The CEO’s Digital Vision Matters
The CEO role is changing and arguably continues to evolve as new digital technology innovations lead to changing customer and stakeholder behaviors. The CEO’s digital vision says a lot about the direction of the organization.
This article is the first in the series of three articles that are designed to equip board directors with three distinct, meaningful and actionable insights outlined below:
Three distinct insights are:
The CEO’s digital vision sets the direction and the future of organization.
The success of a digital vision requires deliberate action by the CEO even if the CIO plays an active role
Deliberate action by the CEO is required even if the CIO plays an active role.
CEO priority considerations for developing a digital vision.
Transition to adaptive challenge ——.
First, it’s important to distinguish between the technical challenge and the adaptive challenge so we can establish common ground and alignment of terms because these two challenges call for very different types of solution strategies.
The CEO’s digital vision sets the direction and the future of organization.
The first step in developing a digital vision is to define a vision for the organization. Having a digital vision without an actual organizational vision will produce mixed results at best.
Defining a shared, clear and compelling vision of the future of an organization is the most important element of the CEO’s job in setting a direction for the organization. A shared vision is one that all relevant stakeholders can relate to and is or can be personalized to their specific role. The vision provides clarity about where the organization is going and this makes the job of getting there easier than if there were no intentional vision. The following statement shared by David Novak (Chairman & former CEO of Yum) in his book drives this point home. “A road to nowhere is hard to build” His vision/passion during his tenure as to put a yum on people’s faces around the world.
By vision, we don’t mean a vision statement. We mean seeing a future state for your organization in your mind’s eye and galvanizing relevant stakeholders around that vision so it becomes a shared vision. We also don’t mean a financial target or goal (e.g. increase net income by 10% in the next 3yrs) when we use the term vision. Another good example comes from Bill George (Medtronics) - restoring people to full life and health.
Once a vision for the organization has been crystallized, then a digital vision can now be developed. A digital vision is seeing how digital capabilities can help accelerate or advance towards the shared organizational vision. In some cases, the digital vision becomes the organization’s vision and in other cases it’s just a critical component of it. In either case, when the CEO plays the leading role in setting the digital vision, there’s a greater chance of success as opposed to when the CEO delegates this leading role/activity to the CIO or other C-suite executive.
CEOs don’t have to be technology experts but do need to know enough about digital capabilities that will help with value creation for their stakeholders.
The four characteristics of a digital vision - modeled after David Novak
The following are four general principles that should be carefully considered when developing a digital vision and some of them should be integrated into the digital vision itself.
The digital vision should work for customers and future customers in a way that’ll also work for the organization in service of the shared vision. Working for customers means it must seek to create value for customers, non-customers or future customers, by solving a challenge for them. It should focus on helping them make progress with whatever jobs they’re trying to get done. It should also represent a positive future state and experience for customers. The vision should also work for the organization - example of WHO Information management story - Stephen Denning
It should reflect who the future or next generation of employees of the organization aligned with the new digital vision. What skills, digital capabilities will be required and what will the benefit to employees look and feel like. It should think through creating a digital environment and culture that will attract and retain the next-generation of employees
It should be informed by market trends, current and emerging digital capabilities and the implications on the future competitive landscape. CEOs should ask who the organization’s future competitors will be and should capture these elements as a compelling story about the future state.
The digital vision should also be dynamic and flexible, able to change in accordance with changing customer behaviors, digital innovations and market trends.
Example of digital vision and applying these principles to the Yum organizational vision stated above.
Let’s go back to vision passion of Yum which is to put a yum! on peoples’ faces around the world. How would a digitial vision aligned to this organizational vision look. Well, in simple terms it would envision how current and emerging digital capabilities could help bring this vision to reality on an on-going basis. It would leverage digital technologies and processes to put a yum! on peoples’ faces. Examples of digital capabilities that could applied in different ways include digital twins for restaurants, virtual kitchens, delivery options, and more to enhance the experience for customers. It would also paint the picture of the digital culture for employees and next-generation talent. Although these are some of the details that inform the digital vision, the expression of this digital vision should be simple to communicate. In our example, the digital vision could be as simple as Experience Yum! when, where and how you want. The underlying capabilities that make that digital vision a reality are the elements we described above.
gine you’re the CEO
Although technology and digital capabilities inform the digital vision, they are not explicitly included in it.
Deliberate action by the CEO is required even if the CIO plays an active role.
The three value dimensions of digital mindsets that influence the digital vision of an organization.
A number of CEOs may not see themselves as digital natives and they may not think they have a digital mindset. A digital mindset is a way of thinking about how to leverage digital capabilities to create value for all stakeholders of an organization. This way of thinking naturally influences actions (is informed by values). As a man thinketh, so is he. Combined with values the digital mindset helps executives visualize future possibilities that align with their corporate vision. If you have asked someone that was in the digital technology space a question like this “ Can predictive analytics help with preventive maintenance?”, then you’ve experienced your digital mindset at work. This question is informed by a digital mindset and it’s a crucial element of creating a digital vision. However, all digital mindsets are not created equal. Different digital mindsets generate different value creation potential.
We believe there are three main value dimensions associated with the three most common digital mindsets. These are:
Sustaining Value ( Keep The Lights On Mindset) - This value dimension focuses on doing the bare minimum with existing digital technology capabilities to keep the business running and operational. Digital and Information Technology is viewed as an operational necessity and some CEOs see IT as a cost center and necessary evil. This digital mindset seeks to protect the organization’s existing value. It is typically characterized by a low digital literacy culture and company employees including their executive leaders are somewhat fearful of technology. They may often say something similar to this “I’m technologically challenged”. You may have heard some CEOs say I just need someone to help keep IT running. They abdicate (not delegate) IT responsibility to the CIO or outsourced provider. They value IT not for customer value creation but for operational efficiencies only. There’s nothing inherently wrong with this digital mindset if the vision of the organization is to preserve the status quo. We would argue however that if this is the sustained prevailing mindset then the technical debt of the organization will continue to increase year after year until it becomes too heavy a burden. Climbing out of this type of technical debt or hole is a lot more challenging than adopting a more strategic digital mindset. Infact, we believe that this mindset is an indication that there’s no clear and compelling corporate vision and the strategic direction is to keep doing what we’ve been doing.
Strategic Value - This value dimension is when IT is treated as a strategic asset for value creation within the organization. Execuitves see that IT can help drive new customer experiences and value delivery models. CEOs may delegate (not abdicate) IT responsibilities.
Transformational Value: This is when leaders view digital capabilities as having transformational value in changing current business models or developing new ones. This is not as frequently occuring as the other two value dimensions. A good example is Adobe moving to a subscription based model for its offerings based on consumers digital capabilities. Why do we care? CEOs should develop their digital mindsets with a heavy concentration on strategic and transformational value instead of the operational. This is very difficult to do when leaders don’t have the inherent skills. They don’t have to be experts in digital or technology but understand the value to be derived from the capabilities.
Next Time: Four Things CEOs can do to develop the right digital mindset and digital vision
Prioritize understanding and anticipating market trends and digital capabilities. How? Excerpts from CEO goals.
Be transformed by the renewing of our minds. Innovation pipeline, etc. Focuses on the future.
Collaborate with digital experts. Cultivate relationships with digital experts.
Ideo visits is a good example.
Be transformed by the renewing of our minds
Culture of psychological safety
Learn about digital
This is very difficult to do when leaders don’t have the inherent skills. They don’t have to be experts in digital or technology but understand the value to be derived from the capabilities.
Adaptive Challenge - This is one of the most interesting and significant leadership principles to be mindful of and it’s the source of a multitude of unexplained leadership failures and challenges. The concept of adaptive and technical problems is best illustrated using a simple yet powerful story that shows what can happen when leaders mix up the two.
Imagine you’re the CEO of an organization and have had some less than perfect history with your CIO regarding her performance. One of the critical enterprise projects that she’s leading keeps getting delayed over a couple of years and finally, the board begins to lose confidence in her. You’re strongly encouraged to make a change to ensure the project is no longer delayed and can be “successfully” completed on time.
Given her performance history, you agree with your board and make the difficult leadership change. To be clear, this a difficult thing to do, not exactly easy to tell your senior executive that another senior executive will be replacing her role on the project even though she still has her job as CIO (at least for a while) and is still expected to support her replacement.
After changing the project leadership to one of your top performers that has a proven track record of success with large enterprise projects, something very strange happens. You still have problems with the project, though these are different and sometimes new problems, but you still continue to have repeated problems with the project. Yes, the project is no longer delayed but now after completion, you have customer satisfaction problems and a host of new issues and an ever growing list of problems continue to emerge. You and the board are perplexed and continue to attribute these problems to poor decisions of the CIO, who has now exited your organization. So, what in the world is going on here?
You and the board thought that changing the project leadership would resolve the problems. You and the board thought you were dealing with a technical problem when in fact you were dealing with an adaptive challenge.
You failed to start by asking a fundamental question and instead started with a problem, one that wasn’t well defined. The assumption was, this leader said the project would be complete last year and it’s been two years of repeated extensions. This leader cannot deliver and that’s the problem, change the leader and all the problems go away. It’s important to note that there are definitely situations when and where this is the case. However, without first taking the time to understand what’s really going on, changing the project leader will work for a while until new problems emerge. By then, significant consequences have occurred with external stake holders. Success wasn’t clearly defined - is on-time completion more important than excellent customer satisfaction?
Sometimes you can’t uncover the adaptive challenge until you’ve tried to solve the technical problem and often times, both are blended together and/or the evolve over time. Either way, they require different solution approaches. In this example, what the CEO was really facing was a combination of talent, culture and leadership challenges. An adaptive challenge is non-linear in this very way. Solving one problem doesn’t do much to sustain the solution over time.
There are several other examples that you can come up with but we’ve listed some that we’ve experienced
Examples include
Three Practices That Can Help: So what can leaders do to avoid making the error of treating an adaptive challenge as a technical problem? There are three main practices that can be helpful from our perspective
Start with a question and not a problem statement. Start diagnosis of a situation with a question
Recognize that a quick fix and a quick win are not the same thing. It sounds obvious after the fact but this mindset is very common in operational get-it-done environments.
Seek multiple and alternate perspectives in high impact or magnitude circumstances and situations.
Start with a question and not a problem statement - Problem statements by definition assume that a clear understanding and definition of the problem has already been established. And that the only thing left to do now is to come up with the right solution that addresses the problem. This is not always (indeed rarely) the case for senior leaders and executives operating within complex environments and situations.
What often happens is that one or two people have observed symptoms of a deeper or larger problem and have then assumed or concluded that they understand the problem. In our scenario above, a few leaders (CEO, board and other senior leaders) observed repeated failures to meet project deadlines promised by the CIO and concluded that she must be the problem why the project hasn’t been successfully completed. When infact she was a symptom of a much larger problem. For sure, she was underperforming in her role in leading the project but she herself, her actions, behaviors and poor results were an indication of a larger talent, leadership and culture challenge across the entire organization.
Starting with a question would have been a better approach to really isolate and define the real problem. The leaders could have asked:
Do we really understand why the project delays are occuring?
What do we know about the challenges the leader is facing on this project? Does she have enough resources and/or the right resources?
What does success really look like for this project? Is on-time delivery within the budget the right measure of success?
How can we get a better understanding and clarity about what’s going on with the project?
It’s important to note that candid answers to these questions may be difficult to get, depending on who’s actually asking the questions and the culture and environment of the organization. In a culture that’s absent psychological safety, superficial positive answers to these questions may be provided and that in itself will skew the decisions made based on the responses. The point here is to make every effort to perform the appropriate level of due diligence to get to the right answers as opposed to trying to get a quick fix to the problem.
Recognize that a quick fix and a quick win are not the same thing. It sounds obvious after the fact but this mindset is very common in operational get-it-done environments. - Begin tomorrow
Solving a technical problem instead of the associated adaptive challenge can lead to worse outcomes than you started with
The adaptive challenge may often be buried within a technical problem. Solving only the technical element of a challenge only leads to a false sense of progress or resolution as illustrated by the following example.
Consider the following example. Problem Symptom - As CEO, you observe that the sustained performance of your sales leader over time is mediocre at best. After repeated talks for him to improve his results, you decide to solve the problem
Solution - You replace your sales leader and viola! problem solved. Sales numbers and profits improve and the board of directors is ecstatic with the sales results, for a few years.
Recurrence - Unfortunately, the sales leader decides to exit your organization because he wants to continue to grow professionally. Upon his exit, the sales numbers slump and well, you look to hire a replacement leader from the outside and the cycle repeats.
A similar cycle repeats itself in the operations and finance functions; non-performance by the respective functional leader motivates the need to find replacement leaders from the outside. The new leaders improve the performance results for a while (a few years) until they exit the organization for better opportunities and again new executive leaders are brought in from the outside.
Some readers may say and believe that this is just the normal cycle for executive leaders and that this is normal and organizations just have to live with it. However we believe this is a classic case of an adaptive challenge that’s buried within a technical problem. The technical problem is poor leadership performance at the respective functions and the solution or quick fix to that is to hire a replacement. However, the adaptive challenge, which requires learning and more time is to seek to understand why there’s a lack of leadership competency and capability within the organization. In other words, is a leadership bench required and if so, why doesn’t one exist? A potential solution to this problem could be instituting a leadership or organizational development initiative which requires learning and takes much more time than just going outside to hire replacement leaders in the short term. However, such solution will have both cost and culture-based advantages with compounding benefits over time.
Other examples, Wells Fargo…etc.
So What, Now What - How to solve this problem of technical and adaptive
So how do we deal with situations and circumstances that present the combination of both technical problems and adaptive challenges. We believe the following three actions/practices will help avoid the common error of implementing a technical fix in response to an adaptive challenge.
Redefine & Reframe The Problem: One common reason leaders are unable to uncover adaptive challenges is because some times the problem has been defined for them. You may have heard the statement from a leader that says “if you bring me a problem, then make sure you have a solution with it”. If it’s a pure technical problem, then the subordinate’s solution may work. However if an adaptive challenge is buried within and/or blended with the technical problem then expect temporary results to be followed by more problems. Example problem - our current software features can’t support new critical requests from the business functions. The solution is to upgrade our current software platform. Sounds like a technical problem with a technical solution, right? Get the experts in to upgrade the software so we can start supporting these new critical business requirements. It won’t be easy or a slam donk but we have a clear line of sight. However, the real adaptive challenge here is changing the hearts and minds of the organization to effectively use the new platform as opposed to the old one. It’s infact a transformation project that will undoubtedly take longer than anticipated if viewed as a technical problem.
If the senior executive is able to refine and reframe this problem they’re likely to get a clearer picture of what it takes to make such an initiative successful. How to do this? The leader has to clearly refine the problem by asking the right questions that go beyond the problem definition from the subordinate. Do we need to prepare the organization for this change or is it limited to just parts of the organization? What are the talent needs for this new platform? Who are the critical chain resources for this project and what else will they be involved in at execution time?
The problem also occurs at the board level. One example is when those with authority incorrectly define a problem. Case in point. The board chair of an organization informs the CEO after an executive session that the board believes she should make a leadership change to solve the problem with a specific business function. The tone from the board chair basically signals that if this change isn’t made the CEO may lose her job. If the CEO accepts this recommendation without deeply investigating and reframing the real problem then the leadership change will yield only temporary results.
This may have the unintended consequence of subordinates bringing the leader technical problems (and technical solutions) and excluding the adaptive challenge that often times is surrounding the technical problem
Other times, it’s in fact the leader is the one that incorrectly defines the problem for her subordinates to solve.
Expand Leadership Tools/Capabilities - Often times adaptive challenges require learning new skills and competencies to understand the true nature of the problem and then to analyze potential solution options. You may have heard it said that to a man with a hammer, every problem looks like a nail. This is true when leaders only have a small set of tools (a hammer) in their existing repertoire or toolbox. By working to continually expand the tools in their toolbox, leaders are better positioned to address adaptive challenges. Leaders are learners and should learn as much as they can. Even if you’re not facing a specific situation yet you may have to deal with it in the future.
Refine Your Perspective - Get On The Balcony - When running day to day operations, it’s incredibly difficult to make the distinction between technical and adaptive elements of a challenge. When we’re in it, it’s near impossible to see it. The idea/notion of leaving the dance floor to go up to the balcony and gain a different perspective away from the day to day action is very helpful. Another way to refine perspective is to seek external and independent perspectives outside the organization
Technical Challenge: Compliance with the new SEC cyber rule can be regarded as a technical challenge; meaning, the solution to the challenge is known, direct and within the scope of the current capabilities of the board. Although some changes may be required by the organization, relatively fewer changes are required by the board for compliance. When it comes down to it, the boards of most large organizations will ask management to ensure they’re ready to comply with the new regulations, get a couple of updates on preparedness and move on to “higher priority” items (e.g. M&A, business strategy, etc.) on the board agenda. So yes, compliance in this context, is a technical challenge. And this challenge, for a lot of organizations, may itself be a heavy lift.
When some underlying or structural elements are not being proactively addressed or when they’re not being addressed adequately then repeated incidents may occur. This becomes especially true if industry competitors are not having recurring or repeated incidents.
The Adaptive Challenge
First, it’s important to distinguish between the technical challenge and the adaptive challenge so we can establish common ground and alignment of terms because these two challenges call for very different types of solution strategies.
Technical Challenge: Compliance with the new SEC cyber rule can be regarded as a technical challenge; meaning, the solution to the challenge is known, direct and within the scope of the current capabilities of the board. Although some changes may be required by the organization, relatively fewer changes are required by the board for compliance. When it comes down to it, the boards of most large organizations will ask management to ensure they’re ready to comply with the new regulations, get a couple of updates on preparedness and move on to “higher priority” items (e.g. M&A, business strategy, etc.) on the board agenda. So yes, compliance in this context, is a technical challenge. And this challenge, for a lot of organizations, may itself be a heavy lift.
Adaptive Challenge: However, commitment to the new SEC cyber rule is really an adaptive challenge. An adaptive challenge is one that requires a solution that does NOT exist within the current scope of capabilities and requires a stretch. It requires a deeper perspective that concentrates attention at the root of the challenge to minimize or avoid variations of the same problem from recurring in unexpected ways. The solution to this adaptive challenge reflects a commitment to the spirit behind the regulation and to cyber risk implications for customers and investors and it is a different challenge altogether from the technical challenge. It’s a heavier lift and a higher standard with potentially higher payoffs.
It is different because it can’t simply be solved by asking and validating that management is prepared to comply with the new regulation. The solution requires board directors to step out of their current scope of capabilities and overcome some of the constraints to engaging with the current and emerging cyber risks facing their organizations. This is an adaptive posture for the board that evolves, adapts and changes with the changing and dynamic needs of the business and the cyber threat landscape. It’s a heavier lift and a higher standard with a solution that potentially has a higher payoff.
The adaptive challenge for board directors emerges from the difficulty in providing oversight in the face of of the three fundamental constraints of time, expertise and will. Some questions to help you identify the impact (if any) of these constraints include:
Security strategy allows contractors to work remote with productivity gains
Speed - operational speed
Drive down insurance costs
HR was a cost center but now with TSR is a strategic lever. Supply chain was a cost center and is now strategic, (e.g. UPS using AI DeliveryDefense as a differentiatior, customer service call centers? the same thing
Cyber helps you see IT and profit levers - identifying new (business) strategic opportunities
Generate strateic value from cyber. Build cyber capabilities as a strategic value engine
Can a robust and effective cyber security capability create new value for your business; new value proposition for customers or other competitive advantages resulting from operational velcoity? Most of us are doubtful that this is possible because cyber has traditionally been viewed as a cost center and not a profit lever. We’ve historically viewed cyber and IT in a support role/function (vs a core function) that’s somewhat necessary for doing business.
However, in the digital economy, cyber and IT are no longer support functions but are core to the business. Some organizations have not made this shift in mindset yet and understandably so. Because it’s not easy to change mindsets unless there’s a compelling event that forces us in the direction of the mindset change that we should have found ourselves (i.e. absent the event).
Yet there’s a significant benefit if we can make this change from cost-center to profit level without experiencing a compelling event (e.g. data breach, material incident, new regulation, etc.) To implement this change in mindset we’ve outlined some foundational principles and philosophies that are worth considering
Mindset: Out of a single mindset flows a thousand different behaviors. If you view IT and cyber as something to keep the lights on then its difficult to see the opportunities it has to make material contributions to the bottom line. Recognizing that this shift needs to happen is the first step and it begins with the CEO. The CIO and CISO can help but ultimately the CEO has to sustain this perspective for the long-term benefits to be realized
1. Redefine How You Look At Cyber & What You See
An adaptive challenge is often disguised/cloaked as a clear technical problem.
Solving a technical problem instead of the associated adaptive challenge can lead to worse outcomes than you started with
How do you begin to solve the adaptive challenge?
Some organizations look at cyber risk as something that can be outsourced or transferred to cloud providers and/or managed services-security providers (MSPs). Still others only look at or see what they can get away with or without doing. They concentrate on doing the bare minimum to avoid or manage future cyber trouble. And again, it’s hard not to have this view point/mindset. Very smart leaders arrive at these behaviors based on their view that cyber is really an operational necessity to deal with as efficiently as possible.
The problem with this view of cyber is that it often fails to uncover the true and hidden business potential of cyber capabilities. It’s like those companies years ago that had a similar view about Information Technology (IT). Arguably, some organizations still have this view about IT. They maintained that IT was just a necessity and leveraged IT primarily from an operational cost-center view point to help with employee productivity. The same could be said of the HR function and capabilities, most looked at HR as the function to handle employee onboarding and benefits as opposed to leveraging HR as a strategic talent capability for the business
This sight problem is not limited to just business functions within organization but extends to entire businesses and industries as whole. For example, some CEOs said we’re in the train business and not the transportation business.
It’s difficult to look at cyber and see anything but a cost center to minimize risk. It’s difficult to uncover the hidden potential of cyber but it’s possible and those who can maintain a broader perspective can expect to reap significant rewards when they do so.
We, you, won’t see the innovation opportunities unless you look for them and redefine how you look at cyber
Transition to: Cyber can be a strategic profit lever and value driver if and when leaders become intentional
2. Cyber As Strategic Value Driver
Cyber can be a strategic profit lever and value driver if and when leaders become intentional
There are different elements of strategic value creation for businesses and these include:
The strategic value driver of cyber is often overlooked or neglected by business leaders as we’ve outlined above because there’s a central focus on risk mitigation and rightfully so. However, the hidden potential and opportunities remain buried for most organizations. So what are these opportunities? There are several but here we focus on four essential strategic opportunities to consider:
New revenue-creation opportunities
Cost efficiencies
Operational Speed
Consumer/Customer trust
R It means proactively demonstrating cyber trust signals that stakeholders, including customers, value. It’s important that stakeholders value these signals and their underlying value. Otherwise, this will be ineffective. The concept of non-cyber trust signals and markers is used in a variety of industries, services and products today already. These include USDA, FDA, FDIC, Visa Secure, Bond ratings (Triple AAA, etc.). Hyundai used warranties effectively as a trust signal/marker to elevate the brand recognition.
Business customers may value this more in making a selection for their service providers, etc. …include Examples
Move to conclusion and wrap up
Operational Speed / Velocity - Speed To Value
Develop learning strategies
Apply growth mindset and principles to the challenge
Implement new value shifts and leadership transitions
Model the mindset for other members of the leadership team and even the board
Competitive
3. Board Engagement
Engagement
High level of engagement looks like what? Low level of engagement looks like the board session described earlier in the article. Once you have board leadership and the right focus, you have the foundation for having and sustaining a high level of engagement during a board briefing but it doesn’t happen automatically or without being intentional about it.
High levels of engagement on cyber creates a high level of effectiveness in the board room. The ingredients (in our view) of great board engagement include:
Digital & Cyber Expertise
Effective Communication
Good Relationships with Management
Digital & Cyber Expertise - Board members should be deliberate about increasing their knowledge and expertise in digital and cyber risk/security. This begins with intellectual curiousity about the benefits and risks of digital capabilities. Several board directors are naturally curious about a lot of topics and cyber and digital should be no different. There’s often some trepidation and anxiety for directors that believe they’re not tech savvy and are intimidated by the technology. But this should be an excuse to resign or neglect the required efforts to be at least curious about the benefits and to have a basic understanding of the implications . The goal is not to be an expert but to at least be able to carry on a meaningful conversation (at a dinner party if need be). We beleive this can be done and it can also be incredibly effective and fun for directors.
There are several ways to acquire expertise ranging from independent reading of cyber articles in board-focused publications such as the NACD, Directors and Boards, PDA, etc.) to more formal training courses such as the MIT courses. But where to begin. We suggest hosting a board learning clinic focused on cyber and the organizational cyber risks and challenges. This allows board directors to learn through meaningful stories and experience the learning collectively as a board. In this group format (in person preferrably for the first), questions from one director will trigger other thoughts from others and build on each others’ understanding. It can also be directed to the organizational struggles and provide context, etc.
Effective Communication - The next ingredient is effective communication, which is a lot of listening and asking questions. There’s a tendency for some board directors, ourselves included, to want to speak instead of listen. Instead of listening intently with our ears, eyes, heads and hearts, we try to focus on our point and what we want to say. But listening is what’s really needed for high levels of engagement. Humble inquiry is the mental frame of mind or model that should be employed here. For example, managemnet or cyber chief shares with the board that a 3rd party parter had a cyber incident but that some of the organization’s customers and suppliers may have been impacted but the organization itself was not impacted and hasn’t really suffered any material attack or data breach.
Aft first glance, it seems there’s no major action for the organization or the board, other than ensuring the organization is not vulnerable to the same thing as the the source of the incident at the 3rd party. Some questions to ask here include
If customers are impacted, does our cyber insurance policy cover these types of incidents and related remediation efforts that may be required?
What proactive steps can the organization take?
How does this incident potentially affect our brand or product launch?
Management Relationships - The last ingredient is to cultivate good relationships with cyber / digital chief. This is important for two main reasons. First it provides a baseline to ask tough questions in the boardroom without the cyber/digital chief thinking and felling they’ve been unfairly targeted or mistreated. When management officers know that board directors care about them and that they are genuinely interested in their success as well as the success of the organization, it makes a difference. Management wants the board to be engaged and they’d like to receive the benefit of an outside view and independent perspectives. Without such relationships, the psychological safety required in the boardroom required to actively and proactively engage is limited at best.
This relationship also provides learning for the directors and this in turn increases their confidence in dealing with digital and cyber topics and the value they can add and provide to the organization. How to cultivate these relationships? There are several ways to do this including :
X, Y and Z
But we recommend a simple informal method, one-on-one lunch
Commitment
Decisions
Clarity : Clear Outcome or Objective
Board Leadership Commitment
Engagement
A - Engagement : A great briefing has an unmistakable energy of engagement displayed by a majority of board members. You can feel the progress in the boardroom. Discussions, though cyber focused, inevitably connect with critical business strategy elements of the business. And this is why even directors without cyber expertise can engage passionately in the discussion. For example, a cyber briefing could be discussing the primary risk of business disruption by bad actors and the impact to the business and not just that the cyber team stopped a certain number of ransomware attempts
Talent - or talking about attracting and retaining cyber talent which naturally evolves into touchpoints with culture, employee engagement, compensation, etc.
A great briefing connects the dots and this is reflected in the engagement from board members. To create this level of engagement - three things :
a - Effective communication
b - Cyber expertise
c - Relationships
Decisions : Is it possible to have good board engagement and ineffective cyber oversight? Yes
Ultimately, strategic decisions about risk mitigation investments and potential opportunities must be made for effective cyber oversight. Thses typically will take on the form of proactive measures to reduce risk and potentially explore how to leverage such investments to elevate the brand or increase value to clients, customers and consumers. Some of these decisions may involve staying ahead of new cyber regulation and crisis preparedness. Whateever the form, these decisions are made by the board, effectively and decisively
There’s a clear understanding and awareness of the implications of these decisions on the business and all relevant stakeholders and these decisions are not reactive but proactive and they anticipate where the business is going and the associated risk velocity of the business. To create and allow for effective strategic decisions, here is what’s required:
Business strategy and vision : You can’t mitigate risk that doesn’t align with where the business is going. Well, you can but it’s not effective.
Courage to Challenge other perspectives and this courage is encouraged by establishing a safe zone; psychologically safety. Multiple perspectives helps. Challenging the effectiveness of existing investments
In summary here are the principles and practices that increase the odds in your favor if you desire to have effective cyber board briefings.
Summarize the required practices and actions.
This is what makes great briefings, great!
In summary here are the principles and practices that increase the odds in your favor if you desire to have effective cyber board briefings.
Summarize the required practices and actions.
This is what makes great briefings, great!