Gregory Wilson, NACD.DC

Pragmatic, strategic governance is fundamental to security departments at large organizations. With sound department standards, operational procedures, and technical standards we can manage at scale, lowering risk, liability, and expenses. I share a little insight on the topic here in this recent interview with Security Journal Americas (SJA). PPG The Security Foundation (TSF) International Security Management Association (ISMA) Diplomatic Security Service OSAC

100

6 Comments

I've briefed Fortune 500 audit committees, executive leadership teams, and military generals. None of them want to hear about your firewall rules. They want three numbers that actually matter to the business: **Mean Time to Detect (MTTD)** Not "we have 47 security tools." They want → "We detect threats in 12 minutes vs. industry average of 287 days." Real impact. Real timeline. Real comparison. **Business Risk Exposure ($)** Not "we mitigated several vulnerabilities." They want → "$2.3M in potential business disruption reduced to $180K through proactive remediation." Translate technical risk into dollars they understand. **Security Debt Ratio** Not "we're implementing new controls." They want → "18% of our security infrastructure needs modernization, down from 34% last quarter." Show them you're fixing the foundation, not just patching holes. Here's what I learned after these briefings: Executives don't care about your CVSS scores or vulnerability counts. They care about business continuity, financial impact, and forward progress. The moment you start speaking their language — dollars, timelines, and trend lines — you get budget approvals instead of blank stares. Your cybersecurity program is only as strong as your ability to communicate its value to people who've never configured a firewall. What metrics do you use to translate technical risk into business language? #CyberSecurity #CISO #RiskManagement #ExecutiveLeadership #InfoSec

37

11 Comments

Another #MYGRCPOV interview at Nat'l Association of Black Compliance & Risk Management Professionals, Inc. (NABCRMP) 5th Annual Summit. I had the honor of interviewing Lawanda "Elle Michell" Hall, one of the most respected voices in compliance and cybersecurity insurance. A few key themes from our conversation: • Community matters. Elle described NABCRMP as a safe space where compliance professionals can share both expertise and lived experiences, especially as minorities in this field. • Global and national challenges are real. She noted the complexity of navigating an ever-changing global compliance landscape while addressing the unique pressures of today’s U.S. regulatory climate. • Compliance is about people. Elle emphasized that compliance is bigger than rules—it is about safety, integrity, and ensuring long-term trust in business decisions. • The future requires intentional action. She called for responsible use of AI and stronger pipelines for young, diverse professionals. As she reminded us, Southern University remains the only HBCU with a dedicated risk management and insurance program—a clear signal that we must do more to expand access and awareness of this career path. Talking with Elle reminded me why we show up: to advocate for equity, push our industries forward, and make compliance a space of both accountability and opportunity. Thank you, Elle, for your wisdom, and thank you, NABCRMP, for continuing to create a platform where these conversations thrive. #NABCRMPANNUALSUMMIT2025 #NABCRMP #ComplianceLeadership #RiskManagement #EthicsAndAccountability #Cybersecurity #DiversityInCompliance #InclusionMatters #AIandCompliance #GRC Jennifer D. Newton, Esq.

25

I found this an odd release from CISA today. Guidance for SIEM / SOAR implementation. I’ve read through most of it, and will make another round, but it reads like an executive presentation. Even the practitioners guide. I’m not really sure what they were hoping to accomplish. The important logs section is a good index/reference page, but the rest is both short sighted and dangerous to call guidance in my opinion. There’s not enough info to estimate log sizes at this level. Even the fact of saying you need to centrally collect logs is short sighted as there are many ways now to decentralize the logs and have the same or better value. They scratch the surface on noting this, but don’t explain the nuance enough. I’ve worked with one of the best engineering and orchestration teams, and this barely scratches the surface of what we did. That being said, it’s a good guide book for someone new to the space, for considerations of design, and for what to expect in the framework that is built. I think one of the biggest things I didn’t see, is doing this right requires the right strategy, and especially the right skill sets. You need people that understand data, big data, and development. There’s is a lot of development here; like you essentially need a development team and solid relationship between threat intel, detection engineering, soc and development teams to do it right. This also scales differently depending on the size of the org, but even in a small org, there’s a level of entry and cost of doing business, but you’re going to have to err on the side that requires less care and feeding which is not a monolithic centralized system. I’m curious what others think. I’m sure Jonathan Rau has some opinions. :). I’m also curious what Sean Maher thinks.

34

22 Comments

This illustration is not accurate. The Executive Team doesn't sit with the Board of Directors (BoD)—two distinct teams with distinct roles. The Chief Executive Office reports to the Board of Directors (BoD) and leads the Executive Team. There are more than three lines of defense. The multiple lines of defense are attempting to engage and activate front office employees and back-office/support employees. For example, here are ten layers of involved groups: employees, middle management, directors, vice presidents, workstream leaders, chief executive officers, board of directors, strategic partners, customers, and regulators. Many layers. It gets down to organizations updating their roles and responsibilities more accurately.

2

📢 Ohio HB96 FY26 Cybersecurity Audit Guide! Thanks to Kirk Herath and Marnie Fredrickson for leading a really nice webinar yesterday on the cybersecurity program requirements outlined in HB96 - and thanks as always to CyberOhio for their tireless work to keep these requirements top-of-mind for all of us. You can find the slides, as well as a recording of the webinar, here: https://lnkd.in/ghCJT_-F The most exciting part of the webinar was the Auditor's Office announcement of the 2026 Ohio Compliance Supplement (OCS). This document is available here: https://lnkd.in/grQ-Gqux If you skip to page 197 of the PDF (page 78 of Section 2), you'll find step 2A-21, where all the details are found regarding how to prepare your district for the auditors' visit for your FY26 audit. So what will the auditors ask you? You can read the supplement, but the TL;DR version is below 👇 Cybersecurity and Ransomware Incidents 1. Did any cybersecurity or ransomware incidents (as defined in Ohio Rev. Code § 9.64) occur during the audit period? 2. If such incidents are identified, were the reporting requirements met to both (1) OCIC and (2) the Ohio Auditor of State? Ransomware Payments 3. If a ransomware incident was identified, and if disbursements were made, were they approved by the legislative authority? Cybersecurity Program 4. Did the legislative authority adopt the required cybersecurity program by the required implementation dates (July 1, 2026, for schools)? 5. Was this program based on either the NIST Cybersecurity Framework or the CIS Critical Security Controls? 6. With respect to the size and complexity of the entity, does the entity's cybersecurity program appear to be tailored to the entity’s unique environmental needs based upon the auditor’s knowledge of the client? 7. If the program contains training requirements, were those training requirements met? There is considerable discussion of item 6 in the supplement. This control determines whether the district created the program itself or copied a generic template. The supplement provides specific examples, including the presence of a learning management system, the types of data that must be protected (PII, HIPAA, etc.), and password management policies. It's safe to say that simply copying a cybersecurity program from ChatGPT will not be looked upon favorably by the auditor. But the good news is that the webinar materials provide significant detail on who should be involved in creating your cybersecurity program. And the even better news? Vinson and Vinson Protect are here to help your district comply with these requirements. We have developed a partnership program specifically for Ohio schools seeking help in developing their cyber program. Learn more 👉 https://lnkd.in/gtJcYtaR #vinson #vinsonprotect #hb96 #cyberohio #letsdothis

21

Cyber attackers do not all think the same—why should defenders? Latinas in cyber bring cultural fluency, multilingual skills, and sharp pattern recognition that threats do not see coming. Yet they make up less than 1 percent of the field. That is not just a gap—it is a missed opportunity. If we want security strategies that actually scale, we need to start by widening the talent pipeline. #Diversity #Cybersecurity #Culture

88

5 Comments

Learn how to build a scalable enterprise risk management framework for 2026 with practical steps, governance insights, automation trends, and ERM best practices.

10

There are two different worlds simultaneously existing right now in #GRC World 1️⃣ Example: Auditors/Assessors (especially in Federal environments) pushing back on automated control validations while defending point-in-time manual checks. World 2️⃣ Example: A security engineer mapping their product to relevant controls through an LLM and the output being good 🔥 I saw both these examples this week. World 1 is rapidly dying. World 2 is sprinting forward. This is a call to action to learn the skills that enable success in World 2. 🏄 We can't control the shifts, but we can learn how to better ride the wave. #GRCEngineering

99

35 Comments

The most successful Compliance Officers I've worked with do something consistently: they celebrate their wins.  Here's what I mean.  When your internal audit catches an undercoding issue and you recover revenue, that's a win worth sharing. When you identify a risk before regulators do and fix it, that's a win worth celebrating.  Too often, these successes get tucked away with a "nothing happened" or "we got out of that one."  But here's the reality: everybody wants to see ROI on compliance. Your leadership team, your board, your investors. They need to understand the value your compliance program creates.  These aren't just "nothing happened" moments. These are proof that the system works, that the investment matters, that compliance protects and creates value.  When your Compliance Officer communicates these wins clearly, it builds support for the program and reinforces why compliance is strategic infrastructure, not just cost.  Always here as a resource, message me.  -RRR

22

ℹ️ Most boards approve technology budgets. Few boards understand what they approve. That’s not a criticism. It’s a structural issue that has existed for years. But with technology accelerating fast, it has become a real risk. and a potential liability. Boards approve technology budgets, AI strategies, and cybersecurity frameworks. But approval without understanding is not governance. It is hope dressed up as oversight. ℹ️ A board does not need to write code. But it must be able to challenge the risk model. ⚠️ If you cannot challenge the risk model, you cannot govern it. Research continues to highlight a capability gap at board level in cyber oversight. Now add AI. Many boards approve AI deployments without being able to assess risk, bias, controls, and liability in business terms. What I see repeatedly in boardrooms: 🔹One “tech-savvy” director carries the entire technology and AI agenda alone. That is not oversight. 🔹AI, cybersecurity, data governance, and data protection are treated as separate topics. They are not. An AI system is only as secure as the data, access, and controls behind it. 🔹Risk is approved without being understood. Regulation is raising the bar (e.g., NIS2, the EU AI Act, FINMA expectations). Technology governance is becoming more explicit — and the downside is real. 💡 Here is what concerns me most: At board events, many board member and executives agree this gap exists. Back at the office, not much changes. The reasons are familiar: “other priorities”, “we are too small”, “it takes too much time”, “it’s too expensive”. 👉 In the short term, that can work, with a bit of luck. In the long term, it becomes governance debt. And governance debt always comes due. ❓ What is your experience; does your board have genuine technology oversight, or is it performed oversight? ✴️ I help and support organisations and boards in building effective technology governance, so cyber and AI risk is translated into decisions the board can actually understand, challenge, and own. #BoardGovernance #TechnologyGovernance #CyberRisk #AIGovernance #RiskManagement #DataGovernance

7

UChicago Medicine Data Breach Exposes 38K Patients Recently, CBS News Chicago reported a concerning data breach at UChicago Medicine, revealing the exposure of 38,000 patients' information. The breach, highlighted in the news segment linked below, sheds light on the vulnerabilities within healthcare systems. This incident underscores the pressing issues surrounding cybersecurity, with terms like ransomware, phishing, cybercrime, and hacking becoming all too common in the healthcare sector. Such breaches not only jeopardize patient privacy but also raise questions about the overall security measures in hospitals. Watch the CBS News Chicago coverage here: [Link to the news segment] #healthcare #Ransomware #phishing #cybercrime #CBS #databreach #hacking #hospitals

9

We built RiskQ to be your audit‑ready source of truth for cyber risk. With a centralized evidence repository, unified asset inventory, time‑stamped risk scores, and AI‑informed prioritization, you’ll shorten audit cycles, improve third‑party assessments, and strengthen board reporting. Hundreds of advisors already use RiskQ to demonstrate compliance and control. Learn how we help Englewood, NJ organizations present clear, verifiable evidence to stakeholders: https://wix.to/pjOYN8y 🚀🔒 #CyberRisk #AuditReady #Governance

1

The latest blurring of lines between Cyber and Reality: Minnesota's Governor activated their National Guard to respond to a cyber attack against St. Paul, their capital.   "the scale and complexity of the incident exceeded both internal and commercial response capabilities"    https://lnkd.in/eVdz6pDG

10

3 Comments

Although Mexico has calmed in the last, it’s important to understand the larger currents that will continue to shape the security landscape. Great webinar this week. Check it out!

15