'),('webinar',0,62,124,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,62,141,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,62,148,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,62,159,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,62,262,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,62,465,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,62,546,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,62,621,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,63,140,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,63,147,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,63,263,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,63,391,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,63,466,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,63,547,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('webinar',0,63,622,'en',0,'<p><strong>About Webinar</strong></p><p>The world of business is changing quickly. Organizations that are best able to adjust and adapt will thrive, while those that evolve too slowly will struggle. In order to succeed in the face of rapid and accelerating change, you must become a Dynamic Organization. Cloud solutions and web-based communications, collaboration and productivity platforms can dramatically enhance and support your development and growth.</p><p><strong>Join us to learn:</strong></p><ul><li>What exactly is a Dynamic Organization, and why should you want to be one?</li><li>What do you need to do to become a more Dynamic Organization?</li><li>How can cloud-based solutions and platforms help you be adaptive and resilient?</li></ul>','','full_html'),('blog',0,64,142,'en',0,'<p>D o you know if your organization is Cyber Secure or Cyber Insecure?</p><p>My focus in this blog series will be about Cybersecurity and your organization.</p><p>Cyber-Insecurity and Cyber Crime have been hurting your business yesterday, and today and will continue to do so tomorrow if you do not:</p><ol><li>have a robust business understanding of the risks of not securing adequately your digital business infrastructures, systems, and product lines.</li><li>have a comprehensive set of business-focused strategies and plans to secure and provide cyber resilience in your digital business world.</li><li>have in place the enterprise and business unit governance policies, processes, procedures, and training which creates a foundation for a company culture of ownership and accountability for cybersecurity at all levels of your company, … Board of Directors, Executive Leadership, management, and employees.</li><li>have in place the operational practices, which include the use of your processes, procedures, supporting tools (manual or automated) and reporting to know whether your Cybersecurity capabilities are protecting your enterprise or not.</li><li>have the practice and acquired learning and knowledge about what to do and not do when your organization has been cyber-compromised.</li></ol><p>Cyber compromise takes many forms and attacks us from many directions. National States, terrorists, criminals, hacktivists, business competitors and business insiders all take advantage of Cyber Insecurity for illegal political, economic, financial, ideological, societal, business competitive and/or personal gain. The reason behind a cyber-attack is interesting but matters little compared to the impact on your business.</p><p>One of the industry reports I pay attention to year after year is the IBM Cost of a Data Breach Report. The latest IBM Cost of a Data Breach (2022) Report tells us that:</p><ul><li>83% of organizations studied have had more than one data breach.</li><li>60% of breaches led to increases in prices passed on to their customers.</li><li>79 of critical infrastructure organizations didn’t deploy a zero trust architecture.</li><li>19% of breaches occurred because of a compromise with a business partner.</li><li>45% of breaches were cloud-based.</li><li>The average cost of a data breach was $4.35m.</li><li>The average cost of a ransomware attack, not including the cost of the ransom itself, was $4.5m.</li><li>19% of breaches were caused by stolen or compromised credentials.</li><li>The average cost savings associated with Incident Response Governance, regularly tested Incident Response plans and Incident Response Teams was $2.66m.</li><li>The average cost of a data breach in the United States, the highest of any country was $9.44m.</li><li>The average time to identify and contain a data breach was 277 days.</li></ul><p>This last fact is the big one. The average time to identify and contain a data breach was 277 days. This is just an average. How many news reports have you read this past year about data breaches being reported that had been ongoing for over a year or more?</p><p>Another industry report I pay attention to is the Version Data Breach Investigations Report (DBIR). The Version DBIR 2022 tells us that:</p><ul><li>82% of breaches involve a human element, including social attacks, employee errors and misuse of systems and data.</li><li>There has been a 13% increase in Ransomware breaches, more than the last five years combined.</li><li>62% of system intrusions involved threat actors compromising business partners.</li></ul><p>These facts should be alarming to you. 82% of data breaches occurred due to a person making a mistake. Ransomware breaches continue to increase. 62% of digital systems intrusions originated with a business partner.</p><p>If you are a Board member, executive, director, or manager of a small, medium, or large business enterprise, you should be alarmed and concerned enough by this information to at least ask some questions within your organization to determine if you are Cyber Secure or Cyber Insecure!</p><p>In my next post, I will speak about <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,64,143,'en',0,'<p>D o you know if your organization is Cyber Secure or Cyber Insecure?</p><p>My focus in this blog series will be about Cybersecurity and your organization.</p><p>Cyber-Insecurity and Cyber Crime have been hurting your business yesterday, and today and will continue to do so tomorrow if you do not:</p><ol><li>have a robust business understanding of the risks of not securing adequately your digital business infrastructures, systems, and product lines.</li><li>have a comprehensive set of business-focused strategies and plans to secure and provide cyber resilience in your digital business world.</li><li>have in place the enterprise and business unit governance policies, processes, procedures, and training which creates a foundation for a company culture of ownership and accountability for cybersecurity at all levels of your company, … Board of Directors, Executive Leadership, management, and employees.</li><li>have in place the operational practices, which include the use of your processes, procedures, supporting tools (manual or automated) and reporting to know whether your Cybersecurity capabilities are protecting your enterprise or not.</li><li>have the practice and acquired learning and knowledge about what to do and not do when your organization has been cyber-compromised.</li></ol><p>Cyber compromise takes many forms and attacks us from many directions. National States, terrorists, criminals, hacktivists, business competitors and business insiders all take advantage of Cyber Insecurity for illegal political, economic, financial, ideological, societal, business competitive and/or personal gain. The reason behind a cyber-attack is interesting but matters little compared to the impact on your business.</p><p>One of the industry reports I pay attention to year after year is the IBM Cost of a Data Breach Report. The latest IBM Cost of a Data Breach (2022) Report tells us that:</p><ul><li>83% of organizations studied have had more than one data breach.</li><li>60% of breaches led to increases in prices passed on to their customers.</li><li>79 of critical infrastructure organizations didn’t deploy a zero trust architecture.</li><li>19% of breaches occurred because of a compromise with a business partner.</li><li>45% of breaches were cloud-based.</li><li>The average cost of a data breach was $4.35m.</li><li>The average cost of a ransomware attack, not including the cost of the ransom itself, was $4.5m.</li><li>19% of breaches were caused by stolen or compromised credentials.</li><li>The average cost savings associated with Incident Response Governance, regularly tested Incident Response plans and Incident Response Teams was $2.66m.</li><li>The average cost of a data breach in the United States, the highest of any country was $9.44m.</li><li>The average time to identify and contain a data breach was 277 days.</li></ul><p>This last fact is the big one. The average time to identify and contain a data breach was 277 days. This is just an average. How many news reports have you read this past year about data breaches being reported that had been ongoing for over a year or more?</p><p>Another industry report I pay attention to is the Version Data Breach Investigations Report (DBIR). The Version DBIR 2022 tells us that:</p><ul><li>82% of breaches involve a human element, including social attacks, employee errors and misuse of systems and data.</li><li>There has been a 13% increase in Ransomware breaches, more than the last five years combined.</li><li>62% of system intrusions involved threat actors compromising business partners.</li></ul><p>These facts should be alarming to you. 82% of data breaches occurred due to a person making a mistake. Ransomware breaches continue to increase. 62% of digital systems intrusions originated with a business partner.</p><p>If you are a Board member, executive, director, or manager of a small, medium, or large business enterprise, you should be alarmed and concerned enough by this information to at least ask some questions within your organization to determine if you are Cyber Secure or Cyber Insecure!</p><p>In my next post, I will speak about <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,64,144,'en',0,'<p>D o you know if your organization is Cyber Secure or Cyber Insecure?</p><p>My focus in this blog series will be about Cybersecurity and your organization.</p><p>Cyber-Insecurity and Cyber Crime have been hurting your business yesterday, and today and will continue to do so tomorrow if you do not:</p><ol><li>have a robust business understanding of the risks of not securing adequately your digital business infrastructures, systems, and product lines.</li><li>have a comprehensive set of business-focused strategies and plans to secure and provide cyber resilience in your digital business world.</li><li>have in place the enterprise and business unit governance policies, processes, procedures, and training which creates a foundation for a company culture of ownership and accountability for cybersecurity at all levels of your company, … Board of Directors, Executive Leadership, management, and employees.</li><li>have in place the operational practices, which include the use of your processes, procedures, supporting tools (manual or automated) and reporting to know whether your Cybersecurity capabilities are protecting your enterprise or not.</li><li>have the practice and acquired learning and knowledge about what to do and not do when your organization has been cyber-compromised.</li></ol><p>Cyber compromise takes many forms and attacks us from many directions. National States, terrorists, criminals, hacktivists, business competitors and business insiders all take advantage of Cyber Insecurity for illegal political, economic, financial, ideological, societal, business competitive and/or personal gain. The reason behind a cyber-attack is interesting but matters little compared to the impact on your business.</p><p>One of the industry reports I pay attention to year after year is the IBM Cost of a Data Breach Report. The latest IBM Cost of a Data Breach (2022) Report tells us that:</p><ul><li>83% of organizations studied have had more than one data breach.</li><li>60% of breaches led to increases in prices passed on to their customers.</li><li>79 of critical infrastructure organizations didn’t deploy a zero trust architecture.</li><li>19% of breaches occurred because of a compromise with a business partner.</li><li>45% of breaches were cloud-based.</li><li>The average cost of a data breach was $4.35m.</li><li>The average cost of a ransomware attack, not including the cost of the ransom itself, was $4.5m.</li><li>19% of breaches were caused by stolen or compromised credentials.</li><li>The average cost savings associated with Incident Response Governance, regularly tested Incident Response plans and Incident Response Teams was $2.66m.</li><li>The average cost of a data breach in the United States, the highest of any country was $9.44m.</li><li>The average time to identify and contain a data breach was 277 days.</li></ul><p>This last fact is the big one. The average time to identify and contain a data breach was 277 days. This is just an average. How many news reports have you read this past year about data breaches being reported that had been ongoing for over a year or more?</p><p>Another industry report I pay attention to is the Version Data Breach Investigations Report (DBIR). The Version DBIR 2022 tells us that:</p><ul><li>82% of breaches involve a human element, including social attacks, employee errors and misuse of systems and data.</li><li>There has been a 13% increase in Ransomware breaches, more than the last five years combined.</li><li>62% of system intrusions involved threat actors compromising business partners.</li></ul><p>These facts should be alarming to you. 82% of data breaches occurred due to a person making a mistake. Ransomware breaches continue to increase. 62% of digital systems intrusions originated with a business partner.</p><p>If you are a Board member, executive, director, or manager of a small, medium, or large business enterprise, you should be alarmed and concerned enough by this information to at least ask some questions within your organization to determine if you are Cyber Secure or Cyber Insecure!</p><p>In my next post, I will speak about <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,64,145,'en',0,'<p>D o you know if your organization is Cyber Secure or Cyber Insecure?</p><p>My focus in this blog series will be about Cybersecurity and your organization.</p><p>Cyber-Insecurity and Cyber Crime have been hurting your business yesterday, and today and will continue to do so tomorrow if you do not:</p><ol><li>have a robust business understanding of the risks of not securing adequately your digital business infrastructures, systems, and product lines.</li><li>have a comprehensive set of business-focused strategies and plans to secure and provide cyber resilience in your digital business world.</li><li>have in place the enterprise and business unit governance policies, processes, procedures, and training which creates a foundation for a company culture of ownership and accountability for cybersecurity at all levels of your company, … Board of Directors, Executive Leadership, management, and employees.</li><li>have in place the operational practices, which include the use of your processes, procedures, supporting tools (manual or automated) and reporting to know whether your Cybersecurity capabilities are protecting your enterprise or not.</li><li>have the practice and acquired learning and knowledge about what to do and not do when your organization has been cyber-compromised.</li></ol><p>Cyber compromise takes many forms and attacks us from many directions. National States, terrorists, criminals, hacktivists, business competitors and business insiders all take advantage of Cyber Insecurity for illegal political, economic, financial, ideological, societal, business competitive and/or personal gain. The reason behind a cyber-attack is interesting but matters little compared to the impact on your business.</p><p>One of the industry reports I pay attention to year after year is the IBM Cost of a Data Breach Report. The latest IBM Cost of a Data Breach (2022) Report tells us that:</p><ul><li>83% of organizations studied have had more than one data breach.</li><li>60% of breaches led to increases in prices passed on to their customers.</li><li>79 of critical infrastructure organizations didn’t deploy a zero trust architecture.</li><li>19% of breaches occurred because of a compromise with a business partner.</li><li>45% of breaches were cloud-based.</li><li>The average cost of a data breach was $4.35m.</li><li>The average cost of a ransomware attack, not including the cost of the ransom itself, was $4.5m.</li><li>19% of breaches were caused by stolen or compromised credentials.</li><li>The average cost savings associated with Incident Response Governance, regularly tested Incident Response plans and Incident Response Teams was $2.66m.</li><li>The average cost of a data breach in the United States, the highest of any country was $9.44m.</li><li>The average time to identify and contain a data breach was 277 days.</li></ul><p>This last fact is the big one. The average time to identify and contain a data breach was 277 days. This is just an average. How many news reports have you read this past year about data breaches being reported that had been ongoing for over a year or more?</p><p>Another industry report I pay attention to is the Version Data Breach Investigations Report (DBIR). The Version DBIR 2022 tells us that:</p><ul><li>82% of breaches involve a human element, including social attacks, employee errors and misuse of systems and data.</li><li>There has been a 13% increase in Ransomware breaches, more than the last five years combined.</li><li>62% of system intrusions involved threat actors compromising business partners.</li></ul><p>These facts should be alarming to you. 82% of data breaches occurred due to a person making a mistake. Ransomware breaches continue to increase. 62% of digital systems intrusions originated with a business partner.</p><p>If you are a Board member, executive, director, or manager of a small, medium, or large business enterprise, you should be alarmed and concerned enough by this information to at least ask some questions within your organization to determine if you are Cyber Secure or Cyber Insecure!</p><p>In my next post, I will speak about <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,64,249,'en',0,'<p>D o you know if your organization is Cyber Secure or Cyber Insecure?</p><p>My focus in this blog series will be about Cybersecurity and your organization.</p><p>Cyber-Insecurity and Cyber Crime have been hurting your business yesterday, and today and will continue to do so tomorrow if you do not:</p><ol><li>have a robust business understanding of the risks of not securing adequately your digital business infrastructures, systems, and product lines.</li><li>have a comprehensive set of business-focused strategies and plans to secure and provide cyber resilience in your digital business world.</li><li>have in place the enterprise and business unit governance policies, processes, procedures, and training which creates a foundation for a company culture of ownership and accountability for cybersecurity at all levels of your company, … Board of Directors, Executive Leadership, management, and employees.</li><li>have in place the operational practices, which include the use of your processes, procedures, supporting tools (manual or automated) and reporting to know whether your Cybersecurity capabilities are protecting your enterprise or not.</li><li>have the practice and acquired learning and knowledge about what to do and not do when your organization has been cyber-compromised.</li></ol><p>Cyber compromise takes many forms and attacks us from many directions. National States, terrorists, criminals, hacktivists, business competitors and business insiders all take advantage of Cyber Insecurity for illegal political, economic, financial, ideological, societal, business competitive and/or personal gain. The reason behind a cyber-attack is interesting but matters little compared to the impact on your business.</p><p>One of the industry reports I pay attention to year after year is the IBM Cost of a Data Breach Report. The latest IBM Cost of a Data Breach (2022) Report tells us that:</p><ul><li>83% of organizations studied have had more than one data breach.</li><li>60% of breaches led to increases in prices passed on to their customers.</li><li>79 of critical infrastructure organizations didn’t deploy a zero trust architecture.</li><li>19% of breaches occurred because of a compromise with a business partner.</li><li>45% of breaches were cloud-based.</li><li>The average cost of a data breach was $4.35m.</li><li>The average cost of a ransomware attack, not including the cost of the ransom itself, was $4.5m.</li><li>19% of breaches were caused by stolen or compromised credentials.</li><li>The average cost savings associated with Incident Response Governance, regularly tested Incident Response plans and Incident Response Teams was $2.66m.</li><li>The average cost of a data breach in the United States, the highest of any country was $9.44m.</li><li>The average time to identify and contain a data breach was 277 days.</li></ul><p>This last fact is the big one. The average time to identify and contain a data breach was 277 days. This is just an average. How many news reports have you read this past year about data breaches being reported that had been ongoing for over a year or more?</p><p>Another industry report I pay attention to is the Version Data Breach Investigations Report (DBIR). The Version DBIR 2022 tells us that:</p><ul><li>82% of breaches involve a human element, including social attacks, employee errors and misuse of systems and data.</li><li>There has been a 13% increase in Ransomware breaches, more than the last five years combined.</li><li>62% of system intrusions involved threat actors compromising business partners.</li></ul><p>These facts should be alarming to you. 82% of data breaches occurred due to a person making a mistake. Ransomware breaches continue to increase. 62% of digital systems intrusions originated with a business partner.</p><p>If you are a Board member, executive, director, or manager of a small, medium, or large business enterprise, you should be alarmed and concerned enough by this information to at least ask some questions within your organization to determine if you are Cyber Secure or Cyber Insecure!</p><p>In my next post, I will speak about <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,64,395,'en',0,'<p>D o you know if your organization is Cyber Secure or Cyber Insecure?</p><p>My focus in this blog series will be about Cybersecurity and your organization.</p><p>Cyber-Insecurity and Cyber Crime have been hurting your business yesterday, and today and will continue to do so tomorrow if you do not:</p><ol><li>have a robust business understanding of the risks of not securing adequately your digital business infrastructures, systems, and product lines.</li><li>have a comprehensive set of business-focused strategies and plans to secure and provide cyber resilience in your digital business world.</li><li>have in place the enterprise and business unit governance policies, processes, procedures, and training which creates a foundation for a company culture of ownership and accountability for cybersecurity at all levels of your company, … Board of Directors, Executive Leadership, management, and employees.</li><li>have in place the operational practices, which include the use of your processes, procedures, supporting tools (manual or automated) and reporting to know whether your Cybersecurity capabilities are protecting your enterprise or not.</li><li>have the practice and acquired learning and knowledge about what to do and not do when your organization has been cyber-compromised.</li></ol><p>Cyber compromise takes many forms and attacks us from many directions. National States, terrorists, criminals, hacktivists, business competitors and business insiders all take advantage of Cyber Insecurity for illegal political, economic, financial, ideological, societal, business competitive and/or personal gain. The reason behind a cyber-attack is interesting but matters little compared to the impact on your business.</p><p>One of the industry reports I pay attention to year after year is the IBM Cost of a Data Breach Report. The latest IBM Cost of a Data Breach (2022) Report tells us that:</p><ul><li>83% of organizations studied have had more than one data breach.</li><li>60% of breaches led to increases in prices passed on to their customers.</li><li>79 of critical infrastructure organizations didn’t deploy a zero trust architecture.</li><li>19% of breaches occurred because of a compromise with a business partner.</li><li>45% of breaches were cloud-based.</li><li>The average cost of a data breach was $4.35m.</li><li>The average cost of a ransomware attack, not including the cost of the ransom itself, was $4.5m.</li><li>19% of breaches were caused by stolen or compromised credentials.</li><li>The average cost savings associated with Incident Response Governance, regularly tested Incident Response plans and Incident Response Teams was $2.66m.</li><li>The average cost of a data breach in the United States, the highest of any country was $9.44m.</li><li>The average time to identify and contain a data breach was 277 days.</li></ul><p>This last fact is the big one. The average time to identify and contain a data breach was 277 days. This is just an average. How many news reports have you read this past year about data breaches being reported that had been ongoing for over a year or more?</p><p>Another industry report I pay attention to is the Version Data Breach Investigations Report (DBIR). The Version DBIR 2022 tells us that:</p><ul><li>82% of breaches involve a human element, including social attacks, employee errors and misuse of systems and data.</li><li>There has been a 13% increase in Ransomware breaches, more than the last five years combined.</li><li>62% of system intrusions involved threat actors compromising business partners.</li></ul><p>These facts should be alarming to you. 82% of data breaches occurred due to a person making a mistake. Ransomware breaches continue to increase. 62% of digital systems intrusions originated with a business partner.</p><p>If you are a Board member, executive, director, or manager of a small, medium, or large business enterprise, you should be alarmed and concerned enough by this information to at least ask some questions within your organization to determine if you are Cyber Secure or Cyber Insecure!</p><p>In my next post, I will speak about <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,64,467,'en',0,'<p>D o you know if your organization is Cyber Secure or Cyber Insecure?</p><p>My focus in this blog series will be about Cybersecurity and your organization.</p><p>Cyber-Insecurity and Cyber Crime have been hurting your business yesterday, and today and will continue to do so tomorrow if you do not:</p><ol><li>have a robust business understanding of the risks of not securing adequately your digital business infrastructures, systems, and product lines.</li><li>have a comprehensive set of business-focused strategies and plans to secure and provide cyber resilience in your digital business world.</li><li>have in place the enterprise and business unit governance policies, processes, procedures, and training which creates a foundation for a company culture of ownership and accountability for cybersecurity at all levels of your company, … Board of Directors, Executive Leadership, management, and employees.</li><li>have in place the operational practices, which include the use of your processes, procedures, supporting tools (manual or automated) and reporting to know whether your Cybersecurity capabilities are protecting your enterprise or not.</li><li>have the practice and acquired learning and knowledge about what to do and not do when your organization has been cyber-compromised.</li></ol><p>Cyber compromise takes many forms and attacks us from many directions. National States, terrorists, criminals, hacktivists, business competitors and business insiders all take advantage of Cyber Insecurity for illegal political, economic, financial, ideological, societal, business competitive and/or personal gain. The reason behind a cyber-attack is interesting but matters little compared to the impact on your business.</p><p>One of the industry reports I pay attention to year after year is the IBM Cost of a Data Breach Report. The latest IBM Cost of a Data Breach (2022) Report tells us that:</p><ul><li>83% of organizations studied have had more than one data breach.</li><li>60% of breaches led to increases in prices passed on to their customers.</li><li>79 of critical infrastructure organizations didn’t deploy a zero trust architecture.</li><li>19% of breaches occurred because of a compromise with a business partner.</li><li>45% of breaches were cloud-based.</li><li>The average cost of a data breach was $4.35m.</li><li>The average cost of a ransomware attack, not including the cost of the ransom itself, was $4.5m.</li><li>19% of breaches were caused by stolen or compromised credentials.</li><li>The average cost savings associated with Incident Response Governance, regularly tested Incident Response plans and Incident Response Teams was $2.66m.</li><li>The average cost of a data breach in the United States, the highest of any country was $9.44m.</li><li>The average time to identify and contain a data breach was 277 days.</li></ul><p>This last fact is the big one. The average time to identify and contain a data breach was 277 days. This is just an average. How many news reports have you read this past year about data breaches being reported that had been ongoing for over a year or more?</p><p>Another industry report I pay attention to is the Version Data Breach Investigations Report (DBIR). The Version DBIR 2022 tells us that:</p><ul><li>82% of breaches involve a human element, including social attacks, employee errors and misuse of systems and data.</li><li>There has been a 13% increase in Ransomware breaches, more than the last five years combined.</li><li>62% of system intrusions involved threat actors compromising business partners.</li></ul><p>These facts should be alarming to you. 82% of data breaches occurred due to a person making a mistake. Ransomware breaches continue to increase. 62% of digital systems intrusions originated with a business partner.</p><p>If you are a Board member, executive, director, or manager of a small, medium, or large business enterprise, you should be alarmed and concerned enough by this information to at least ask some questions within your organization to determine if you are Cyber Secure or Cyber Insecure!</p><p>In my next post, I will speak about <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,64,548,'en',0,'<p>D o you know if your organization is Cyber Secure or Cyber Insecure?</p><p>My focus in this blog series will be about Cybersecurity and your organization.</p><p>Cyber-Insecurity and Cyber Crime have been hurting your business yesterday, and today and will continue to do so tomorrow if you do not:</p><ol><li>have a robust business understanding of the risks of not securing adequately your digital business infrastructures, systems, and product lines.</li><li>have a comprehensive set of business-focused strategies and plans to secure and provide cyber resilience in your digital business world.</li><li>have in place the enterprise and business unit governance policies, processes, procedures, and training which creates a foundation for a company culture of ownership and accountability for cybersecurity at all levels of your company, … Board of Directors, Executive Leadership, management, and employees.</li><li>have in place the operational practices, which include the use of your processes, procedures, supporting tools (manual or automated) and reporting to know whether your Cybersecurity capabilities are protecting your enterprise or not.</li><li>have the practice and acquired learning and knowledge about what to do and not do when your organization has been cyber-compromised.</li></ol><p>Cyber compromise takes many forms and attacks us from many directions. National States, terrorists, criminals, hacktivists, business competitors and business insiders all take advantage of Cyber Insecurity for illegal political, economic, financial, ideological, societal, business competitive and/or personal gain. The reason behind a cyber-attack is interesting but matters little compared to the impact on your business.</p><p>One of the industry reports I pay attention to year after year is the IBM Cost of a Data Breach Report. The latest IBM Cost of a Data Breach (2022) Report tells us that:</p><ul><li>83% of organizations studied have had more than one data breach.</li><li>60% of breaches led to increases in prices passed on to their customers.</li><li>79 of critical infrastructure organizations didn’t deploy a zero trust architecture.</li><li>19% of breaches occurred because of a compromise with a business partner.</li><li>45% of breaches were cloud-based.</li><li>The average cost of a data breach was $4.35m.</li><li>The average cost of a ransomware attack, not including the cost of the ransom itself, was $4.5m.</li><li>19% of breaches were caused by stolen or compromised credentials.</li><li>The average cost savings associated with Incident Response Governance, regularly tested Incident Response plans and Incident Response Teams was $2.66m.</li><li>The average cost of a data breach in the United States, the highest of any country was $9.44m.</li><li>The average time to identify and contain a data breach was 277 days.</li></ul><p>This last fact is the big one. The average time to identify and contain a data breach was 277 days. This is just an average. How many news reports have you read this past year about data breaches being reported that had been ongoing for over a year or more?</p><p>Another industry report I pay attention to is the Version Data Breach Investigations Report (DBIR). The Version DBIR 2022 tells us that:</p><ul><li>82% of breaches involve a human element, including social attacks, employee errors and misuse of systems and data.</li><li>There has been a 13% increase in Ransomware breaches, more than the last five years combined.</li><li>62% of system intrusions involved threat actors compromising business partners.</li></ul><p>These facts should be alarming to you. 82% of data breaches occurred due to a person making a mistake. Ransomware breaches continue to increase. 62% of digital systems intrusions originated with a business partner.</p><p>If you are a Board member, executive, director, or manager of a small, medium, or large business enterprise, you should be alarmed and concerned enough by this information to at least ask some questions within your organization to determine if you are Cyber Secure or Cyber Insecure!</p><p>In my next post, I will speak about <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,64,623,'en',0,'<p>D o you know if your organization is Cyber Secure or Cyber Insecure?</p><p>My focus in this blog series will be about Cybersecurity and your organization.</p><p>Cyber-Insecurity and Cyber Crime have been hurting your business yesterday, and today and will continue to do so tomorrow if you do not:</p><ol><li>have a robust business understanding of the risks of not securing adequately your digital business infrastructures, systems, and product lines.</li><li>have a comprehensive set of business-focused strategies and plans to secure and provide cyber resilience in your digital business world.</li><li>have in place the enterprise and business unit governance policies, processes, procedures, and training which creates a foundation for a company culture of ownership and accountability for cybersecurity at all levels of your company, … Board of Directors, Executive Leadership, management, and employees.</li><li>have in place the operational practices, which include the use of your processes, procedures, supporting tools (manual or automated) and reporting to know whether your Cybersecurity capabilities are protecting your enterprise or not.</li><li>have the practice and acquired learning and knowledge about what to do and not do when your organization has been cyber-compromised.</li></ol><p>Cyber compromise takes many forms and attacks us from many directions. National States, terrorists, criminals, hacktivists, business competitors and business insiders all take advantage of Cyber Insecurity for illegal political, economic, financial, ideological, societal, business competitive and/or personal gain. The reason behind a cyber-attack is interesting but matters little compared to the impact on your business.</p><p>One of the industry reports I pay attention to year after year is the IBM Cost of a Data Breach Report. The latest IBM Cost of a Data Breach (2022) Report tells us that:</p><ul><li>83% of organizations studied have had more than one data breach.</li><li>60% of breaches led to increases in prices passed on to their customers.</li><li>79 of critical infrastructure organizations didn’t deploy a zero trust architecture.</li><li>19% of breaches occurred because of a compromise with a business partner.</li><li>45% of breaches were cloud-based.</li><li>The average cost of a data breach was $4.35m.</li><li>The average cost of a ransomware attack, not including the cost of the ransom itself, was $4.5m.</li><li>19% of breaches were caused by stolen or compromised credentials.</li><li>The average cost savings associated with Incident Response Governance, regularly tested Incident Response plans and Incident Response Teams was $2.66m.</li><li>The average cost of a data breach in the United States, the highest of any country was $9.44m.</li><li>The average time to identify and contain a data breach was 277 days.</li></ul><p>This last fact is the big one. The average time to identify and contain a data breach was 277 days. This is just an average. How many news reports have you read this past year about data breaches being reported that had been ongoing for over a year or more?</p><p>Another industry report I pay attention to is the Version Data Breach Investigations Report (DBIR). The Version DBIR 2022 tells us that:</p><ul><li>82% of breaches involve a human element, including social attacks, employee errors and misuse of systems and data.</li><li>There has been a 13% increase in Ransomware breaches, more than the last five years combined.</li><li>62% of system intrusions involved threat actors compromising business partners.</li></ul><p>These facts should be alarming to you. 82% of data breaches occurred due to a person making a mistake. Ransomware breaches continue to increase. 62% of digital systems intrusions originated with a business partner.</p><p>If you are a Board member, executive, director, or manager of a small, medium, or large business enterprise, you should be alarmed and concerned enough by this information to at least ask some questions within your organization to determine if you are Cyber Secure or Cyber Insecure!</p><p>In my next post, I will speak about <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,65,149,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyber Insecurity and systemic Business Interruption caused by Cybersecurity events can no longer be contained by any one company or organization. Recognizing this (at long last) the United States Securities and Exchange Commission issued a press release on March 15, 2023: <em>The Securities and Exchange Commission today proposed requirements … to address cybersecurity risks. Market Entities increasingly rely on information systems to perform their functions and provide their services and thus are targets for threat actors who may seek to disrupt their functions or gain access to the data stored on the information systems for financial gain. Cybersecurity risk also can be caused by the errors of employees, service providers, or business partners. The interconnectedness of Market Entities increases the risk that a significant cybersecurity incident can simultaneously impact multiple Market Entities causing systemic harm to the U.S. securities markets. (https://www.sec.gov/news/press-release/2023-52)</em></p><p>If your organization is a publicly-traded company in the United States, you will soon be required to report your Cyber Risk and Cyber Insecurity risk management policies, practices, and procedures as well as actually assessed risks to the SEC. The insurance industry is already assessing this in determining what your Cybersecurity insurance premiums will be.</p><p><strong>Cyber Disruption equals Business Interruption</strong></p><p>If you are a senior Digital / Information Technology leader and you are asked the following question:</p><p><strong>“How much security do we need?”</strong></p><p>I would recommend that you change the question narrative to understand your organization’s tolerance for risk. I would answer the above question with the following question:</p><p><strong>“As a business, what can we/you live without?”</strong></p><p>A business leader can not begin to understand why and how much to invest in Cybersecurity to reduce Cyber Insecurity unless they have been provided and understand a comprehensive view of the systemic cyber-driven business risks and the implicit business impact these risks can inflict on business operations today and tomorrow.</p><p>A quick test to determine if your Cybersecurity / Cyber Insecurity Risk Management practices are adequate, ask yourself the following question:</p><p>“When your Threat Intelligence tells you that a Risk Threshold has been reached, who do you tell and what action plan do you implement?\"</p><p>If your answer to any part of this question is <strong>“I do not know”</strong>, then you can be assured that your Cybersecurity / Cyber insecurity Risk Management practices are not adequate to help you protect your organization.</p><p>In my next post, I will provide visibility into risk categories and types, with an emphasis on Cyber Risks and their systemic interconnected with and potential impacts on business operations.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,65,150,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyber Insecurity and systemic Business Interruption caused by Cybersecurity events can no longer be contained by any one company or organization. Recognizing this (at long last) the United States Securities and Exchange Commission issued a press release on March 15, 2023: <em>The Securities and Exchange Commission today proposed requirements … to address cybersecurity risks. Market Entities increasingly rely on information systems to perform their functions and provide their services and thus are targets for threat actors who may seek to disrupt their functions or gain access to the data stored on the information systems for financial gain. Cybersecurity risk also can be caused by the errors of employees, service providers, or business partners. The interconnectedness of Market Entities increases the risk that a significant cybersecurity incident can simultaneously impact multiple Market Entities causing systemic harm to the U.S. securities markets. (https://www.sec.gov/news/press-release/2023-52)</em></p><p>If your organization is a publicly-traded company in the United States, you will soon be required to report your Cyber Risk and Cyber Insecurity risk management policies, practices, and procedures as well as actually assessed risks to the SEC. The insurance industry is already assessing this in determining what your Cybersecurity insurance premiums will be.</p><p><strong>Cyber Disruption equals Business Interruption</strong></p><p>If you are a senior Digital / Information Technology leader and you are asked the following question:</p><p><strong>“How much security do we need?”</strong></p><p>I would recommend that you change the question narrative to understand your organization’s tolerance for risk. I would answer the above question with the following question:</p><p><strong>“As a business, what can we/you live without?”</strong></p><p>A business leader can not begin to understand why and how much to invest in Cybersecurity to reduce Cyber Insecurity unless they have been provided and understand a comprehensive view of the systemic cyber-driven business risks and the implicit business impact these risks can inflict on business operations today and tomorrow.</p><p>A quick test to determine if your Cybersecurity / Cyber Insecurity Risk Management practices are adequate, ask yourself the following question:</p><p>“When your Threat Intelligence tells you that a Risk Threshold has been reached, who do you tell and what action plan do you implement?\"</p><p>If your answer to any part of this question is <strong>“I do not know”</strong>, then you can be assured that your Cybersecurity / Cyber insecurity Risk Management practices are not adequate to help you protect your organization.</p><p>In my next post, I will provide visibility into risk categories and types, with an emphasis on Cyber Risks and their systemic interconnected with and potential impacts on business operations.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,65,151,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyber Insecurity and systemic Business Interruption caused by Cybersecurity events can no longer be contained by any one company or organization. Recognizing this (at long last) the United States Securities and Exchange Commission issued a press release on March 15, 2023: <em>The Securities and Exchange Commission today proposed requirements … to address cybersecurity risks. Market Entities increasingly rely on information systems to perform their functions and provide their services and thus are targets for threat actors who may seek to disrupt their functions or gain access to the data stored on the information systems for financial gain. Cybersecurity risk also can be caused by the errors of employees, service providers, or business partners. The interconnectedness of Market Entities increases the risk that a significant cybersecurity incident can simultaneously impact multiple Market Entities causing systemic harm to the U.S. securities markets. (https://www.sec.gov/news/press-release/2023-52)</em></p><p>If your organization is a publicly-traded company in the United States, you will soon be required to report your Cyber Risk and Cyber Insecurity risk management policies, practices, and procedures as well as actually assessed risks to the SEC. The insurance industry is already assessing this in determining what your Cybersecurity insurance premiums will be.</p><p><strong>Cyber Disruption equals Business Interruption</strong></p><p>If you are a senior Digital / Information Technology leader and you are asked the following question:</p><p><strong>“How much security do we need?”</strong></p><p>I would recommend that you change the question narrative to understand your organization’s tolerance for risk. I would answer the above question with the following question:</p><p><strong>“As a business, what can we/you live without?”</strong></p><p>A business leader can not begin to understand why and how much to invest in Cybersecurity to reduce Cyber Insecurity unless they have been provided and understand a comprehensive view of the systemic cyber-driven business risks and the implicit business impact these risks can inflict on business operations today and tomorrow.</p><p>A quick test to determine if your Cybersecurity / Cyber Insecurity Risk Management practices are adequate, ask yourself the following question:</p><p>“When your Threat Intelligence tells you that a Risk Threshold has been reached, who do you tell and what action plan do you implement?\"</p><p>If your answer to any part of this question is <strong>“I do not know”</strong>, then you can be assured that your Cybersecurity / Cyber insecurity Risk Management practices are not adequate to help you protect your organization.</p><p>In my next post, I will provide visibility into risk categories and types, with an emphasis on Cyber Risks and their systemic interconnected with and potential impacts on business operations.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,65,248,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyber Insecurity and systemic Business Interruption caused by Cybersecurity events can no longer be contained by any one company or organization. Recognizing this (at long last) the United States Securities and Exchange Commission issued a press release on March 15, 2023: <em>The Securities and Exchange Commission today proposed requirements … to address cybersecurity risks. Market Entities increasingly rely on information systems to perform their functions and provide their services and thus are targets for threat actors who may seek to disrupt their functions or gain access to the data stored on the information systems for financial gain. Cybersecurity risk also can be caused by the errors of employees, service providers, or business partners. The interconnectedness of Market Entities increases the risk that a significant cybersecurity incident can simultaneously impact multiple Market Entities causing systemic harm to the U.S. securities markets. (https://www.sec.gov/news/press-release/2023-52)</em></p><p>If your organization is a publicly-traded company in the United States, you will soon be required to report your Cyber Risk and Cyber Insecurity risk management policies, practices, and procedures as well as actually assessed risks to the SEC. The insurance industry is already assessing this in determining what your Cybersecurity insurance premiums will be.</p><p><strong>Cyber Disruption equals Business Interruption</strong></p><p>If you are a senior Digital / Information Technology leader and you are asked the following question:</p><p><strong>“How much security do we need?”</strong></p><p>I would recommend that you change the question narrative to understand your organization’s tolerance for risk. I would answer the above question with the following question:</p><p><strong>“As a business, what can we/you live without?”</strong></p><p>A business leader can not begin to understand why and how much to invest in Cybersecurity to reduce Cyber Insecurity unless they have been provided and understand a comprehensive view of the systemic cyber-driven business risks and the implicit business impact these risks can inflict on business operations today and tomorrow.</p><p>A quick test to determine if your Cybersecurity / Cyber Insecurity Risk Management practices are adequate, ask yourself the following question:</p><p>“When your Threat Intelligence tells you that a Risk Threshold has been reached, who do you tell and what action plan do you implement?\"</p><p>If your answer to any part of this question is <strong>“I do not know”</strong>, then you can be assured that your Cybersecurity / Cyber insecurity Risk Management practices are not adequate to help you protect your organization.</p><p>In my next post, I will provide visibility into risk categories and types, with an emphasis on Cyber Risks and their systemic interconnected with and potential impacts on business operations.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,65,396,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyb</p>','','full_html'),('blog',0,65,469,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyb</p>','','full_html'),('blog',0,65,549,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyb</p>','','full_html'),('blog',0,65,624,'en',0,'<p>I n my last post I asked the question: Do you know if your organization is Cyber Secure or Cyber Insecure?</p><p>In this post, I will be discussing with you <strong><u>Cyber Risk from the perspective of Business Risk.</u></strong></p><p>Business Risk is the possibility that an event will eventually lead to a reduction in a company’s objectives, i.e. current or future economic profits. Pretty much every business today, from small “mom and pop” businesses, all the way up in size to massive global multinational businesses, has a significant to massive dependence upon their information technology-driven business operations. There is no avoiding the fact that Cyber Risk is a dominant risk category that every business faces. <strong><u>Cyber Risk is one of the few risks which businesses face which have the potential to bring a business to a complete standstill!</u></strong> Ask yourself this series of questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Is this too hard to imagine? Change the questions to something like this:</p><ul><li>Can your business survive a significant shutdown of business operations for 1 day?</li><li>Can your business survive a significant shutdown of business operations for 7 days?</li><li>Can your business survive a significant shutdown of business operations for 14 days?</li><li>Can your business survive a significant shutdown of business operations for 21 days?</li><li>Can your business survive a significant shutdown of business operations for 28 days?</li></ul><p>I have asked this series of questions of business leaders and board members many times. I have never received the following reply in response:</p><p><strong>“We may be impacted for a few days but will be back up and running within 7 days with minimal business interruption and impact.”</strong></p><p>Never! Not once! The response I normally receive from asking these questions takes one of two forms. Either a denial that this could ever happen or a non-verbal response involving a lot of uncomfortable facial expressions and body language.</p><p>My purpose with these questions is to get your attention.</p><p><strong>Cyber Risk is Business Risk</strong></p><p>You do not have to take only my word for this fact:</p><p>The World Economic Forum reports<strong> Widespread Cybercrime and Cyber Insecurity</strong> as the top 10 global risks over the short and long term (two to ten years as reported in the WEF The Global Risk Report 2023 Insight Report).</p><p>The Allianz Risk Barometer 2023, another global industry risk reporting standard finds cyber incidents to be the #1 top risk that businesses face <em>“reflecting the importance of today’s digital economy, the evolving threat from ransomware and extortion, as well as geopolitical rivalries and conflicts increasing being played out in cyberspace. Cyber risk and business interruption (BI) are closely linked with cyber also ranking as the cause of BI (business interruption) companies fear most.” (Allianz Global Corporate &amp; Specialty (AGCS) is a leading global corporate insurance carrier.)</em></p><p>It is my experience that most companies do not typically ignore risks to their business operations. What I have experienced, though, is that most of the companies and leadership teams do not fully understand the cascading systemic risks which Cyber Risk and Cyber Insecurity present to their organizations. Many companies address their risks with a <strong>Governance, Risk, and Compliance (GRC) </strong>approach and support staff, following sound risk assessment practices which result in an annual risk report. GRC practices have matured in some organizations and are addressed via an<strong> Enterprise Risk Management (ERM)</strong> process, often still an annual risk assessment with associated risk reduction and abatement plans. Further, I see more advanced and integrative risk management practices being utilized in an<strong> Integrated Risk Management (IRM)</strong> approach taking a Value Chain integrated business risk perspective more in line with an organization’s extended business operations across business units, support functions, extended supply chains, and customer value chains.</p><p>Best practices in<strong> Integrated Risk Management (IRM)</strong> involve developing a structured and disciplined approach that aligns business strategy, processes, technology use, and knowledge with the purpose of evaluating and managing uncertainties an organization and its value chain faces. IRM categories of risk recognition involve business Strategic Risk, Operational Risk, Financial Risk, and Hazard Risk.</p><p>One of the emerging risk management models which takes a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective can be found in the DIRECTOR™ and RISCX™ Models. The DIRECTOR™ model identifies eight core domains of risk from a corporate director’s perspective that regulate the health and vitality of an organization’s digital ecosystem. The RISCX™ model identifies five key causes of system risk within and across these domains. (Digital Directors Network).</p><p>The eight domains of the DIRECTOR™ model are: Data, Information Architecture, Risk Communications, Emerging Technology, Cyber Security, Third Party, and Operations of IT risks. The key causes of risk failures identified in the RISCX™ model allow an assessment of the systemic nature of a company’s risks from the perspectives of: cross-jurisdictional boundaries (legal, regulatory, geographic), replaceability (of processes, systems, technologies in the event of a disruption), inter-connectedness (of processes, systems, suppliers, customers), size and the overall complexity of organizations. Used together the DIRECTOR™ and RISCX™ model allow a fully integrative view of systemic business Cyber Risk to emerge and become visible.</p><p>The threats that Cyb</p>','','full_html'),('blog',0,66,152,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><p>body { font-family: Arial, sans-serif; } .container { display: flex; gap: 20px; justify-content: center; align-items: flex-start; margin: 40px; } .column { border: 1px solid black; padding: 20px; width: 220px; } .column h3 { margin-top: 0; text-align: left; } ul { list-style: none; padding-left: 0; } ul li::before { content: \"●\"; color: orange; font-weight: bold; display: inline-block; width: 1em; margin-left: -1em; }&nbsp;</p><h3>Strategic Risks</h3><ul><li>Political</li><li>Economic</li><li>Regulatory</li><li>Market</li><li>Reputation</li><li>Leadership</li><li>Brand</li><li>Customer</li><li>Mergers &amp; Acquisitions</li><li>Etc.</li></ul><h3>Operational Risks</h3><ul><li>Human Resource</li><li>Business Process</li><li>Technology</li><li>Supply Chain</li><li>Business Continuity</li><li>Channel Effectiveness</li><li>Customer Satisfaction</li><li>Health and Safety</li><li>Environment</li><li>Product and Servic</li><li>Efficiency</li><li>Capacity</li><li>Compliance</li><li>Etc.</li></ul><h3>Financial Risks</h3><ul><li>Volatility</li><li>Currencies</li><li>Interest Rates</li><li>Commodities</li><li>Credit</li><li>Liquidity</li><li>Market</li><li>Compliance</li><li>Legal</li><li>Etc</li></ul><h3>Hazard Risks</h3><ul><li>Natural Disasters</li><li>Terrorism</li><li>Shooter Events</li><li>Insurable Liabilities</li><li>Impairment of Assets</li><li>Health / Pandemic</li><li>Etc.&lt;</li></ul>','','full_html'),('blog',0,66,153,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><p>&nbsp;</p>','','full_html'),('blog',0,66,154,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,155,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,247,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,397,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,468,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,470,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,550,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,66,625,'en',0,'<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style=\"display:flex;flex-wrap:wrap;gap:20px;justify-content:center;\"><!-- Strategic Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Strategic Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Political</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Economic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Leadership</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Brand</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Mergers &amp; Acquisitions</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Operational Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Operational Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Human Resource</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Process</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Technology</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Supply Chain</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Business Continuity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Channel Effectiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer Satisfaction</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health and Safety</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Environment</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Product and Service</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Efficiency</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Capacity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Financial Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Financial Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Volatility</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Currencies</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Interest Rates</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Commodities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Credit</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Liquidity</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Market</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Compliance</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Legal</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div><!-- Hazard Risks --><div style=\"border:1px solid #000000;padding:10px;width:220px;\"><ul style=\"list-style-type:none;margin:0;padding-left:15px;\"><li>Hazard Risks</li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Natural Disasters</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Terrorism</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Shooter Events</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Insurable Liabilities</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Impairment of Assets</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Health / Pandemic</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Etc.</span></li></ul></div></div><p>&nbsp;</p><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,156,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,157,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,158,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,246,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,398,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,471,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,551,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,67,626,'en',0,'<p>In my last blog post, we explored both the World Economic Forum “Global Risks Report 2023” and the “Alliance Risk Barometer 2023”. A simple summation of both reports is:</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Connectedness is Pervasive</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Cyber Business Interruptions as a result are Pervasive and Impactful</span></li></ul><p>I had planned in this post to explore the notion that we are all Risk Managers, taught by our parents and / or caregivers from the day we are born and to share perspectives on understanding Threats and creating a Threat Catalog. However, I am going to deviate from my plans to provide you with a special update about the July 26th, 2023, release by the Security and Exchanges Commission of their:</p><p><strong>“SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and incident Disclosure by Public Companies”.</strong></p><p>Industry media has been ablaze since July 26th with reactions to these new SEC Cybersecurity Rules. There has been an immense amount of praise, as well as some disappointment, expressed about these new SEC rules. There has also been a significant amount of disinformation published about these “RULES” by quick reactionaries who in my opinion rushed to publish something, perhaps too quickly without fully reading and digesting this SEC Rules release. So, let’s look at the new SEC Rules, because if you are involved in Cybersecurity and / or Risk Management,<strong> this is a big deal!</strong></p><p><strong>What is the SEC’s Goal in adopting their new Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies?</strong></p><p>The goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions.</p><p>From the SEC press release: <em>The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.”</em></p><p><strong>These new rules now require Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b).</strong> Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing<strong> material risks from cybersecurity threats </strong>in sufficient detail for a reasonable investor to understand those processes.</p><p><strong>Materiality</strong></p><p>A shift to <strong>“Materiality”</strong> as a trigger for disclosure will require management, cybersecurity, and risk management practitioners to better understand how the complex digital business systems of today’s companies contribute to business value as well as to systemic risk.</p><p><strong>Disclosure of Cybersecurity Incidents on Current Reports (Form 8-K) ITEM 1.05: </strong>The trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery.</p><p>Disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts, within four days from when it is determined to be material.</p><p>Guidance is provided as to materiality, which is consistent with securities case law. The burden to determine materiality is up to the registrant issuer / company reporting the incident. Under existing case law, information is considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the total mix of information made available”.</p><p>Clarification that disclosure should describe the material aspects of the nature, scope and timing of the incident and the material impact or reasonably likely material impact on the issuer, including its financial condition and results of operations.</p><p>Clarification that disclosure should include both qualitative factors, alongside quantitative factors in assessing materiality, to include but not be limited to:&nbsp;</p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Harm to reputation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Customer or vendor relations</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Competitiveness</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Possibility of litigation</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Regulatory investigations or action by U.S or non-U.S. authorities</span></li></ul><p>Includes recognition that there may be false positives, and an incident originally thought to be material may not be. Includes language that clarifies materiality disclosure to be disclosed “without unreasonable delay” to avoid issuers deliberately slowing a determination to avoid disclosure.</p><p>Recognition that a materiality determination necessitates an informed and deliberative process.</p><p>A new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the Attorney General.</p><p>Systemic risk disclosure that includes material cybersecurity incidents on third-party systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer, or one but not the other.</p><p>Clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats, and clarification that a decision to share information does not itself necessarily constitute a determination of materiality.</p><p>Clarification that Form S-3 eligibility will not be impaired by an untimely Form 8-K filing.</p><p>Form 8-K delay of up to seven days for those subject to FCC notification rule for customer proprietary network information (CPNI).</p><p>No disclosure regarding an incident’s remediation status or if a remediation is ongoing.</p><p>No disclosure of specific technical information about a planned response to an incident or cybersecurity systems, related networks and devices, or potential system vulnerabilities at any level of detail.</p><p>No requirement for additional third-party incident inquires outside of regular channels of communication and third-party service provider contracts or normal disclosure controls and procedures.</p><p>No requirement that the materiality determination be made by the full board, a board committee or one or more officers, but by normal internal disclosure controls and procedures in demonstration of good faith compliance.</p><p>No new rule on insider trading during the materiality determination period.</p><p>Clarification that a data breach or compromise is not in and of itself disclosable, but is a factor in determining materiality, as are other incident types such as losses of intellectual property, reputational damage, or business value.</p><p><strong>Disclosure about Cybersecurity Incident in Periodic Reports (Form 10-Q) ITEM 106:</strong></p><p>Clarification that an updated incident disclosure should be made in a Form 8-K amendment, not on Form 10-Q</p><p><strong>Annual Disclosure of a Registrant’s Risk Management, Strategy and Governance on FORM 10-K -ITEM 106(b):</strong></p><p>Specifically, disclosure now requires a description of registrant’s processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.</p><p>The disclosure focus is recast onto “processes” not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant’s cybersecurity practices.</p><p>Expresses the expectation that the disclosure allows investors to ascertain practices, such as whether there is a risk assessment program in place, with enough detail for investors to understand the registrant’s cybersecurity risk profile.</p><p>Recognizes that processes also accommodate situations where there are not written policies and procedures.</p><p>Provides clarification that processes described should relate to material cybersecurity risks.</p><p>Disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process.</p><p>Disclosure should include whether registrants engage assessors, consultants, auditors, or other third parties in connection with any such process(es).</p><p>Includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.</p><p>Clarification that the burden is on registrants to disclose whatever information is necessary, based on their facts and circumstances, for a reasonable investor.</p><p>Disclosure requires a description of whether any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affect or are reasonable likely to materially affect the registrant, including its business strategy, results of operations or financial condition and if so, how.</p><p>Registrants must disclose management’s role in assessing and managing the registrant’s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise.</p><p>Disclosure of the processes by which such persons or committees are informed about and monitor the prevention, detection and mitigation and remediation of cybersecurity incidents.</p><p>Whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors.</p><p>New disclosures of the board’s role to describe its oversight of risks for cybersecurity oversight.</p><p>Disclosure if any board committee or subcommittee is responsible for cybersecurity oversight.</p><p>Requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks.</p><p>Removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy.</p><p>Eliminates the disclosure of cyber risk prevention and detection activities, continuity and recovery plans, and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details.</p><p>Removed disclosure of whether and how the board integrates cybersecurity into is business strategy, risk management and financial oversight.</p><p>Removed the requirement to disclose the frequency of the board or committee’s discussion on cybersecurity, while acknowledging that this is an observed leading practice.</p><p>Removed disclosure whether the registrant has a designated chief information security officer.</p><p><strong>Definitions and Miscellaneous:</strong></p><p>Cybersecurity Incident is defined as an unauthorized occurrence, including accidental occurrences not triggered by a threat actor.</p><p>Information Systems means any resources owned by or used by the registrant.</p><p><strong>Compliance dates:</strong></p><ul style=\"list-style-type:none;padding-left:15px;\"><li style=\"color:#f58220;\">● <span style=\"color:black;\">Annual reports for fiscal years ending on or after December 15, 2023. (ITEM 1.05)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Current report Form 8-K and 6-K (foreign private issuers) 90 days after these rules are published in the federal register or December 18, 2023, whichever is later (ITEM 1.06)</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or June 15, 2024.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Foreign Private Issuers and XBRL (interactive data format) filings have parallel requirements for disclosures of material incidents on Form 10-F and Form 6-K. Inline XBRL filings have a one-year delay for implementation.</span></li><li style=\"color:#f58220;\">● <span style=\"color:black;\">Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</span></li></ul><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,68,160,'en',0,'<p>My last blog post presented the changes released by the Security and Exchange Commission on July 26, 2023 to their “SEC New Rules on Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure by Public Companies.”</p><p>These changes are quite impactful to Public Companies and their regulatory reporting concerning cybersecurity and have been welcomed by professional practitioners in the cybersecurity fields. Some of us may wish that the SEC had gone a little further in and with their new rules, but …. progress is progress. If you are a member of a private company breathing a sigh of relief that you are not “required” to make such reporting and disclosures, I would suggest that you take a close look at these new SEC Rules and consider how your Cybersecurity practices compare to these “rules” for public companies. I will be coming back to this topic in future posts to explore some of these new rules in more depth. These are just a small sample of things we learn about as children that can harm us or cause injury.</p><p><strong>These are threats to our well-being.</strong></p><p>These four threats are very specific. Each of these threats has a specific range of impacts. We can easily be hit by a car when crossing a street and be injured or killed. Some strangers may wish to do us physical harm. Being struck by lightning will cause grievous bodily harm or outright death. We can easily suffer frostbite or hypothermia and potential death if exposed to cold temperatures for an extended period.</p><p>The specific actions we have been taught as children to avoid harm are very specific <strong>threat avoidance and mitigation actions</strong> we can practice.</p><p>Every time we check traffic before crossing a street or intersection to determine if we can cross safely,<strong> we are evaluating the probability of a potential event, </strong>i.e., that we may be struck and injured by a vehicle.</p><p>Practicing <strong>Risk Management</strong> in our personal lives is no different from practicing Risk Management in our business lives and roles! Risk Management entails:</p><ol><li>Acknowledging that Threats Exist</li><li>Determining the probability that a potential Threat will occur.</li><li>Understanding and assessing the potential Impact of a Threat Event if it occurs.</li><li>Ranking or Scoring Threat Risks for their Impacts (I.E., Probability X Impact = Risk Score)</li><li>Implementing Risk Actions / Plans to avoid and/or mitigate the impact of Threat Events.</li></ol><p><strong>Effective Risk Management requires both Knowing and Doing</strong></p><p>Now, let me circle back to Risk Behaviors. I stated earlier that throughout my career I have been amazed by the disconnect I have seen and experienced between the way we behave in our personal lives as compared to how we behave in our business lives regarding Risk. In our daily lives, we naturally embrace our roles as Risk Managers for our own safety, and the safety of our family members and loved ones. Yet it always seems that as soon as we enter our work environments (in an office place or remotely from home or hotel) we often witness employees, at staff, management, and executive levels, unconsciously ignore or abandon any sense of understanding of Business Risk. Most Risk Event impacts occurring today in business, especially related to Cybersecurity and Cyber Insecurity, occur because individuals did not practice the same level of acceptance and ownership of their roles as Managers of Risk in their business lives as they do every day when they leave their work environments and enter their personal life environments. If we did, no staff member, manager, or executive of a company would ever click on a phishing link, be fooled by social scamming, or not fund mandatory security awareness training and certification for every employee of a company, from bottom to top.</p><p>In my next blog post, it is my intention to explore Systemic Risk in Business with you.&nbsp;</p><p><em>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</em></p><p><strong>Joseph F. Norton </strong>is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),