Felly, dweud eu cwestiwn i'r cwestiwn i'r cymunedau sydd y ddysgu a gallwn i'r cwestiwn i'r cwestiwn i Ben Macpherson. Gweithraeddiol sydd wedi'i gwyfoes iawn i ddweud y� ar gyfer Scolwmiadau harfaenau a hyd yn ôl, ddyn ni'n ddweud i greadio gwirioneddau yma yn Lundin. Dechreu iawn, mae'n drym yn gyflwylliannol i'r ddweud i Holley Judas thaton yn mynd ymgynghoru. I offer my heartfelt condoneses to all those affected by the dreadful incident in London on the evening of 3 June. Following the incident in London, the First Minister chaired a meeting of the Scottish Government's Resilience Committee, which included Police Scotland, to consider the impact of the incident and the required response here in Scotland. The First Minister has also received a briefing from the Deputy National Security Advisor. The Scottish Government officials are engaged with UK Government officials to keep the implications for Scotland under review. As with the response to the incident in Manchester, Police Scotland increased the visibility of armed and unarmed officers on the streets in Scotland over the course of the weekend. Further events taking place in Scotland over the next 14 days have also been reviewed to ensure that the right level of policing is in place to meet operational requirements and also to provide public reassurance. Planning for the general election is included in this review. However, security measures are only one part of the solution. The responsibility to tackle violent extremism is one that we all share. The most important challenge for us all is to work towards creating cohesive and resilient communities in which the terrorist message will not resonate. In times of adversity, our communities in Scotland have shown that they will stand side by side to send a shared message of tolerance and of unity. Ben Macpherson, I thank the cabinet secretary for that answer. Like him, all our thoughts and condolences are with the London victims at this time, their families and their communities. Following the terror attack in Manchester on 22 May and in London on Saturday 3 June, can the cabinet secretary confirm that the Scottish Government and Police Scotland will continue to work closely and engage with communities across Scotland to provide reassurance and ensure that no communities feel marginalised, isolated or vulnerable? Yes, I can. In the wake of the terrorist attack in Manchester on 22 June and the attack in London on Saturday evening, the Scottish Government and Police Scotland have continued to engage with communities across Scotland to provide reassurance and to ensure that no communities feel marginalised, isolated or vulnerable. Police Scotland continues to monitor hate crime incidents on a daily basis and review those on a regular basis to identify any significant rise in tensions in communities. I can give the member an assurance that the work with the Scottish Government and Police Scotland and their other partners will continue to take forward to ensure that those who may wish to peddle a message of hate or to exploit those situations that they are not able to do so in our communities here in Scotland. Ben Macpherson, I thank the cabinet secretary for that answer. In his first answer, he talked about community cohesion, which is clearly extremely important in ensuring that there is one Scotland where people live in peace. Can he outline what action the Scottish Government is taking to ensure that Scotland is a welcoming place for all those who have chosen to make Scotland their home? As a nation, we have a long and proud history of welcoming people to our country from various nationalities and faiths. As a Government has continued to be committed to supporting integration into our communities here in Scotland, it is vital that we continue as a country to send out a very strong welcoming message that Scotland is a place where you are welcome and you are particularly welcome if you have chosen to make your home here. Over a number of years now, we have invested in a range of different measures in order to make Scotland a welcoming place, including investing more than £100 million in 2021 in promoting equality and tackling discrimination. We have also published a race equality framework for Scotland, which is about promoting race equality and tackling racism. We also have Scotland's first new Scots refugee integration strategy, which ran from 2014 to March 2017. Those are measures that we have taken forward in order to make Scotland that welcoming place in a place where hate crime has no place. As a Government, we will continue to work with agencies to ensure that that message is taken forward. Douglas Ross I add the thoughts of the Scottish Conservatives to the condolences that have been expressed by the cabinet secretary and Mr McPherson to those that were affected by the most recent atrocity. I also place on record our grateful thanks to the reaction of the emergency services in both London and Manchester. Although no one wishes to see a further increase in the number of armed officers across Scotland, if it is required and we earlier in this parliamentary term did see an uplift in the number of armed officers, what assistance and support will Police Scotland require if there is a further need for a further uplift in armed officers across Scotland? Cabinet Secretary As I set out to Parliament last June following an assessment of the level of firearms capability that Police Scotland had, following the terrible attacks that took place in Paris in 2015, it was identified that a further uplift in firearms capability should be deployed within Police Scotland. Since that statement was made to Parliament, Police Scotland has been undertaking an extensive training programme in order to have an increase in its firearms capability. That work is now at a very advanced level. As a member will have noted in the last 10 days, Police Scotland has also stepped up its firearms capability to the level that was necessary for critical, which demonstrates the level of capacity that Police Scotland now has in its firearms capability as it is able to do so without the requirement for any military support in meeting that demand. I am confident from the information that has been provided by Police Scotland that it believes that existing firearms capability is sufficient to meet existing needs. However, as with all those things, they are kept under constant review. Should Police Scotland feel that there is a requirement for that to change yet again in the future, that is a matter that will require to be considered not only by this Parliament but by the public of Scotland and also by stakeholders across the country. Clare Baker We are all shocked at the attack at the weekend and our thoughts are with the victims and their families. This is the third terror incident within three months that we have had to experience. While it is right that the focus is on the capacity and the deployment of our police officers and our intelligence service, what advice the Scottish Government can give to people who may be feeling vulnerable after witnessing the terrible events on Saturday night but who have also taken strength from watching the concert in Manchester on Sunday evening? John Swinney One of the early actions that was undertaken by Police Scotland following the terrible incident in Manchester and also in London was to deploy specialist officers at our transport hubs to meet any individuals who had travelled from Manchester who had witnessed the events and also who had travelled from London who may have witnessed the events on Saturday night in order to provide them with any advice or information and to take any information that they might have that could help to support the investigation. The information is then shared with the lead agency that is responsible for investigating these matters in Manchester, getting Manchester Police and London Metropolitan Police. Alongside that, advice is provided on where they can get support through the NHS and through their GP services and to specialist support for anything that they might have witnessed. That support is also there for those who may have witnessed some of those scenes on social media. I am particularly conscious of that with the incident that took place in Manchester given the number of young people who were involved in that incident and who may have been particularly interested in the concert in itself. Advice was provided to our local authorities through our education departments and on to schools and also through our health services to make sure that any young person who was seeking advice or support that there was an avenue in a pathway in which they could go into in order to get that advice and support. That information was disseminated as widely as possible through our schools and through our health services. To ask the Scottish Government what efforts it is undertaking to comply with freedom of information requests. Scotland has the most open and far-reaching freedom of information laws in the UK. We take our responsibility for FOI seriously and, in the large majority of cases, we respond on time and in full. The Scottish Government is open and transparent about how it deals with FOI requests. All of our guidance is in the public domain. Thank the minister for that response. In April of this year, Rosemary Agnew, the former Scottish Information Officer, ordered ministers to improve their performance following a number of, and I quote, totally unacceptable failures to respond to requests, adding that she was dissatisfied with her performance and would respond with the full force of the law. She launched a formal intervention to force improvements and will be closely monitoring responses until September of this year. Therefore, what will the Scottish Government do to raise its game, although it has been monitored? Performance over recent years is consistently better than the 61 per cent achieved under the last full year of the previous administration. The volume of requests has increased steadily over the years. In 2015, the Scottish Government received 2,155 requests, an increase of 173 per cent since 2007. Even so, a record 1,674 responses were issued on time in 2015 and 1,557 in 2016, as compared to just 684 responses on time in 2006. In recent months, the number has spiked dramatically. We have received 777 requests in the first quarter of 2017 compared to 524 requests in the first quarter of 2016. By April this year, we have received more requests in 2017 than we received in the whole of 2007. That said, we are committed to improving our response times and are working with the commissioner's office to that end. I appreciate that very long list of statistics, but how telling is it that just 40 hours before we exercise our biggest manifestation of democracy that we have to bring this to the Scottish Parliament to question the transparency of an SNP-led Government? Last week, journalists from across the political spectrum—the Guardian, Common Space, The Times, The Courier, The Daily Mail, The Terald, The Telegraph—I could go on—signed a letter to the Scottish Parliament selection panel for the next Scottish information officer. In that letter, the outline a number of concerns over the Scottish Government's use of legislation, which undermines openness and accountability. Clearly, that practice is not sustainable in a mature democracy. Can I ask the minister again if he understands the need for transparency and will the Scottish Government commit to addressing all six of the concerns that are outlined in the letter? As I said earlier, Scotland has the most open and far-reaching freedom of information laws across the UK. We are determined that we continue to improve our performance and continue to make more information available. If we can compare the amount of information that we release here in Scotland to what happens in the rest of the UK—in Scotland, in 2016 and the last full year—85 per cent of valid requests received information, either completely or at least in part, where we held irrelevant information. Compare that to the rest of the UK, where only 63 per cent of the UK Government departments have released information. We have widely recognised as being the most robust FY regime in those islands. That is something that the Information Commissioner noted in her special report, and she made the point that Scotland is ahead of the international field in that area. However, we are determined to continue to work to improve those response times, but here in Scotland we certainly release more information than anywhere else in the UK. Does the minister accept that there is real suspicion that the Scottish Government is trying to circumvent the freedom of information legislation by failing to record meetings that it had previously recorded and that the secrecy is not conducive to good government? I think that there is a question tomorrow on this particular topic, but I can confirm that the Scottish Government proactively publishes lots of information about ministerial engagements and information on the date, purpose, attendees and the subject of those engagements, and that is something that was brought in by this Government that did not used to happen. Formal minutes are taken at meetings where discussions are on substantive government business, where policy decisions arise or where there are significant action points all in line with the ministerial code. To ask the Scottish Government what the impact will be of the planned closure of the police control room in Inverness and its move to Dundee will be. Cabinet Secretary Michael Matheson, decisions on the operation of individual police control rooms are the responsibility of the Scottish Police Authority. Scottish ministers are clear that any such decision must be subject to appropriate assurance, including external scrutiny, in order to ensure that the impact of any change is fully understood. Understand that a decision on the transfer of control room functions from Inverness to Dundee is now expected to be made on 24 August 2017. To thank the cabinet secretary for that, in 2015, when the Inverness police control room was last threatened with closure, HMN inspector of constabulary said that dividing calls away from the control room was creating additional risk. Given that the recent failings in control at Police Scotland, I am not convinced that the risks have been eradicated. How will the Scottish Government convince the people living in the Highlands and Islands that they have been? The member highlights a particular issue that was highlighted in the assurance review that was carried out by HMICS in 2015, which I directed the HMICS to carry out. However, he may also be aware that there was an updated report published in January of this year, which highlighted very significant progress and improvements that had been made by Police Scotland in their call handling arrangements and that a significant number of the recommendations that had been made by HMICS had been discharged as a result. The 16 of them being discharged, 12 partially discharged and only two still outstanding. They also confirmed that the model that was being proposed was still an appropriate model that was being taken forward by Police Scotland and that the HMICS continued to be part of the assurance process before any further change is undertaken. It is important to keep in mind that, although there were original issues highlighted in the report that the member referred to in 2015, there has been a significant amount of work undertaken during that period of time, and the updated report from HMICS confirms the significant improvements that have been made. Edward Mountain Cabinet Secretary, history has taught me that, in an emergency, command and control should be as close to an incident as possible. Why does the Scottish Government therefore think that it would be sensible, a sensible idea for incidents in Caithness and Sutherland to be dealt with in the first instance by control room in Dundee? That is 240 miles away, and that is hardly local. I do not think that he has dealt with the other problems that were brought up in the report. I can only presume that the member was not aware of the actual content of the report that was published in January, which highlighted the significant progress that has been made in all those areas, which is undertaken independently by HMICS in looking at what is the best model, what is the most appropriate model and whether Police Scotland has addressed the issues that were highlighted in the original review report that the member has just made reference to. Alongside that, the Scottish Police Authority has its external review of the changes that report to the Scottish Police Authority, which has to be agreed upon and considered before any final decisions can be made on those particular issues. The very reason that Police Scotland has moved to the 3C models is in order to provide a much more comprehensive contact, can and control system than what was there previously with the eight legacy forces. What I would do is encourage the member to consider the update report that was published by HMICS in January, which demonstrates the significant progress that the member seems to choose to wish to ignore. John Finnie Thank you, Presiding Officer. Cabinet Secretary, I think that the issue of local knowledge is often played up quite a bit, but I certainly share the view that this is a backward step for communications. In fact, I take considerable reassurance from the role of the inspectorate. What we know is that the facility remains and we have been previous assurances about its role for criminal convictions and vehicle records. Can you confirm that that is still the case? As a general principle—I am aware that you do not wish to include on operational police matters, but as a general principle—would you believe that public bodies, including Police Scotland, when opportunities and technologies exist, they take the opportunity to disperse jobs to areas such as Inverness and indeed Dumfries? Cabinet Secretary, on the member's latter point, I agree with the technology and the ability to be able to do so, so long as it can provide operational reassurance in the deployment of resources and in responding to incidents as and when that is required. As the member will be aware, in moving towards the 3C model, one of the aspects that Police Scotland were considering having established at Inverness is the national database inquiry unit. My understanding is that that is still Police Scotland's intention that the national database inquiry unit will be largely based at Inverness. However, alongside that, it is looking at the existing arrangements that it also has for national inquiries at Govan, to see whether there is a partnership arrangement that should be in place. My understanding is that that will then be considered by the Scottish Police Authority in due course to make a final decision on whether it will be one single national database or whether it will be across two bases, but it will involve having some of that provision being delivered in Inverness. Liam McArthur I share many of Edward Mountain's concerns. Some of the reasons why the Scottish Liberal Democrats did not support the creation of a single centralised police force, a centralisation proposed by the Conservatives in their manifesto leading up to the 2011 election. Will the cabinet secretary confirm whether, in supporting the creation of Police Scotland, there were any amendments lodged by the Conservatives calling for or demanding the retention of the control room in Inverness, or other parts of the country? Cabinet secretary, I was not the cabinet secretary for justice that dealt with that particular piece of legislation, but I do not recall any specifically off the top of my head. I think that the member does make a good point, although the Conservatives party are often keen to criticise the single force that was in their manifesto prior to that election. That concludes topical questions. The next item of business is a debate on motion 5982, in the name of Margaret Mitchell on behalf of the Justice Committee, on its inquiry into the role and purpose of the Crown Office and Procurator Fiscal Service. I would invite all members who wish to speak in this debate to press their request to speak buttons now.


Thank you, Dr. Bryson, for joining us today. I wonder if you could start by talking about the town of Gilbert and your role. I mean, as the CISO of Gilbert in Arizona, you're responsible for securing a fairly substantial enterprise. I wonder if you could tell us more about that and specifically how you spend your time. Sure. Town of Gilbert were recognized as being a town, but in reality, we're more of a city. We have 281,000 citizens. We have the support, have a number of critical infrastructure services that we provide to our citizens. So that is a huge responsibility there. I am the first Chief Information Security Officer for the town of Gilbert, so have had to come in and start putting together a strategic perspective on how to secure systems, how to prepare ourselves for future changes that are going to impact us as far as the evolution of technology goes, and we're experiencing a dramatic evolution in technology. So it's been a bit of a challenge, but ultimately it's been fun. Day to day has been really looking at technology, making sure that we have the appropriate processes in place to take on new and evolving technology and make sure we do so with security in mind. Let me ask you a question about strategy. I presume strategy, you start, Tony, with a mental picture, and then you begin to maybe document that with actual pictures or frameworks and things of that nature. What a lot of SecOps pros tell me is that that's really important, but the real hard part is operationalizing that framework. I wonder if you could add some color to that challenge. Sure. As you said, really putting together a strategy is putting pen to paper and trying to understand where your organization is going, understanding what its business objectives are, and making sure that we have the technology in place that can support those particular business objectives. Make sure that we have the appropriate mechanisms in place to secure those systems and help carry the organization forward towards those particular business objectives. Now, from the information security perspective, it's a little bit challenging because naturally we have to deal with the changes that are happening, not only within our business objectives from division division, but also within the technology industry and what's happening there. Ultimately, we've got some unique challenges that we have to face there. We have to try and find the right human resources to bring in and help us take on those particular challenges, but we also have to find the right technology partners, find the right third parties that can come in and be true business partners to us, and help us meet those business objectives, help us meet our security objectives, and help us make sure that we can take on challenges of the changing technology landscape. We are dealing with a very difficult time right now with changes within that technology landscape. One of our guests at this summit is a gentleman named Mark Sorenson who wrote a book. It's a fictional book, but it's very plausible. It's called A Restaurant in Jaffa, and it's about basically what you can do if technology gets in the wrong hands to critical infrastructure. My question is, is that critical infrastructure part of your scope? Maybe it transcends the town of Gilbert and bleeds into the state. What about the critical infrastructure within the town? Is that your scope? If so, how do you deal with securing that? Critical infrastructure does fall into scope for us. Naturally, we do have requirements. We have to deal with both state and federal. It is a unique challenge for us, and we have to be very careful as we take on those particular challenges. We have to recognize that critical infrastructure is a service that every one of our constituents relies on. Let me tell you, as someone who lives in a desert for us who provide water and wastewater services to our constituents, you want to have upset customers. You prevent water from going into their particular homes, and you prevent the wastewater, the excrement from being removed from those particular homes. So that responsibility of managing that critical infrastructure and securing that critical infrastructure is extremely important. It is a huge challenge because we're coming from a time when critical infrastructure was very much handled in one way. That was to go and create air gap solutions and put those, operate those systems in a box, a black box that nothing could get into, nothing could really get out of. Those systems were very easy to secure because they operated within that air gap environment. With today's technology and especially vendors that want to maximize their investments in their technology and leverage support contracts, Internet of Things technology is really starting to take off in that particular segment of the technology landscape that we have to support. And as a result, we have to now find ways to poke holes into that black box. We have to allow vendors access to those critical infrastructure resources. And we have to find ways to do that in the most secure way manner because those are assets that are targets for bad actors, not only within our borders, but also nation states. So we have to be very careful in protecting those particular resources. It's just listening to you. It's sort of awe-inspiring when you think about the scope of what you do in the conversation about critical infrastructure. It's one thing when a company gets hacked and that's obviously a bad thing. But it's like, ah, their stock price dropped. And unfortunately, maybe some private information, personal information got exfiltrated. But when you just listening to you describe the basic services that you provide in terms of securing a municipality, it really hit home to me with respect to how important it is, what you do. And when we talked previously, you shared with us that resilience was the top priority. And so thinking about the municipality-wide resilience, what does that actually mean to you as a CISO? It's been a change in thinking. It used to be that every CISO out there would look at finding ways to put protective mechanisms in place, put more firewalls in place, put more sensors on the network to identify when things were happening. It's been a change in thinking. And resiliency has become, I think, the new way of securing your systems and your data. You have to provide a mutable data set you can fall back to and that you can rely upon. That if something should happen, and that's where we are today, we're no longer saying if we're now saying when this happens, we need to have our mission critical data available so we can restore our systems and get that data back into place so that we get those services back up and running for constituents as quickly as possible. So you're saying it used to be, oh, we need a copy and now you need a mutable copy that you can restore from? That's correct. You need to make sure that the data that you have can be restored. It is the best version of that data that you're going to be able to restore it quickly and get it in place accurately and in a timely manner because, frankly, the services that we provide to our constituents are extremely important to them. Not to mention the recovery point objective and the recovery time objectives. I'm curious as to are they compressing because of the sort of emphasis on digital, particularly post-pandemic? Very much so. All those particular metrics, everything is shrinking. People have very much become digital citizens and they're used to that immediate response they get from doing everything online and digitally. So when we have some type of physical solution that experiences some type of disruption, the expectation is that we still have to get that recovered as quickly as possible so that our customers are getting the same type of response they do from all of those digital interactions that they have. So sticking on the theme of kind of what's the same and what's new, we talked about a year and a half ago, Dell Technologies World, about how you think about protecting your infrastructure, your data, your application. So it's sort of a two-part question here. From a strategy or first principle standpoint, what hasn't changed in part two? Is there anything that's changed since we last talked at the spring of 2022? What hasn't changed is our focus on trying to maintain a level of resiliency. What has changed is how we're approaching that. As an organization, we've been very focused on trying to move as many workloads as we can to the cloud. I find that you get much better security in the cloud than you would on-prem. You've got some major partners like Amazon Web Services, Microsoft, and Azure, that they can spend just ungodly amounts of money to secure their systems that we can't on-prem. So we've made a purposeful decision to try and move those major workloads to the cloud and get those off of the infrastructure that we have to support. I think we're better off trying to support the services to get to the internet and secure connections, more so than trying to build out data centers and host that stuff, secure that stuff within our own data center. So that's a significant change. When it comes to resiliency, we also decided that we want to move that from, again, within our data center, move that out to the cloud as well. So again, we have another layer of protection there that a bad actor would have to try and traverse to get to our data. So the cloud is like a first line of defense. I think if you're not 100% cloud, so you still have a hybrid model. Let me just clarify, is that correct? That is correct. We're still hybrid, but we're getting there. We're 70% plus cloud engaged. Okay. Now, given, as I say, first line of defense, but it's still a shared responsibility model, and I'm particularly interested in how you think about data protection and backup and recovery with respect to putting data in the cloud. A lot of people say, well, my data is in the cloud, so it's safe. And to your point, the infrastructure, what the cloud guys do is great. It's more consistent, and they've got a lot of engineers running around, but they're not necessarily protecting your processes. You've got to worry about your recovery, the data that's inside your SaaS application. So how do you think about data protection for the cloud? Again, we try and focus in on how we did it on prem, and then go out and try and find appropriate cloud service providers that follow the same methodologies that we did on site. When we made the conscious decision to engage in a resiliency strategy, we went out and found business partners that could help us achieve that particular goal. Dell was the partner that we initially engaged with and put in play of the cyber recovery vault on premise, and it has proven to be an invaluable safety net for us, I guess is the way I'd put it. As we started looking at more cloud integrations and wanting to make sure that we could leverage the cloud even for something like cyber recovery, we went back to that same business partner and said, okay, what are you guys offering? Where are you going next that can help us achieve this particular challenge while maintaining the same data principles that we have on our own network and internally? How are you going to do that? And that's where their APEC service really stepped up for us. It gave us multiple options where we could either do on-prem, go to Colo, or even go full cloud. And because we want to go full cloud and there's certain things that we still have to maintain on-prem, that's where APEX was a perfect fit for us. It allowed us to leverage that hybrid environment and achieve those business objectives of trying to secure that immutable data in the cloud. Yeah, as I recall, you were looking at APEX a year and a half ago, but you hadn't yet implemented it. Is that correct? And it sounds like now you have or are beginning to? We're beginning to. We are and we're just initiating the project to move our recovery vault from on-prem to the cloud. We've landed on the service that we're going to use with Dell and we're hoping to have that done within the next six to eight months. And do you expect, Tony, that experience to be substantially similar or even identical between your on-premises and your cloud from a data protection standpoint? We expect the experience to be similar for end users. We expect them to feel nothing. From the support perspective, there's going to be some very minor technical differences in how data is moved around, how data is copied. As you move to the cloud, there is a slight difference. You're not relying heavily on some of the copy practices that are used on-premise, removing data domain to data domain. When you go to the cloud, it's handled a little bit differently, maybe a little bit more old school in some ways, but it ultimately achieves the same end state, which is what we want. We want to have a safe immutable dataset that we can fall back to and rely upon should we run into that significant cyber event that we have to recover from. We can do both with the on-prem solution and also that on-cloud solution. The way they do it is just slightly different from on-prem to in the cloud. But it's back to the first principle as you're working backward from that outcome. It's pretty clear. One of the themes of this summit is data protection as a fundamental component of a cyber security strategy. And in thinking about the evolution of data protection from backup and recovery to data protection, data management, there seems to be a much tighter link now with cyber security strategies. And I wonder, do you think about data protection, backup, recovery as a separate process? Or is it increasingly or now something that shouldn't be tightly integrated into your cyber security infrastructure? And if it is tightly integrated, what are the challenges and prerequisites of doing that? To me, it should be integrated. I've always felt that. We've always gone out and tried to find solutions where, even out to our endpoints, we would have some type of backup solution that if an endpoint got hit, say, with ransomware and took it out of production, how can we most quickly recover that solution and then quickly restore all of the data? Now, some of the cloud services that are out there, OneDrive, allows you to do that pretty seamlessly now. In the past, we leveraged other products. We had a contract with another service provider that allowed us to literally backup systems on the fly. And then if we did run into a ransomware event, no problem, we just burned the system down, rebuilt it, logged back into that particular system, and it would pull the data back down to that endpoint. So it allowed us to take on that particular challenge. The technology has always been there. It's just a matter of how you wanted to approach putting that technology into play. When it came to the enterprise systems, yeah, naturally, you have to look at solutions that are more robust, can handle much more data than when you normally just get from an endpoint. So there are some challenges, but again, it's the same principle just at scale. Yeah, wow.  I think this is so helpful for organizations that aren't perhaps as mature and far along as you are, giving them hope that they don't have to sleep with one eye open. Thanks so much, Dr. Bryson, for spending some time with us. You're very welcome. And thank you for watching the Navigating the Road to Cyber Resiliency Summit. Stay tuned for more conversations about the intersection of data protection and cybersecurity right back.