Author: Paul Bergman

Hello all,

Today I completed my training and passed the exam for my Certificate in Private Company Governance from the Private Directors Association. PDA is a membership association for board members of private organizations. They offer both job postings and training to their membership. I’ve been a member since January of 2021 and am a member of their cybersecurity committee. As a member of that committee, I’ve led the development and management of four very successful webinars in the last year.

As a board member I’ve always been committed to developing a and understanding my role at a private company. This may seem like an easy task, but many private companies are owned by a very small number of people. Sometimes when those people are directly on the board, it’s difficult to know exactly where you fit in. Take, for instance, a board I was on where there was just one owner and he was CEO of the company. It is difficult to ‘represent the best interests of the shareholders’ when they are already sitting at the table! Where do you fit in?

The fact is, you need to walk a fine line in those cases. They clearly have their own interests in mind but aren’t always experts in everything (although some think so). You do bring a different skillset to the table and certainly a different point of view. Remember, you are there for a reason.

Fortunately, not all company boards are so skewed. Most companies that are large enough to start considering creation of a board of directors have a large ownership base as well. One family-owned business that I worked with had only a few family members running the company. In those cases, it’s much more clear that you represent the interests of those that aren’t there.

Keep in mind also that shareholder interest isn’t always the only interest you need to keep in mind. Courts are starting to expand that to include all stakeholders such as employees. Not to mention with new privacy laws doing into effect around the world, the interests of customers should certainly be a discussion in the boardroom to address risks that could be extremely costly to a company.

The cybersecurity world is full of certifications.

The fact is, it’s an easy way to validate a skill set without doing a deep-dive interview with a candidate. Most certifications require classroom and fairly lengthy exams covering a large body of knowledge. In my case, the CCISO certification is my most recent validation of my skillset.

The CCISO exam is offered by EC Counsil, the folks that did the highly popular CEH certification. Similar in scope to CISSP certification, the CCISO covers 5 domains of knowledge:

1. Governance, Risk, and Compliance
2. Information Security Controls and Audit Management
3. Security Program Management and Operations
4. Information Security Core Competencies
5. Strategic Planning, Finance, Procurement, and Third-Party Management

As you can see, this is a management level program. There isn’t a focus on certain tactics or procedures because those don’t belong at the management level in the same way the next CEO of Amazon need not have experience as a delivery driver.

I’ll admit that the exam itself was difficult, and some questions are arguably awkward, but does a good job testing against the body of knowledge. It is a great indicator of awareness and understanding of corporate risk and security. Particularly when paired with other certifications, I feel that these certifications go a long way toward validating education and awareness of issues. That is the challenge that corporations need at the C-level and boardroom.