Cyber Risk Belongs in the Boardroom

Hi, everyone. Welcome back here to Techstrong TV. My next guest is Dylan Sandlin.

Dylan is program manager for digital and cybersecurity governance at NACD. Hey, Dylan. Welcome to Techstrong TV.

It's great to have you on here. Yeah, appreciate it, Alan. Great to be here.

Dylan, let's start with you, and then we'll go into NACD and some other stuff, but give people a sense of your career path, your journey. Yeah. So, as you mentioned, I currently sit as the program manager for cyber and digital content here at NACD, but had kind of a circuitous route getting here.

So my first experience when interacting with cybersecurity and risk management, coming out of school, I started at Gartner, in their cybersecurity and risk management practice, assisting their analysts there, and just digging into as much research as I could, right? Really understanding how boards interacted with CISOs. I had a lot of interactions with the analysts there, understanding what really mattered to the board, and what CISOs should really be telling them, and storytelling to boards about cybersecurity.

So it was my first real interaction with the board and CISO relationship. Found it incredibly fascinating, and then moved over to NACD, where now I really sit at the intersection of that in my day-to-day role, right? But beyond just focusing on the cyber risk side of things, I'm also focusing on how boards are engaging with other aspects of technology governance, whether that's digital transformation, whether that's AI, and the inherent opportunities and risks that come with those technologies.

So, a little bit circuitous, but I've been at NACD for about five years now, and really just focusing on understanding, again, how boards are engaging on the topic of technology governance, whether that's cybersecurity, AI, or digital transformation, and how boards can better help their management teams and better lead their organizations to be more resilient, and towards long-term value creation. Excellent. I love it.

Dylan, NACD. A lot of people are going to shake their heads like they know it, but they don't really know it. Give us the NACD story, if you don't mind.

Yeah. Sure thing, Alan. So, the National Association of Corporate Directors, right?

Who are we? What do we do? What purpose do we serve?

Right? So ultimately, our mission is to serve our members by helping them elevate their board's performance, and oversight of their companies, right? We serve the full range of directors, whether it's from public companies, whether it's from nonprofit organizations, tax-exempt organizations, and private companies as well, across every sector and the economy.

So really, we have the full range of directors that we're serving, and we offer a couple of different things for them, right? We provide educational and thought leadership materials, right? That they can educate themselves to elevate their governance performance.

But we also provide them several opportunities to interact with each other and learn from each other. Right? The networking aspect of what NACD offers is a really big component, and that's where a lot of learning actually happens, right?

Understanding from each other, how did you confront this specific issue, right? That's where a lot of the value of the NACD is leveraged, by interacting with other directors. And we provide that to our members on a regular basis.

So, I sit in the content development, thought leadership side. So I'm focused more on developing that thought leadership and turning that into educational products for our members. But yeah, I would say that that's really the mission that we serve, is to provide the resources necessary for board members to learn about what's best in practice for them across a range of topics, whether, again, there's technology, there's also things like CEO succession, shareholder engagement, board operations, you name it.

Cover the gamut. So, we provide a lot of resources here, but again, our ultimate mission is to help our members provide better governance and oversight for the companies for which they oversee. Love it.

What a great ... Hey, I'm on a board down here, more of an HOA board, but I got to tell you, as a board member, and I have a lot of friends who serve on a lot of corporate boards. It's an honor at some level to be a board member, but it's a task.

It's more than a task, it's a whole bunch of tasks. It's a job being a board member. And especially in today's litigious world, you're always thinking about, did I do what's reasonable?

Because at the end of the day, especially when it comes to cyber and stuff, look, you're talking to someone who went to law school and practiced law. At the least common denominator, the thing every board member has to ask themselves is what you did, was it reasonable? If it was reasonable, generally, you'll be okay, unless there's a specific thing.

But that, to me, is the bedrock of this, and you build from there. Okay, I did what was reasonable. Now, were there specific rules of behavior, rules of engagement, statutes, regulations that needed to be followed?

And you got to follow those as well. But, a lot of it, it doesn't come with an instruction manual or a how-to, and you rely on someone who's already been there a while, and it is what it is. Let's put it that way.

But Dylan, cybersecurity at the board level is a whole different thing, right? There was a time in my career when I was a security vendor. I co-founded a few security companies.

And back in those days, you were selling FUD Fear, uncertainty- Right ... and doubt. I had friends who'd go up to the board and say, "Hey, how do you look in stripes?

" This is back when Gramm-Leach-Bliley came out, and some of the older regulations and statutes. Hopefully, we're not selling FUD anymore, but cybersecurity is much more of a board-level issue now than it was back then. Right?

Governance, resilience. Absolutely. And then at the end of the day, cybersecurity is always, especially at that board level, business level, it's been about risk management.

Right? It's not about necessarily making yourself bulletproof and handling every single cyber risk or cyber threat. It's about risk management.

And that's how the board has to look at it. Talk to me about... And then we got to look at this, obviously, Dylan, through the lens of AI because it's changing everything, right?

Right. Talk to me today about what it is to be on the board today and dealing with cybersecurity at this level. Yeah.

Well, Alan, I think there's really been a cultural shift within the boardroom community pertaining to technology risk. We performed a commission a couple of years ago where really the major outcome of that was board members recognized that honestly not taking risks with technology is pretty existential. You need to be willing to take risks in technology to be successful and competitive in today's marketplace.

Technology is a fundamental driver right now of business model success. But coming with taking risks with technology, you have to actually protect against those risks. If you're going to assume the risk, you have to mitigate and protect against it.

And that's where the cybersecurity conversation comes into it. It's at a much more strategic level now than it is from a purely risk management or compliance exercise like it was previously. And getting to your point around fear, uncertainty, and doubt, I think there's still a lot of that that exists because it's an incredibly evolving space.

" Because if it's not linked to strategy, you're having the wrong conversation around cybersecurity, and board members have recognized that. So that's the strategic element. But then you mentioned reasonableness.

There's the fulfilling your fiduciary obligations. There's making sure that you're doing what's necessary to fulfill your duty of loyalty and duty of care to the organization. And oftentimes, that does look like risk management.

But there are now greater expectations on boards to have a line of sight on this risk, whether it's the SEC's new rules about disclosure of material cyber risks. But that stems from a recognition that cybersecurity incidents can pose a material risk to the organization that investors want to know about. And so making sure that the board understands that risk, is able to communicate it effectively, and is doing what's necessary from an operational standpoint, and that management is doing what's necessary, has really forced the issue and made cybersecurity a frequent topic of conversation.

We get survey data from our members that shows that cybersecurity is regularly a top five issue that they're discussing every single quarter. And that's alongside things like AI, shifting economic conditions, geopolitical uncertainty. It remains a very important topic that board members are engaging with very regularly.

I agree. And it's more so, as I said, I've been in security 25-plus years. I've seen this where, look, when I first got involved, it wasn't normal to have a CISO.

No, actually, there was no CISOs, so I get it. We didn't have CISOs 25, 30 years ago. I've seen security steadily rise up, first at the executive level and then up into the board level.

It used to be that it was all just managing risk was a CFO function, and it all laid under there. We didn't think of it as a technology issue. It was just managing risk.

And quite frankly, there were a lot of companies back then that, hey, they just built a 5% buffer in for security incidents, and that was managing risk. That's what they deemed as reasonable. You couldn't argue with them.

It was in retail, in the retail industry, for instance. 5% loss when e-commerce first started popping up. So we have seen it.

But there's a couple of reasons, Dylan. Number one, the amount of risk from a dollar point of view is catastrophically rich. It's just way, way up there.

Number two, again, depending on the vertical, if you're in critical infrastructure, you can't afford. You're managing healthcare, you can't afford it. You're managing financial information, you can't afford it.

And so vertically, we've seen risk in cybersecurity become much, much more important than it was in other years. But One of the lessons I think we learned during COVID, everybody's subject of a target. Everyone's target as for ransomware or something like that, and it doesn't take much.

We've seen companies actually have to shutter their doors and close down- Mm-hmm ... over this. So it absolutely is a real thing.

But let me give you a flip side, Dylan, and ask your opinion on this. The way I've seen boards operate is there's always a certain amount of people on the board who say, "Oh, I don't know nothing about cyber, let alone technology. I'm here on the business side of the house," or go to market or what have you.

"I'll leave that to the CISO. " And they think by doing that, by not getting involved, somehow they are not shirking their responsibility, but by not getting involved, they're not taking on the responsibility, let's say. Right.

But that doesn't fly at the end of the day. As a board, you're still responsible, right? Absolutely.

When it comes to whether or not it's determined that a board fulfilled its obligations to oversee this risk, right, it's going to be yes or no. Did you do it? Did you not?

Right? And who specifically was asking the right questions, right? It's just a question of whether you were, whether you're documented, whether you have it written down and established in policy, and whether you're testing it.

Right? And so, I like to think of good governance in this space as three legs of a stool that's supporting it. And the first and foremost is the personnel, right?

The composition of the board. If you don't have the necessary fluency and understanding of this risk, you can't oversee it, right? It's difficult to oversee something that you don't understand, right?

Complementing that is the actual structure and operations of the board. Do you have the right committee structure? Is responsibilities for overseeing cyber risk properly delegated to these committees, right?

And are you overseeing cybersecurity at the right level within a committee versus at the full board level? Right? So that's the second aspect.

And then the third is reporting, right? Are you receiving the right information from the right individuals via the right channels at the right time to make sure that you're informed and making proper decisions surrounding this risk area? All three of those things are necessary for proper oversight of this risk area, and none of them are sufficient in and of themselves, right?

But together, if you can answer affirmatively that we have a board composed of individuals that both matches the criticality of the risk for our organization, but is also aligned to its strategic objectives, you're doing that right. If you can answer affirmatively that, yes, we have architected our board via its committee structures and how it reports out, that we're addressing this in the right way and we're receiving the right information, you're probably already 80% of the way there, right? To good governance of the space.

You need all three. Right. But, as this risk area continues to evolve, boards need to continually assess whether or not all three of those things are fit for purpose, right?

Whether it's the composition, whether you might need more, a director with additional skills or expertise in this area, whether you need to supplement your board's current expertise with outside experts, whether you need to hear more routinely from the CISO or the CIO about this risk. All those things can add to elevating that fluency component. But, again, that's only one aspect of it.

If you're not properly architected, if you're not hearing from the right people, and if your management team isn't properly set up with the right skills either to address this, right, you're not fulfilling those fiduciary obligations, right? And I would say we've seen a lot of progress in this area, but I do think that moving forward, given the significance, right, and the importance of technology as a center of value creation for businesses moving forward, that fluency piece, right, board expertise and understanding of this area is going to have to continue to improve, right, to match the level of risk and to match the level of importance that technology is for these companies. It's not something that can remain static.

It has to continually evolve. And the speed of these threats is going to force the issue, I believe. Oh, yeah.

It's AI scale, right? AI scale is velocity- 100% ... versus just the surface area, if you will.

Hey, Dylan, we're almost out of time, but for people who either maybe serve on boards or are interested in this subject, what's the best way to stay in the know? Yeah. So NACD offers a number of different resources for board members and directors who are looking to elevate their knowledge on this.

We recently published our Director's Handbook on Cybersecurity Oversight in its fifth edition now. You can see it right there. So that has the most up-to-date, best-in-class, best practices for boards looking to align their board's oversight of this area with best practices.

We also offer a range of educational resources that are routinely updated. So NACD's website hosts all of these on our website. If you're interested in becoming a member, you can go to our website and reach out there.

We'd love to get in contact with you. I love it. The website is?

org. There you go. Hey, Dylan, thanks for coming here on Techstrong TV.

We appreciate it. Keep up the great work, man. Excellent.

Appreciate the invitation, Alan. Love doing this. All righty.

org. Was that right? Yes.

Got it. All right, Dylan. Thank you.

We'll be back with more Techstrong TV in a little bit.