Welcome everybody to today's CIT Tech for Business podcast.
We are now three podcasts in and you may have maybe gotten inkling that we are kind of bouncing
all over the place.
Our favorite thing here is to talk about all of the tech tangents.
So do know that at any point if you have an idea, something that you want to have these
guys talk about a question you want to answer, you can always send those on over to info
at CIT-net.com and we're more than happy to tangent right along with you answer any of
those questions week to week as we get them.
Today we are going to sit down with Kyle and Todd and talk about SEC compliance.
Kyle Todd why don't you guys introduce yourself and get us kicked off.
Hi everybody, I'm Kyle Leder.
I'm the president and CEO at CIT.
Happy to be with you today.
I'm Todd.
I am CIT's chief operations officer.
I'm also the CISO at the organization.
In case anybody doesn't know SEC in this particular instance does not stand for the college
division.
This is so it's not southeast conference.
The security is an exchange commission.
For those that are not aware there was a proposal that came out just a couple of weeks ago that
was talking about some new compliance things that potentially were going to go on.
And really largely they're focused heavily on cyber security and the risks that are associated
with it.
We can touch on briefly who potentially is going to be impacted on this in a minute but
just kind of wanted to give you an idea what that is.
So we'll share out some links as we get further along in this process.
So for those that are listening we'll talk to it the best we can.
For those that are watching the links will be added when we go through this at the end.
So just kind of giving a real real super high level of what's going on is there are recommendations
from the SEC that when a cyber security incident happens that organizations need to disclose
the incident.
And currently the way it's framed up is it's within four days which as soon as they found
out there's something material which is pretty soon or pretty early I mean they need to disclose
their policies their procedures for managing risks and the cyber threats.
They want to make sure that they disclose the board mechanisms for cyber security risk
oversight and they need to disclose cyber expertise on the board of directors.
So I'll start there and then I'm going to ask Kyle a question is Kyle who does this
impact.
It's going to impact any of your public traded companies.
Obviously comes through so your larger companies even some smaller equity based ones that are
looking for public funding side of it's going to add significant cost and operation sides
on to how you are protecting your systems.
So there's a it's pretty far reaching.
I mean there's a lot of controls that they're talking about here.
And the time frames are talking about is very short you know I think that's the part that
really jumped out to me is the how quick they want the notification to come through because
these things are complicated.
There's a lot to those things and I don't know about Utah but I looked at that I'm like
wow that's that's quick turnaround.
And the bigger you get I think the harder that becomes you know a smaller organization
could be fairly nimble I think to have a pretty good idea of the significance and where the
information's at but you know a large organization to really kind of get a handle on things could
be pretty could take take quite a while granted they're looking for you know getting their
policies out and everything but and not for all the full information but still that's
very quick.
And that's going to require you know I think a lot of them to look at their existing tool
sets and definitely looking at their policies and certainly looking at their controls and
really being able to you know be able to disclose things very very quickly which is ultimately
what the SEC is asking for here.
So a couple things I'll add on to that just just to kind of clarify this is not finalized
so it is certainly possible it will change but I kind of wanted to throw a little background
to kind of give the listeners an idea of what that actually means for most organizations.
So when we work with our customers I would say on average it takes us about two weeks
from the time that there's discovery to the time that we're typically recovered but that's
as Kyle said I would consider that to be pretty nimble if you want to contrast that by what
potentially is quote unquote the normal is you can use the Octa example that came out
in the news just recently is that was discovered at the end of the of 21 I believe and then
it took for the most part took the vast majority of three months to to say this is what we
think happened and then it continued to evolve for another two to three weeks.
So when you're talking four days you really have very little to no information to work
from and go okay now I have to turn around and explain this to the world.
Wow that's not a great thing they're a great place to be I would think.
Yeah yeah that was my thought I mean they probably may have to revisit that time request
stuff or the you know how much has to be disclosed within that four days being a much smaller
subset and then mandating you know different tierings of data side with it but you know
that part jumped out of me right away.
I think the requirement for cybersecurity awareness within the board level of these organizations
I think that's a very pro thing I'm very much in favor of that I think I think awareness
at the board level of companies on cybersecurity if they're not already there this is a good
thing they need to have it I think it's very important for the executive level and that
board level operational sides of any business side to have good insight as to the risks
that were that are involved in cybersecurity nowadays regardless of public traded or not
it's just there's you just cannot ignore it in 2022 it's a significant risk to the business
even more so than fire and theft from your traditional aspects of it this is something
that should be considered and their certificate costs to the business and there's also certificate
approaches that the business needs to take into account of their liabilities when approaching
their their customer engagements because there's so much risk involved there's a you know there's
that risk hot potato that you're going to have to work through with your customer sides
on cybersecurity incidents and what that looks like so there's just a lot of high level business
discussions that needs to be into the fabric of the company in all aspects of it it's not
just a side conversation.
I agree I mean to me it was quite frankly I don't want to say it was a long time coming
but quite frankly it was a long time coming it really was I'd mentioned this to Kyle a
couple days ago too is the last time the SEC did something like this it was back when they
did Sarbanes Oxley as kind of a requirement and I believe that was 2002 or something along
those lines and by comparison that was very transformational for organizations boards
etc.
Yes we love the cat if you're not cat people very sorry.
I'm sorry for those that are just listening there's a cat on screen as I was saying this
is a this is transformational I think to Kyle's point is you're going to see things change
dramatically back when Sarbanes Oxley came out it's kind of hard to think about it at
this point but there was a dramatic shift where all of a sudden organizations had to
have that level of financial acumen added to the board and now it just seems like a
given right you would absolutely include that well ultimately as a good outcome of this
as I think you're going to see that security becomes a board level concern too which it
always should have been it's gotten so bad over the last five years that it doesn't really
surprise me.
The one other thing that I would say is kind of a negative at the moment is there really
aren't a lot of quality IT security individuals out there so for you look at the sheer number
of organizations this will impact that there just may not be a ton of people that you can
lean on and go hey I want you to join my board so a lot of organizations may need to reach
outside and look for some additional help for their to supplement their board on the
bright side the way that this is written is it currently is kind of anybody that has any
kind of security background so it could be a security analyst or a CISO or whatever the
case may be so you do get to tap into basically any cybersecurity experts expertise which
is great but like I said I still think it's going to be a bit of a challenge for a lot
of organizations out there.
Yeah I think having those individuals that you know have the security background to understand
the potential risks and having are able to bring that alongside the business aspects
and operations of the business side of it to understand you know beyond the technicalities
of it and really connect those two together and say you know these risks could affect
our business because of this you know because of the way we hold customer data this is where
customers you know they'd be able to correlate that to be able to explain it to their core
board members in a business way is going to be the key there because you can't deal in
technical terms with with all members of the board that's not their their their main acclimate
you know but if you were to put those into into the business operational terms and risks
because it's really to me it always comes back to the risk and you know put into those
terms and how you're mitigating those risks with these new approaches to reduce it because
that's that's what this game is going to be about is risk mitigation.
I think it's been proven over and over again that no organization is immune no matter how
good their stand side with it if they are targeted there is a significant risk to the
organization but there are many great practices to be done that will dramatically reduce your
risk footprint and that's you know I know for our approach to our customer sides of
it Todd speak very very depth on this side of it but that's what it's about I mean putting
in a framework and reducing of a lot of the risk I mean you're you're a gambling person
your percentages drop way way down and that's what that's usually what it's about today.
I kind of.
Go ahead.
Sorry I just wanted to pose a question so if I'm an organization that this is going
to be affecting me later down the road right now this communication has gone out what do
I do in order to be proactive so once this thing is finalized then I feel comfortable
that I have X, Y and Z in place so can you give me a little bit of background of like
if there's an organization where do they start from this point?
Sure I mean I'll start and Kyle can fill in the blanks but one of the big takeaways that
I had from the article just in general is that compliance is coming right if anybody's
listened to me talk over the last year and a half I've been kind of saying you can see
it starting to creep up whether that was starting with CMMC that started to impact the manufacturers
or the executive order that came out that anybody working with the government needs to start
to become compliant with things you can see it's continuing to tick up and again it's
ticking up now for anybody that's in that's governed by the SEC so to me that's kind of
the main takeaway that being said there are a lot of core functionalities and frameworks
and they're all designed to reduce risk to Kyle's point so you know looking at risk you're
looking at a variety of different things whether that's stuff that comes out generally so if
you had a cyber attack you're looking at financial risks you're looking at potentially if you're
a an organization that is traded you're going to have some equity problems and concerns
and then you know if we get even get into this some of the down strokes are or the downsides
could be potentially any litigation that comes from it but all that being said is if you
look at common frameworks that are out there and you can use NISC or COVID or a variety
of others they're all designed to start to lower that risk and there's core places that
you should be focusing on this kind of gives you a little bit of a framework to write you
should put in somebody that's got some security wherewithal and start looking at how do you
get that advice if you're going to be under a regulation obviously you're going to look
at trying to add that individual to the board but if you're not and you can see this coming
at some point down the road which I would say it likely will you'd start to work with
those organizations that do have the wherewithal and then they can help you build the framework
where do you start is it cyber security training is it controls or is it security tools that
you can put in place that help you start to reduce the risks that are associated with
various different types of attacks.
Yeah, yeah, no, I would agree with all that I think you take if you are publicly traded
and you're starting to prepare for the likelihood that this does become come into law side with
it that you start taking some steps now that if your board has not incorporated this and
do it now I mean I think starting to take those steps to create the board seat that
brings in that that cyber security individual into at the board level is is a good move
regardless of the regulatory requirement.
You know I know there's many large companies in the United States already have taken those
steps sides with it you know and I think you know if they haven't they should be doing
it already if you're not publicly traded I think you should consider having somebody
with cyber security awareness on your personal private company board to have those insights
in there if they haven't done that already that individual himself then I think should
align themselves with security framework practice as Todd mentioned some of those I think you
adapt a framework and that starts become part of the part of the discussion points for the
board and I start to make them aware of what that framework is and what the risks are and
then have those discussions on how you're remediating those risks because that's if
that becomes part of the normal business practice self on it they're moving in the right direction
on how to approach this side with it that's that's a big big takeaway for them to do right
now that's why I like so much about this topic because whether you know this topic obviously
is is targeted at a public traded company but I think the results for even a private
one to it to adopt what they're talking about here is strongly recommended and is Todd alluded
to we we firmly believe two other regulatory requirements are coming down the pipe even
for private organizations through affiliations and whatnot you're going to be more than likely
associated with some kind of regulatory requirement in the near future.
Just to kind of expand on that so so if you look at how the world has kind of been transforming
is if you did business with the Department of Defense you kind of had some pieces in
place already and you already know your regulations with defarters and a variety of other things
but then they started to say well if I'm doing business with any other partner third party
so you're working with just as an example you're working with an organization like CIT
you're going to be looking to that partner and saying hey what do you do and that's going
to be true of any of these publicly traded organizations as they're going to go okay well
do I work with this other organization downstream a little bit any third party is going to naturally
get pulled into that and saying okay you now need to be compliant on a plus side as you
start to get in front of this that actually becomes a differentiator for you you can go
hey there's quick ROI because I can win business that my competition can't because I put my
ducks in a row so I mean there's some there's some boons for companies out there too so
I had to throw that in because it's tech for business right so there is there is a good
reasons to do this for your organizations is it does set you apart it does get you in
front of it it gets you going in the right direction and it's good basic hygiene in addition
to yeah yeah there's a definite win-win component to it to allow those you know take those necessary
steps now or start moving those directions because it's going to pay dividends being
an early early adopter and those businesses already done it you know commend you for
already taking those steps sides with it and continue to work through it but you know
as we approach many organizations we find that their their hygiene is not at that level
where they need to be and it's usually just they don't know what they don't know and
that's knowledge is definitely power in this subject so getting that information again at
the board level with leadership can understand the risks so they can make the necessary investments
into how do they improve it.
You know I don't I don't know what you've seen Todd I mean usually you know what what
has come from organizations who don't do the preemptive approach side with it it's usually
unfortunately after an incident occurs then all of a sudden you know the spend is done
and that's that's what we definitely want to avoid and we hope you know this type of
discussion you know leads to early steps to you know avoid that being being the reason
for change in the organizational structure side with it because that's a it's a painful
process we witness it it's not pretty you know and the the damage is to the business
just from obviously the cost and downtime but then just a long term you know damage
to the reputation of the business side of that in the possibilities for litigation as
Todd talked about you know those are those are those are talk points we don't want to
do you know and I think you know you can take some steps now if the business learns to make
some early investments and priorities around it it's completely avoidable in our mind to
avoid that.
I'd agree I mean I'll use some statistics so one of the latest statistics I saw were
48 percent of all attacks are on small and mid-sized businesses which is where we typically
focus if that's true and then the statistic that followed up with it only about 14 percent
of those organizations were prepared to deal with the attack in any shape manner or form
so that's everything from tools to being able to recover that's a really small number if
you ever look at the whole gist of everything that's a pretty darn small number so to Kyle's
point of what does it look like if you're not prepared the likelihood of something happening
and it being pretty devastating is high and so we got into the risk conversation of whose
hot potato is that when we talk about the third parties and all that type of stuff if
you are working with those businesses and they're going well gee I'll use the octa example
is octa used a third party to help do some of their support and that's where their particular
incident started well octa is quick to go hot potatoes yours good luck you're the ones
where it all started and so that's the kind of stuff we want to avoid right so starting
to prayer prayer for it finding the health that you need is definitely a good place to
go and as Kyle mentioned there's all kinds of things we can do to kind of get you going
on that platform it's just kind of understanding where you are today and like it or not most
organizations have started on this process one way or another I would say a vast majority
of organizations already have cybersecurity insurance as an example if you've got it you've
already decided that there was some risk out there and you want to avoid it at all costs
so you went and got your insurance so you're already on the path it's a good thing you
should be doing those kinds of things one of the natural transitions you're starting
to see is as that starts to happen those insurance companies are starting to ask a lot of the
things that you're going to see from a compliance organization or a regulator saying do you
do MFA do you do EDR you name it they're basically building out that foundation or that base
layer of how do I start how do I start to put security around what I do day in and day
out and how do I reduce that risk because that's what an insurance company is doing
right reduce their risk they don't want to pay it no chance yeah yeah I mean that's
exactly right I mean the insurance companies want to reduce their risk exposure that's
what they do and they price it into the policies so those potential clients that they're looking
at that are viewed as high risk they're either going to say we can't afford that risk hence
we can't give you insurance which is going to put the business in a very bad position
given the cost of it or they're going to want this have proof that they have taken steps
to reduce their risk to make them an insurable entity no different than your health insurance
saying do you exercise do you eat right otherwise I can't afford to give you that life policy
because there's too high risk you're going to die you know that's the same idea here
and it's definitely become in the last few years just so much more prevalent because
they've had to pay out a lot more I think it's interesting and what we've seen happen
is that there's you know the threat actors are aware of these policies as well and they're
you know when you're seeing these ransom I mean they're targeting knowing that there's
a high percent likelihood of payout of these policies so they've been abusing that as well
now to the point that I think you know what they're asking for is ransom is what they
believe the insurance coverage is that not what they believe the company has in cash
on hand you know so you know they're even betting on that which is which it makes it
even scarier which then means the insurance company is going to put more criteria around
because they don't want to be put into that situational side of it so you can you can
see where this is going and I think it's it's definitely trending to where you know the ease
of being able to get cybersecurity insurance is no longer going to be as easy as it used
to be just because of that trend that we've seen I you know the next few years I know
I would say we fully believe it's going to become much more difficult to get the cybersecurity
insurance and I think the unfortunate side effect that it's had is yeah we've always
praised customers for having the wherewithal to go get it because it we view it's important
to have it they've used it as a as as the check box that we got it ourselves covered
and then they didn't take any other necessary steps to reduce their risk they said well
I got insurance I'm fine you know and that's just unfortunately is not going to be good
enough you know you're going to have to take steps to actually reduce your risk to reduce
the likelihood that you would ever need to use that policy is is really what this is
going to be about no longer can you say we bought the insurance I don't need to do anything
else that's that's definitely where this is going.
I mean I agree you look at it now I'll actually throw the sand and I feel like I may have
said this in a podcast previously and if I didn't I will now but as you're seeing how
the cyber insurances coming along is they've transformed dramatically and I would say within
the last 12 months if I looked at the beginning of 21 it was pretty benign you were kind of
going yeah I need insurance and I go okay how much do you want here's the bill and it
was it wasn't quite that simple but it was pretty close by the end of the year I was
being pulled into customer sites going okay let's let's answer the questionnaire by the
underwriter and it was nearly a full blown audit from a third party coming in going okay
let's look at your network diagram you know network diagram do I need one yes you do all
of a sudden this became a big thing at the end of the year and so it's just getting more
and more complicated some of the things I guess kind of just circling back to this particular
compliance that's coming I wanted to kind of hit a couple of things just briefly so if
you are under the regulations and you're trying to get informed on it what does that look like
some of the things that I know are coming are number one we talked about it you're going
to have a lot more reporting requirements currently that requirement is really really
fast reporting so you need to have a good plan in place as to what does an instant response
look like you'll you'll absolutely need it you will need some some reporting capabilities
as we mentioned earlier I think you are going to be looking at some exposure there is risk
associated with communicating early and often there are there absolutely is going to be
some unintended consequences what those are I don't know it's still pretty early I think
they're still looking for that kind of feedback coming back there are some specific things
where there is no current or there is no delay in that reporting there's no safe harbor you
need to do it as fast as you possibly can you absolutely are going to see that there
are going to be very difficult these filling those board positions as I said they made it
super broad so you can bring in anybody with experience but still going to be difficult
not everybody's going to be comfortable joining a board you're maybe looking outside your
organization etc so those things are coming and then one last little takeaway is for organizations
and we see I see this a lot in banking and Kyle can expand on this a little bit too as
we're wrapping up here is a lot of times organizations when they do have that compliance
in place they tend to lean on compliance and go compliance you do it with this you figure
it out this requirement is striking it right up to the board as high as you can possibly
go and go you now need to deal with it you're ultimately responsible which is what you've
been seeing from a lot of organizations anyway the frameworks always say that that's where
the ultimate responsibility comes from but this is nailing that that down completely
going this is where it's at.
Yep yep that's correct it's putting it up at the highest level of the organization side
with it which honestly is where I think it needs to be because it is this is you know
there's a business survival side to this aspect of what this threat to the businesses are
and I think for the protection in this case obviously protection of the shareholders that's
what the SEC is saying you owe it to the investors in this organization to make sure that you
are protecting their investment and this is significant risk and the boards that's the
board's responsibility for the shareholders is protect their investment.
So any other parting thoughts before we wrap up the show today.
I don't have any I think this is a great topic though again now he's cyber security is always
so easy to talk about just because there's so many aspects of it I know we talked about
a ton of different areas that you know definitely tie into this particular one but again I think
it's you can take this information and apply it to a private organization very easily and
still still adopt a lot of what they're saying and you know that's that's really ultimately
what what CIT is about here that's where we try to make you know the technology work for
the business side of it is is bringing in that framework helping with that information
you know we're happy to discuss with with our with our customers at the board level
you know these level of issues sides of there and advocate for for change in those organizations
ultimately because it's you know we we want to we don't want our customers to deal with
the bad situation and I don't think anybody anybody wishes that on any organization at
this point but you know so taking these next steps and anything you can do we're happy
to have those discussions my party thought is is reiterating what what Kelsey said at
the beginning is Phyla and I we love talking if you've got questions about this so you
got cybersecurity the complies your name it we're happy to go through it with you so if
it's something that you've got interested in or there's other items that are similar
that you've got a passion about by all means let us know and we're happy to to get on and
chat with you a bit yeah absolutely no we love it and thank you Todd for kind of taking
that mean like yep sure talk to us 100% yes we are always hearing kind of just like Kyle
said right and we're here in Minnesota Western Wisconsin but if you're outside of that and
you happen to be watching the podcast because that would be our dearest hope is that we're
helping anybody across all businesses we are still here to help you find those resources
point you to the right people get you those people because we know it can be one of those
things where you got a lot on your plate every single day and we're just here to help and
help educate you and help you find all of those but if you want to connect with us directly
that's what Tara and I are on here for for the marketing people that are sitting here
and telling you yes emails go to the website and you can always find us you guys know it
info at CIT-net.com or head out to our website it's CIT-net.com same as the end of our email
we are here to answer any and all questions get you connected with Kyle Todd I'm sure
they'd love to sit down have coffee with you guys all the good things will work for food
but we are here every single week so send us your thoughts your questions and we look
forward to chatting with you again next week.