Cybersecurity Training and Services for Boards

All boards have different interests and requirements for such training, therefore we tailor each program to your needs. Additionally, boards themselves have widely differing appetites for learning about risk management and cybersecurity.

The new U.S. National Cybersecurity Strategy and SEC regs are increasing the urgency of such training within boards.

Training is typically scheduled during normal board meetings. Each situation is different, but we typically recommend four training sessions over the course of four quarterly or monthly meetings. Each training session is a 1.5 hour, interactive (Zoom or equivalent) session with time for Q&A. Sessions are recorded for documentation and later traing or review. The sessions typically generate many questions.

Trainings are performed by company partners Mitch Tanenbaum and Ray Hutchins, each of whom is imminently qualified to teach their fellow citizens how better to protect our nation's assets.

Over the course of the training, we'll typically cover:

1. Risk management: Risk management strategies including risk assessment, risk mitigation, risk transfer, and risk acceptance.
2. U.S. National Cybersecurity Strategy:This important new national strategy impacts many things that affect your company.
3. Ransomware response strategy:Overview of the current threat landscape and the potential impact on the organization's operations, reputation, financial performance and company valuation.
4. Threat landscape:Overview of the current threat landscape and the potential impact on the organization's operations, reputation, financial performance and company valuation.
5. Regulatory landscape:Overview of the current threat landscape and the potential impact on the organization's operations, reputation, financial performance and company valuation.
6. Risk appetite and tolerance:Has your company defined these and are the company's risk management strategies aligned with these levels?
7. Incident response:Board members should be familiar with the organization's incident response and/or emergency operations plans. This includes the key steps involved in incident response, which includes detection, containment, investigation, and recovery. We'll also cover management's communications with the board during incidents.
8. Third-party risk management:Risks associated with third-party vendors and service providers and how the organization manages these risks.
9. Cybersecurity metrics and reporting:Introduction to the metrics associated with tracking cybersecurity and privacy risks and the effectiveness of risk management strategies. Boards must understand how to interpret these metrics and reports and how to use them to make informed decisions about cybersecurity and privacy risks.
10. D&O and company cyber insurance:Coverage requirements and considerations.
11. GRC solution review:Leveraging off our latest position paper and assessment of forty GRC solutions, we discuss the features, limitations, and costs of such systems. We help board members and executives establish expectations for understanding and maximizing the value of such systems.

• Demonstrates to employees, customers, vendors, investors, regulators, and insurers the leadership’s unequivocal commitment to responsible cybersecurity.
• Takes the most important first step towards a sound and long-lasting cybersecurity governance posture.
• Supports increased company valuation.
• Enables a more favorable negotiation posture for D&O and other cyber insurance coverage, terms and rates.