This is distributed companies are the future so that's not the room that you intended to be in no offense You get up and walk out. I will not be offended if you get up and walk out during the presentation either. I get it Sometimes it's just not hitting you. It's alright. Don't feel bad about it. Um, I Am Addison Berry add one son on the internet struple.org clear those things I am the director of education at Lullabot and I've been with I've been working on Drupal for over eight years. I've been with Lullabot for over seven years and We have been a fully distributed company from day one since the company started so I The entire time I've been at Lullabot. I have always worked from home. We don't have any office anywhere about four years ago We started a product called Drupalize me, which is our video training site service and As the director of education Pretty much Drupalize me is my world now and that's where I spend 100% of my time and I aside from explaining who I am and what I work on I also want to point out that Lullabot is a services company and we've done client services now for eight years but we also have a product and in terms of speaking about Distributed companies and how people get work done services and products are very different And it has a different impact in terms of how your teams work and We are an unusual company in that we have both it's not particularly common So anyway, there's experience on both sides That has been very interesting for me Leading a team on a product after working in services for so many years As I said, we have no central office. We are fully distributed. Everybody works from home. We have 55 people We are currently in six countries across seven different time zones and My team the Drupalize me team is a smaller subset team Dedicated within the company. We are eight people in three countries, but we're still across six time zones To do all of our work So just to give you a little context on where I'm coming from with all of this and and the experiences that I want to share I'm going to Before I actually dive into talking about this I want to ask a few questions just to get a sense of who all is in the room How many people here currently work for a company where someone is working from home like as their normal regular thing Cool, that's a lot of people. How many people wish they worked at a company where you could work from home? How many folks are managers or business owners versus employees Cool. Okay. Awesome.  That's all all right so When I put this session forward, it's sort of My universe for for many many many years has been working distributed And it's it's funny to me because it's I take it for granted and I assume that this is the normal way that people do business And have been doing it for a long time But often I end up in conversations where people are utterly confused on how I actually get any work done It's it's always an interesting Conversation piece when I talk with people and they're like, oh well, so you work for an American company. Where's the office? I live in Copenhagen and It's confusing to them and I'm like, well, I work from home and they're just like horrified There's like this little like that sounds weird and uncanny. So And it's an interesting thing in the Drupal community because our community is online We work on a product Like Drupal the software we work on our community our culture Online all the time But even within the Drupal community people find it strange that you would actually make money this way Versus just doing it as a volunteer free thing So I figured I would try and share some of the experiences that Lullabot has had we've had a lot of challenges It's a different way of doing things and I think the Biggest the first hurdle for everybody is everybody thinks oh just have everybody work from home hire people haven't worked from home done it sounds very simple on the tin that is not how it works and Since it's not that easy. I just sort of want to walk through what it really is like and What I would like to do is make sure that I end this Early enough so that we can have some questions and conversation. I would love to hear from other people What your experiences and challenges have been and sort of share that information with each other so That's what I'm going to be talking about. I want to start off by actually defining what I'm going to talk about beyond this like Because people use different terminology and the title in my presentation is about distributed companies When I first started working for Lullabot, we call ourselves a virtual company And I would I was so very very excited about this job. I was working at Lullabot I was going to do Drupal full-time and I was going to be able to work from home and that was just Stunning to me and I would tell people I worked for a virtual company and I'd be all excited and they'd be like You don't work for a real company No, it's real So virtual was a really odd word, but it's what we used for quite a long time Originally in the company, but yeah, people kind of Doesn't sound real. It's it's it Eliminates the the real people aspect of things. It makes it sound like it's all all fake and all in the ether somewhere So I don't tend to like to use that term anymore Another really common one is remote that's used a lot and for me remote has a very specific meaning which is That there are a bunch of people in one place and then there's someone else in another place and That you are removed from where things are really happening remote is not a particularly Comforting word to me as an employee I don't want to feel like I'm an appendage that's been left off on the side of the road somewhere From where everything else is going on So for me when I'm with my terminology if I'm speaking of remote companies Those are companies that have an actual physical location and not everybody works at that physical location Which is quite different for me from distributed Distributed is evenly distributed Everybody is Working separately you don't have some people congregated and some people not the significance of this is That you have equal access to communication When you're in a distributed company Whereas when you're in a remote company not everybody has equal access to the same information and the communication mechanisms And that is a huge distinction for me in this talk I'm talking about my experience as a distributed company. I I consider remote companies the hardest nut to crack a lot of what I'm going to talk about is definitely applicable to a remote situation but I honestly don't know that I would Recommend a Remote situation because to me it sounds really hard to pull off well to create the Equality that's really necessary for people to all be on the same page at the same time is really hard How many people here work with because there are a lot of hands for working someone's working from home How many of you that is that a remote situation where there's actually a physical location for your company? Yeah, okay, fair number. How many of you are like truly fully distributed with no physical location? All right, so good one there They're really different So I just want to be clear about My terminology so you understand what I'm talking about here, and I'm not sure if it applies for remote or not sometimes I'm going to talk about Advantages it's all on one slide. I'm going to go through this pretty quickly. Most of this presentation is going to be focused on the challenges That's you know kind of where the rubber meets the road And I think that's the the more interesting stuff to kind of dig into but I do want to run through the advantages And there are different advantages for different people. So this is just sort of a generic list But ones that I have found actually applicable for us Of course like one of the big things and one of the reasons that Lollabot started as a distributed company Was it was a wider talent pool for for us to be able to hire whoever we wanted Let's hire the best people But not be limited by location because not everybody wants to move to the same city Trying to look for talent in one city is really hard trying to look for talent in one country is hard I live in Copenhagen And the the Danish System or you know group of people there like finding Drupal developers experienced Drupal developers is really hard. It's extremely competitive So we have a much much wider range of people that we can hire Lower overhead costs. I don't have an office. We aren't paying for all of that Stuff to keep the lights on we have a company of 55 people. That's a pretty substantial space That would be necessary in a regular office. There's an asterisk there because we're going to come back to that because In some ways that is a false Assumption for a lot of people. We don't have an office, but we have other costs that can balance that out But I'll come back to that later business continuity a lot of people don't think about this But when you have an earthquake or a flood And all your systems go down Power outages and cities like it has happened in New York You everything is gone your entire company is offline Whereas our distributed team just because somebody is affected in one city or in one block of the city The rest of the company is still functioning and we can re-root the work that needs to happen We've had instances where our clients Have had a problem Locally and they have gone offline But we're still working and then but there's no way for us to communicate with them and actually keep things moving forward Because their localized place has gone down So it's useful More time zone coverage as a product. This is really awesome for us. It extends our support coverage But it's also for even for services teams being able to hand things off to people Doing some work in the morning and then going to bed and then waking up and somebody's already worked on it But again, there's an asterisk there because time zones are also tricky We'll come back to that in the challenges section Better communication skills If you're a distributed team people have to communicate and they have to communicate well And it has to be something that you actually put a lot of effort into you can't just assume communication happens and it actually makes you Overall as a company and as a team better communicators We've had people come work for lullabot who are stunned at the level of communication and feel that they have way more Understanding what's going on and more connections and ties with their co-workers in a distributed company Then they did when they worked in an office because we focus so much on communication and people have to up their game If they're going to be successful with us And then wider cultural perspective and experience, I mean there's tons of studies out there on diversity within a team Does lots of different things some of it subtle and some of it not so subtle that will improve the overall quality of your team and It's like one of those things. It's easy to kind of take for granted that. Oh, yeah, you know I've got people and I you know they came there from East London and they're from West London I mean we know those are two completely different cultures, right? But being able to have like people in widely different areas, not just time zones or countries Even like are they urban or are they in rural areas? It's amazing the perspective that people bring to their experience We often it's interesting just having people from different countries or who speak different languages It's simple things like our marketing materials We have a filter of that doesn't make any sense Because it's so American centric that it doesn't make sense outside of an American who would be reading it and that Improves our overall product and the work that we're doing so It's something I think a lot of people dismiss but this to me This is actually one of it's a huge advantage of being able to spread out the team that we hire All right, let's talk about challenges because it all sounds great on paper, right? Before I get into Specific practical things. I want to start with this one, which is a very high-level thing Which is trust? Trust is a root of a lot of the challenges that you're going to encounter does Does your client trust that your action actually like show up for work and get work done? Do you trust your employees to do what they need to do without you seeing them do it? Do your employees trust that you have any clue what's going on when you're not actually there with them with the client? you've got to build trust and Like that's true. I think of any team in any circumstance whether you're co-located or not But the distributed nature Highlights that and can cause a lot more problems if you don't have Solid trust within your company and within your team. It's it can be a real problem So at the end of the day a lot of it does come back down to trust Can't really be a micromanager and a distributed company Okay, so on to actual like practical. Oh gosh. I don't know how to do this Legitimacy are you actually a real business that whole virtual thing I said like people are like so you don't have an office You're not really a business right you're in like your mom's basement, right? You get that reaction from clients and from potential employees It's a it's a thing. We've definitely had clients who are just like Yes, you don't have an office, right? Where are we supposed to meet you and Then it just comes down to education and you're not going to be able to educate and convince everybody and then you just need to move on but I do think that The more we talk about the work that we do in the way that we do it is Very useful for moving that stuff forward. We have case studies There are other companies out there who are distributed and very successful automatic is another example. They are huge company They have hundreds of employees fully distributed and They are very successful and so Being able to point to those things and adding to that literature out there We write blog posts about the stuff that we do. I would love to see more People writing about what it is and how you work because that only helps all of us be able to legitimize Ourselves well of us, you know, we have a huge reputation and we're one of the top Web shops out there. So we have that but back in the day We had to just sort of work on it and build our reputation by doing the work And I think one of the biggest things that helps with that process is In the initial interactions with people whether they are potential employees or clients Highlight the actual advantage of the distributed nature, which is communication a lot of people take stuff for granted if you actually Show people I mean communication is bizarre like how people people can be stunned because you actually communicate well and effectively And you don't waste people's time It's amazing And so I really think that like just be professional and communicate and teaching people how you communicate and how they should communicate Better that in and of itself is an enlightening experience. I think for a lot of clients so It's a hard this is a tough nut to crack though if you have people who are really skeptical and I'm it's interesting I Find that And this just might be my experience and perception But I feel like in in Europe it is there's more resistance to the distributed work System then in the US it's been really interesting and lightning for me living in Europe And the reactions from people is a Lot more like really that can't possibly be a real thing So it can be tough. I do think that you need to just talk about it With other people and add to the literature so that we can all like you guys can use lullabot's experience To help you establish legitimate me for the way that you want to work We're cool with that Hiring it's different when people don't come into the office and shake your hand and sit down across the desk and talk to you It's awesome because you have this huge pool, you know We get applications from all over the place. It's amazing and it certainly helps to get that bigger pool But when you actually get to the hiring process You have to modify your hiring process a little bit and not just like yeah You're gonna have like, you know a video hangout or you know, whatever the online tool is that you're using to communicate But when you're hiring most people hire for skill and cultural fit, you know sort of your standard Things I'm gonna hire for but now you also have to hire for the ability to work in a distributed team It's a specific thing that you need to look for not everybody is cut out to work in a distributed team Really and they might not even know it. It's your job when you're hiring to figure that out Or be prepared to deal with it. Some people can't they just can't handle it They end up not working because it's too hard They're not disciplined enough to actually get their work done without somebody standing over them Sometimes they work way too much and they burn themselves out Which can be equally dangerous So it's one of those things that like you actually have to put this into a checklist of things that you are assessing when you are talking to somebody The kinds of questions that they ask figuring out what their fears are about working in the distributed Be amazed in the number of interviews we have the number one thing that comes out is if people are Very hesitant about the distributed nature of coming to work for us and they have a lot of fear about how it's going to work And having having that conversation and being very open about it in the interview process is going to save both of you a lot of pain So something you need to really pay attention to We do have we Years and years ago. We started to ask for people to submit a video when they submit their application to us It's not a hard and fast requirement, but as a general rule It's highly suggested and it helps us get a sense of the person During just the interview like before we even get to the interview process through the screening process But we also do hangouts now, so we do video interviews for a long time. It was only Skype And it's not part of it is of course you just want you need to get a sense of a person You need to have some sense of cultural fit and you know Facial expressions and things like that, but there's also honestly, there's a whole element of can they actually use the tools that we use on a day-to-day basis Can they figure Skype out? Can they figure hangouts out if they've not done that before can they do it because it's going to be really important on our day-to-day work I know over at automatic and part of their hiring process. They actually have It's Skype chat text interviews Because they use that as their main tool most of the day for communication and they need to know that you can communicate and Understand what's going on purely through text And so they use it as part of their interview process so that they can weed that out pretty quickly So using the tools that you use in your day-to-day work in your interview process Can really help you assess and sort of narrow down people who can actually Figure it out and be able to work with those tools properly Another thing that we do at Lullabot is we have Lullabuddies So everyone's assigned every new hire is assigned a Lullabuddy So somebody else in the company, they don't have to be some like old veteran of the company They're there just to you know, can you get into IRC? Have you do you know where you're supposed to be for the team call on Monday? Just reaching out and making sure that people get through those initial pieces because again you have this Once you hire somebody and you're onboarding them, how do they figure out what's going on? Without, you know shadowing a person walking around the office with them It's harder for people to create the personal connections When you first start working and you're in the office the personal connections that you end up making with people are those things That you lean on very early, but we don't have that In-person thing so you really have to be proactive about creating a personal connection and giving someone Basically an internal support network within the company that they can rely on very early on in the process It's very easy for people to end up feeling overwhelmed and isolated When they start to onboard Unless they've worked in a distributed fashion before we find it happens quite often So Hiring process a little different pay attention to that stuff and The decisions you make in the hiring process Effect all the other things that happen all the other challenges that are going to happen You need to have people who can work in a distributed environment and can thrive in that environment a Lot of all this stuff comes down to of course communication and of course trust That initial issue that big kind of root challenge A lot of trust is built through communication. You've got to communicate well So I'm gonna have a couple of sides on communication because there are a bunch of different challenges around it Start with collaboration how you actually work together So Jared Ponchot is our creative director and he recently wrote an article and He had these sort of three points in terms of how we try to structure our communication, right liberally Chat frequently congregate occasionally We have a lot of Written communication in our company and it's interesting. I mean like when someone submits an application The way that they write even at the very beginning it matters and It's like, you know, they can be someone can be an amazing developer or an amazing designer But if they can't articulate in written form, it's gonna be very difficult To be successful in a distributed company because so much of our communication is in writing Chat frequently we talk a lot Touching base with each other We use lots of different tools for that whatever Skype hangouts But the keeping that like real-time figuring stuff out Obviously, you need to have that stuff in place and then congregate occasionally is actually getting together in person But you can't do it all the time Obviously or you defeat sort of the purpose of being a distributed company and the way that we kind of break down these Where you're doing what with these three things and This is actually this asynchronous and synchronous stuff came from Conversation that we had with Brian over at a github and Asynchronous is tactical work synchronous is strategic work With the asynchronous work. This is the day-to-day only tactical get the job done the work that needs to happen and This is very It's designed to get out of people's way You need to communicate, but do you need to be distracting people all day long when you communicate with them? Let people organize their information the way that they need to if it's not like some kind of critical thing Like if someone needs to do a task, do I have to tell them on the phone to do the task? Not really. I don't it can be in an email and they can parse it and deal with it when the time is right for them to deal with it The synchronous stuff is strategic This is the kind of thing that you don't want to have an email thread that goes on for two weeks and has like 200 emails long to try and do brainstorming or figure out a larger vision for something that ends up being really awkward And so synchronous stuff where you actually get on the phone and talk with somebody or get on a hangout and have conversations Should be directed more towards strategic work larger picture things I Will also say that the synchronous stuff is not just strategic It's also cultural, but I'm going to talk more about culture a little bit later The point being with with this is Picking the correct mode of communication to be efficient Because a lot of people end up being on the phone all day long and then not getting any work done and it's not necessary So it's not just learning how to communicate. How do I write the words? How do I share this information with somebody? It's making sure you're using the right mode of communication at the right time to accomplish the task that you're trying to do and It really requires stepping back and actually being deliberate about the decision We spend a lot of time reassessing this on a regular basis I would say that we probably have conversations about our phone calls at least once a month or every other month Are we having too many phone calls? Should we change the way that we're doing the phone calls? What are people showing up the calls without agendas like what's going on? Or is this rarely scheduled call that was really awesome six months ago? Is this actually still a useful phone call or is it just disrupting everybody's day now? It's a constant conversation for us. It's crazy, but it's true We have been spending a lot of time talking about our communication. It's just weird So When it comes to collaboration and distributed teams and dealing with communication tools Think about it. Don't just like we I mean we send a lot of email We say email liberally in our company You should CC if you're not sure CC somebody let them handle it with their filters and stuff like that But you you need to think about the communication and why are you doing it this way? Why are you scheduling a hangout? Make sure you have a good answer for that before you do it truly disruptive to people's days and then of course we have The ultimate synchronous communication, which is actually in-person stuff getting together in the same location We do this quite often When we kick off something with a client We will often go on-site with the client for the first few days or week of a project get everybody on the same page Make sure everybody understands what's going on at the high level before we start diving into everyday tactical tasks With that client we meet at conferences like this.  We spend a week together, but all of the Teams all the departments also have retreats where they get together and focus on the tasks that they need to do and that The amount of work that we can get done in two or three days of just sitting down and sprinting together is amazing But again, we try to focus that so it's not necessarily So tactical But more like what are the what are the brainstorming things that need to happen? What are the larger issues? How do we figure out the tricky parts where real-time communication with each other is going to accelerate us a lot faster Then trying to figure out an email form and then you can split things off and then have tactical tasks that get done after the fact It's funny. We get together. We love getting together It's also a cultural thing and it's like just fun. We really enjoy hanging out with each other But after a few days of working on something once all the big picture stuff has been figured out I find at least on my team people want to go home and so they can get work done We actually want to like get back to our space in our zone where we have more control of a synchronous Communication so we can focus on work and actually just start to bang things out It's fascinating how that works This is a problem Isolation well, I hope you all know isolation means feeling like you're separated But submarining is the term that we use for people who just sort of slowly quietly disappear And you're just like there's someone on our team called Joe But what it's funny because it's it's strange how easily it can happen without you really noticing that someone has disappeared Their communication drops off. They're getting their tasks done even But all of a sudden they just aren't like a presence anymore It can happen for a lot of reasons Personal stuff going on distractions just feeling overwhelmed by all of the things like all the communication mechanisms Whatever the reasons are It's your job and you're I mean not just like owners and not just bosses Everybody on a distributed team is everyone's responsibility to be aware of this look for that and be able to identify it think about who would be most susceptible to Having these kinds of things happen. I know we've been all about our consultants. So we have on client services We have developing teams Often we have a team of people that work on a client project together. We also have consultants Architects who often will work with the client alone because the client has their own internal team And they are just there to advise them so consult with them So our consultants often work without any of them all about and it's it's right for Isolation and feeling like you're cut off from the rest of the culture and what other people are doing And even things like if I think about those goals that people are in on our team, so video site Many of us the only one video editor When we wanted to do editor in the entire company Doesn't really have anybody that he can like know it out with about video editing stuff stuff And so it's part of the team and and we all collaborate together a lot There's an element of the goals and the job that he's doing that feels different from everybody else And that can create a sense of isolation And so what I've done in that particular situation has actually hired a part-time contract Are they not You can't just say if someone doesn't go something to gamma three times a week or once a day Because everybody has a different level of communication to begin with you need to be aware of what those are The larger the company the harder to get so that's why you need everybody on the team to be aware of that Not just the manager or the owner of the company. That's just not sustainable at all Yeah time zones. We've got some How many people here work in a multiple time zone country, okay? No company Yeah, we have a lot of time zones. I'm in Copenhagen Central European we and we have team members in London and then East Coast US and Central US and Mountain US and Pacific US The time difference between myself and my my West Coast team member is it's it's a nine-hour time zone difference in the day But it works totally works for us And I said like, you know back in the advantages This is actually a really nice advantage because you have this huge range of time that people are working And so some works happening while you're sleeping and then you're working and it's great in the handoff But you have to have some rules around time zones and how they're going to affect your company or else it is really gonna bite you in the ass We have a kind of base Time zone within Lullabot, which is US Eastern time. That's sort of like, you know, it's a it's in terms of our time zone spread It's kind of in the middle Roughly in the Middle-ish so that works It's where the owners have been living for a while So like when we were smaller that was sort of the focus of the time zones at that time But the thing about having that base time zone like when we hire someone when we interview people This is already an expectation when you come to work for Lullabot You are going to have to work in what a US Eastern time zone work day would look like for at least part of the day There has to be some kind of overlap You have to have time for synchronous communication within your company How much that is is up to you But I really feel strongly that you've got to have that on a regular basis not once a week or something like that It has to be a regular thing where people can reach out and just talk to each other when they need to You need to establish what that minimum overlap is for your company We don't have a hard and fast But for example, I work In my local time zone from about 11 in the morning till around 7 sometimes 8 in the evening depending on my schedule Whereas you know Amber is gonna have to get up. She's on the the Pacific Coast She's gonna have to get up at 8 in the morning sometimes. That's just how it is But she knew that when she was hired. That's cool. That's the decision that you make Everybody's gonna have to compromise to some degree. Well, maybe except for people who live in the base time zone I don't know It hasn't been the case for me a lot And also keep in mind that just because someone's willing to be really flexible with their schedule It's that's not always good Just because someone's willing to work at 2 a.m Because that overlaps the window that you guys have doesn't mean that that's actually a good time for them to work It could be maybe their spouse like works the night shift And so their family is just generally a we stay up all night kind of thing That's cool, but you should understand that in the hiring process You know if people have like lives and families, but they really want this job And they say they'll work at 2 in the morning and they're like completely exhausted when they're trying to get work done for you That does It's not cool. I would recommend starting with a base time zone and not going Really far out of that initially, I mean within Europe three time zones and you got the kind of the whole Whole nice big selection right there. You don't need to go like crazy with the time zones I've definitely known some people who were like yay We're gonna be distributed and we're gonna hire people anywhere in the world And then you have people all over the world and nobody can ever talk to each other It and it's hard like that's really frustrating. I also I traveled quite a lot for a period of time before I ended up settling down and There were times when my time zone was further away than it really should be I have found the times that I have been in in Asia and Australia really isolating I didn't have enough time to have synchronous communication with the other people on my team My company felt that I wasn't present and I felt really disconnected You need to figure out what those what that area is and it's going to be limited I Feel at least from my perspective to be really affected at this point Lullabot generally sticks to the Americas And and European time zones It's really difficult to have somebody on the opposite side of the planet Trying to communicate with you So that's what we have at this point Also, I will say that my team being the product team is a lot more flexible Then our client services team because of clients clients expectations are also we've definitely had clients Say we do not want to work with that employee because of their time zone Because the client didn't feel like the communication was going to be enough So that has definitely bitten us in the butt before But the products, you know, I get to make the decisions I'm I'm the client and then we have culture This is a vine video it won't last I didn't I don't have a loop so you won't be distracted by it forever So this is this is a this was just made this summer At our design and developer retreat. It's one of those team retreats and This is a this is like a this is a company meme thing sometimes you'll start at the company and people will chant Or they'll type in a yammer. So it'll be like And new people are like It's just like where have I come to work? What are you people doing? So it's like it's a thing But it comes from this game that we played at a company retreat a couple years ago.  We had a really good time You play rock paper scissors and then whoever wins the other people have to get behind and chant their name and support their Champion and then you get down to the last person and then the whole company is chanting one person's name It's a fun game. It doesn't mean anything But now it's a thing But you know for new people who get hired it's not a thing and it's weird Transferring that kind of company lore and keeping the culture is really important And this is I mean this is true in any company, right? Like whether you're distributed or not again I think this is just an instance where the distributed nature of things can exacerbate a problem If with if you don't have strong culture to begin with or a good communication about it But you need to again you need to be proactive and think about creating a space for people to share who they are Create your water cooler We use Yammer people post all kinds of random stuff in there. I mean some of it's work related Some of it is definitely not But it's our place to share and it's an asynchronous place So even if I'm not online when this really funny joke or thread just you know happen The next morning when I wake up it's there and I can read it and I'm still part of that whole experience When people are like, you know, what are you eating for lunch today picture thread, you know Well, you know, it's way beyond lunch for me at that point probably but that doesn't mean lunch next day I can't add my picture so That's the space that we've tried to create for sort of our online water cooler So that everybody can again have that equal access to communication versus People in an office did this thing and I wasn't there and oh And we also the in-person stuff is really important you're going to spend money To get people together in a successful distributed company And that's what sort of like you don't have an office, but you're gonna invest that money in your people directly By letting them get together Cost money and we fly 55 people from all over the world to one location and and hang out and party for a week Cost money to do that, but it's really important The strategic stuff those larger conversations That like from a work and collaboration perspective is really important, but from culture.   You're just being you know sarcastic in written form But I mean that that's night and day it makes a huge difference in how you read people and how you interact with people Having the physical in-person Interactions with people to set the context for who that they are as a round for individual rather than just the words They write is huge So we get together a lot I'm on the Drupalize me team Education side we travel probably more than most of the people in the rest of the company. I'm also a director So I I travel at least ten times a year Most of that is to the US I have gold status Yes, that's another tip sign up for any of your frequent flyer stuff if you can have a distributed company But anyway for culture and being able to have those things pass on you need to have an Asynchronous place where culture is captured that people can access and catch up and see sort of what's going on and be a part of it And you need to have real in person Getting to know the human beings in a much broader picture than your daily work life and you really need to encourage people to communicate outside of the boundaries of the work tasks that you're doing Having fun together as a company You know and that tone is set by everybody So if everybody's only posting in Yammer about work tasks, then that's what everybody else is going to do and it's going to get really boring really fast So you need to again like actively proactively encourage that culture make sure the place is well-defined and then use it And turn it into that And you can totally teach you the entourage game. It's pretty fun We do it at every event now and the new people are always like what's going on. This is really oh Joe Joe Joe Joe So just to kind of like wrap this up. I do feel like the distributed nature of working is The future we're moving in that way our lives are online. We expect access and flexibility. I know I do in my personal life I want to be able to just look stuff up or go here and do this thing at 3 in the morning if I want to and so more and more Clients are expecting to be able to have that kind of access and flexibility and that you Are going to of course just because they don't work in the same city as you I mean, why can't you get my work done? You should be able to Employees like they expect to be able to live the lives that they want to live It's just it's it's where we're going as a as a culture And so I feel like if we want to improve our businesses if we want to be able to serve the clients that we want to serve To make our money and we want to have the teams of people that we need to accomplish those goals We need to get on the train with this and we come from an open-source community that already does this So it's strange to me that like just because there's like a business money thing involved all of a sudden that falls apart for some reason so That's sort of my my whole take We've been doing this at Lullabah for eight years And it just to me feels normal and the fact that it's still something considered futuristic is strange to me But I do think that it's something that Helping drive Drupal forward helping drive businesses forward is a very symbiotic relationship And we already come from a culture that can do this. Why shouldn't we lead to the pack with Drupal? Rather than sitting back while other people sort of try and figure this out and make it up Why can't we be leaders in how this is supposed to work and how you can do it right and how you can do amazing things? In the web world I feel like that's something we should own because it's right there in front of us If you would like to read more stuff about distributed stuff we blog about it quite a bit LB that's an L the font is just looking funny, but LB that cm slash distributed That is all of the distributed posts on our blog We talk about it a lot and I would love to talk to people We also do have a there's a conference called yonder IO I didn't talk about that a lot here. It's it's mostly invite only It's a very very small conference that we started last year, which is Distributed company owners getting together to talk about all this stuff Some of the stuff I talked about like I said we talked to you know like things We've learned from automatic and github and other large distributed companies and how they're doing things So you can read more about that yonder and stuff like that on our blog as well So I have ten minutes eight minutes maybe For questions and chatting and people sharing thoughts I'd really love to hear what other people have to say and then I'll finish up also by The classic rate your session thing to help improve the Drupal cons You guys should use the microphone So you're gonna have to stand up sorry But yeah, go to the mic go to the mic the Drupal eyes me Videos have gone from the rather tasteful 1970s orange curtains to a kind of apple-esque white background I just wondered how technically you do the white background when you don't have like a studio in each of your houses Or maybe you do yeah, we do distributed video recording, right um I use a blank white wall Other people we do actually have people every trainer has a backdrop kit But the more important thing is not the background, but it's that we have a full lighting kit So each trainer Has a lighting kit at home, and I know how to set it all up And that's what I do and then I record my stuff and send it off to the editor. Okay. Thank you Another question the one thing that blocks me and in my experience My teams around me is this doctrine in scrum especially that you have to sit in one room and Look at the white whiteboard and have post-its and not write anything and it electronically because this is so 90s so the trend seems to be having post-its on a wall and everybody's sitting in a small room What's your experience with scrum especially well? Yeah, we don't really do scrum that way I don't my team doesn't we have extremely different project management style all around though for for our projects and it's We actually don't have a project manager We have prioritization and self-assignment But we're a small team and I trust them to know what needs to get done And we do it together because it's all sink or swim for all of us But yeah, so I actually don't have a personal experience with scrum I know that there are lots of tools we used to for a little while we were working with scrum stuff And so we had like you know basically online Sticky noting things to do stand-ups like on a hangout or on a call and stuff like that But honestly, I don't personally have a lot of experience. We've we've moved away from that model entirely actually Your story is mainly based on having people as employees Do you think it will be a? Rather different when you try to do it with independent persons bringing them together on a project base and Expanding and working together. I think I Think it's less about whether they're an employee or a contractor I think the the amount of time like if it's a short-term, you know two months And you're constantly bootstrapping new people into things then the continuity ends up being a problem But I think that's just true generally It again comes back to are these people who can communicate using the tools They need to communicate with and are they good communicators And and working with them to learn how they should communicate like making it a thing an understood Task like you're not just a developer. You also are a communicator and And we can help you figure that out But it's a thing and it's something you have to do and if that doesn't work Then it doesn't work and it's more about that than it is about whether you're an employee or a contractor Hi So we are a distributed company as well. We've got people in 11 different cities There are times when there's a lot of pressure You know and productivity is not coming up and often team members have come up to me and said can we Fly back, you know down to one particular place all of us and get this job done a week and back How often does that happen? With Lullabab and if not, are we doing something wrong here? Yeah, we so in terms of like Right now like so we have the one all-company thing Right and then like my team gets together once a year and the directors get together twice a year again That's sort of that strategic thing In terms of like people who are working on projects together if it's like aside from like a client on site Our teams don't tend to get together physically to work on stuff a whole lot That said we the the owners and directors we have been talking about Modifying our budget for travel to allow for more More people getting together at different times and for it to be more spontaneous When something happens in a project and it really is going to actually get people over that hump We would like to have budget to make sure that that can happen So we I think we're still playing with the balance of that. I know a github. They do it extensively It's a big thing that they do where they will just rent out of space and send every team That's working on a project and just kick something out for three or four days and then go home again And so we've been definitely talking about how we can actually incorporate more of it But I would say again like as a rule for like specific projects. It actually doesn't happen that often right now So if you say you have no project manager, but you work with prioritization and self-assignment who prioritizes I do gives the priorities. I do I'm the sound manager right well It's in the sense. We don't have project management or project manager in the sense that I don't assign tickets And we don't we used to load up a sprint We have a two-week sprint we do this thing that we release that sprint and now it's just a constantly rotating We release every Wednesday depending on how much work managed to get done in the Dev branch and then QA before the Wednesday release Goes out and that's what's in there and we do it every week So we've just changed utterly that stuff, but when new tickets are created I review the tickets every day or if I'm not available. It's called the gatekeeper roll Reviews the ticket make sure that there is an acceptable QA Written so each ticket has to have the what what the QA is to test it once it gets through So you have to make sure that's acceptable and then basically You know categorizing it where bucket does it go in is this really important? So should it be listed as high priority? Is it a hot fix? Oh my god Go through that stuff every day But then essentially the tickets are there It's actually this is going to get into a whole big project management thing So but we actually have a road map Where there's a prioritization on like for this quarter. These are the things that we want to accomplish as a team But people can work on anything they want So if they're getting really burned out on working on the new library page Then they can go find something that they just are excited about or bugs the crap out of them And they can go work on that for a couple of days and refresh themselves So I don't tell people what to work on. I just we just communicate what we all think is important It would make us sad if it doesn't happen Hi I have two quick questions of us from your blog is a share that what kind of collaboration tools that you guys are using a little book for like, I don't know my club and then communication You know social internet and the second question is is it mandatory to have a good internet connections to work for? For European and US people that's pretty big you take it for granted to have internet connections but Like most of the rest of the world doesn't have a questions Because I've been doing this You know communications and then the biggest problem is trying to use Skype to have a good communication with other people in less You know less developed country that no connect internet connections. Yeah, good question. So first question We use a lot of tools and we're kind of constantly reassessing the tools that we use I could give you a list now and six months later. It could be different But we do like right now. We use Yammer for our internal communication At this time We use IRC for chat. There's been a lot of talk of slack. We've looked at lots of different Chat tools and it's you know, it's a bunch of nerds We play with every new toy that comes out and see which ones are going to work for us And then we get into heated arguments over which one's better and then somebody comes in and says no we're using this and Then you know six months later, we reevaluate it all again We use hangouts pretty extensively now lot of Skype and I would say those are kind of our Main tools Big stuff, but like I said, there's We're always playing with tools sort of keeping your eye on that like I remember when Yammer came out What is this thing? But now we use it. It's like a backbone for our communication And then people get really pissed off and we go try and find an alternative and then we go back to using what we're using So yeah in terms of I mean I think on that in our in our blog We may talk about some of the tools, but it changes so much that it's not like we have like a list of tools We use because it can change quite a bit In terms of the internet connection thing Yeah, you got to have a decent internet connection At least for part of the day when you need to have synchronous communication. It doesn't have to be all the time. I lived in In Montevideo, Uruguay for a while This is that beauty of you know, it's winter time I'm gonna go live in South America because it's warm And it was great. I lived down there for about two and a half months The internet was shit It was really hard and I ended up in an internet cafe for phone calls You know for a few hours pretty much every day I went I did that thing and then I just went and worked mostly offline the rest of the time But it was frustrating to me because I'm used to just oh, you know internet should just work Anywhere you go in the world Doesn't quite work that way But I would say so yeah, it's difficult. I think to be distributed again without being able to have synchronous communication at some point It doesn't have to be all the time And if it's if it's if there's Problems with internet for the communications on like that It's a matter of just setting up a schedule and the time and making sure that you do create the space and that people can do that I feel like you need to have that to some degree, but you think you can get creative over how to handle it Yeah last question Hi, thanks for a great session I have a question about office space Even though you're a distributor company I know a lot of employees would probably prefer or at least I know a lot of freelancers who prefer working in a shared office space Do you support that or is it strictly your work from home policy type thing people work anywhere? They want so and I know some people and while a bot do like to go to a shared space A lot of people like to go work in cafes So they're around other people or there's other things that are happening one of the things we are discussing is To supplement funding for that for employees who do want to have a have a works a shared workspace To help them before that Because it is you know part of their their work. I'm not sure where The conversations on that are but it is something we're discussing is to actually financially support that for people Okay, but you haven't for the past eight years. No, but we haven't yeah It's it's been if you want to do that. That's great your choice. Do what you want Very quick question How do you? Differently define a set of freelancers working together versus a distributed company And is that just who pays whose tax or is it is there more to it? Wow, yeah, this gets into a whole other world of the distributed company, which is HR and administration and that is It can be a pain I guess it depends where you are in the US if you are in different states things like health insurance companies like to work in regions Not countries And so even within the US even if you're in the same country and you have people in different places It took us it took us over a year to find a health insurance company that understood what we were trying to do And would help us but so in terms of like yeah, like an employee It's like who's handling all of that stuff all that overhead And that that is a whole other world of stuff you have to figure out with a distributed company first of being contractors And everybody figures it out on their own and that's cool Not everybody who works full-time at Lullabot is an employee And that's because setting up HR and admin and taxes in every country is expensive and annoying So we have Employees and we are set up for payroll in the United States Canada the UK and Denmark But we do have people who are working in Spain and India, but they are contractors Because we are not set up for payroll there so And it's the kind of thing that Again, we sort of need to have like a It just becomes like a An investment question in terms of how much money and time we want to set doing that But yeah, so we do actually have technically they are contractors, but they are Treated as an employee culturally communication wise we fly them with everybody else all of that kind of a thing Cool. Thanks everybody Enjoy your con


Welcome to the GATT, the podcast for enterprise leaders delivering timely insights for today's global economy and tomorrow's competitive advantage. I'm Chris Kane, president of the Center for Global Enterprise. And this week, we will be re-releasing key episodes from 2023 that we believe are very topical and on the minds of you, our listeners, given the challenges confronting business leaders around the world. Welcome to the GATT, podcast for enterprise leaders delivering timely insights for today's global economy and tomorrow's competitive advantage. I'm your host, Chris Kane, president of the Center for Global Enterprise. And today, we will be discussing the pluses and minuses of President Biden's recently released National Cybersecurity Strategy with Sam Palmosano, chairman of the Center for Global Enterprise and former vice chair of President Obama's commission on enhancing national cybersecurity and Karen Evans, managing director of the Cyber Readiness Institute and former CIO of the U.S. Department of Homeland Security, as well as a number of other cybersecurity leadership roles in the U.S. government. Sam and Karen, thank you for being with us today. In March, President Biden released his administration's new national cybersecurity strategy. This followed a number of executive orders and other actions that he has taken and other governments have taken around the world. It is the latest in a series of movements in the regulatory and legal responsibilities for companies to take proactive steps to defend against cybersecurity incidents. While the Biden plan may be the most ambitious we've seen thus far, other governments are also advancing new regulatory requirements. For example, the EU has proposed new regulations that would require any device connected to the internet to have security features built in. So, after years of relying mostly on voluntary efforts to encourage companies to shore up their cyber defenses, these government and regulatory developments seem to be examples of how regulators are deploying new tools and incentives to mitigate cybersecurity risks. Should the Biden plan become policy, companies can expect to face new regulations and lawsuits perhaps if they fail to make secure products or do not enact basic cybersecurity measures. It seems that business leaders must prepare themselves now to operate in a global economic environment with increased cybersecurity requirements and liability. So, Karen, perhaps we can start with you. What are the pluses and minuses of the President's plan if the goal is to get companies to implement new cybersecurity capabilities and to increase their state of cyber readiness? Well, I think what the Biden plan outlines is a real change in the paradigm. There's a lot of things, as you said in your opening comments, Chris, that we've been trying for gosh, a micro over 20 years. And so like what's old is new again, but it is trying to shift some of the responsibility away from the specific consumer on to product developers, on to software developers so that they're more responsible in the ecosystem as they go forward. Sam, your thoughts on pluses and minuses from the President's new strategy? Yeah, I would agree with Karen, Chris. I mean, back to the Obama commission, one of the things we talked about heavily was design security from day one versus make it an afterthought. And of course, the debate is slowing down innovation and therefore more cost if you do it this way. And we argued though, not necessarily, not if you design from day one. So to her point, put more onus or emphasis on the products themselves in the future and then therefore have the stick, I guess, in a way because if you don't comply with the regulations that the government potentially could impose, as you know that they haven't, this is just the strategy paper at this point in time. But then there would be financial risk associated with lack of compliance. So the plan has five pillars to it. And the third pillar really is what I think I'd like to focus on today, because it probably is of most interest to our business leaders in the audience. And it's about shaping market forces to derive security and resilience. And Sam, to your point, one of the fundamental elements of pillar number three is shifting liability for software products and services to promote secure development and practices. It's an interesting model, i.e. being a stick model, perhaps you could argue it's probably both a carrot and a stick to get market forces to act in a different way. Karen, I wanted to ask you something about the CRI and its mission and how it relates to this pillar number three. Part of the plan that the president has proposed embodies a statement, the following statement. Today, end users bear too great a burden for mitigating cyber risks. Individuals, small businesses, state and local governments and infrastructure operators have limited resources and competing priorities. Yet these actors' choices can have significant impact on our national cybersecurity. And this is the quote that I find most intriguing and especially relevant to the Cyber Readiness Institute's mission and approach. Our collective cyber resilience cannot rely on the constant vigilance of our smallest organizations and individual citizens. Do you agree with that statement? Well, I do agree with the statement and I'm glad you asked me about that because when the strategy came out, I actually wrote a blog post about it because I would be excited if we did shift the paradigm so that some of the software developers, and as Sam said, that we shift some of the responsibilities away. So I would be happy if CRI's Core 4 became the Core 3, which deals with one of our Core 4 issues is automatic updates because this is part of what a small business has to do. They don't necessarily understand all the updates that come out from software vendors, but we do tell them, hey, you need to apply them. In this particular case, if it's really done from the beginning, the thought would be that these automatic updates would actually cut back, that you wouldn't need to do it every week. There are certain vendors that we all know that they release patches every week because of what they're doing. They don't have the resources to be able to test the impact of what these patches are going to be. So we error on the side of saying, hey, you should do the automatic updates. I would be happy if I had to come up with a new fourth area where we cut down to three areas and have them focused on those three areas that they can do, which is related to the human behavior because there's enough things that are happening around email and trying to use phishing emails to exploit and do a whole bunch of social engineering that if we could just be focused on that, that would help unto itself if the rest of industry does their part. So Sam, when you were Vice Chair of President Obama's Cybersecurity Commission, there was a large focus on the federal government and what the federal government could do to protect itself and build resilience.  In this context, from what you've learned through the Obama Commission and what you see in the president's new national cybersecurity plan, what are some of the lessons learned coming out of the Obama experience that could help make the Biden administration's initiative here achieve greater results? Or what are some of the areas that concern you about gaps in execution? Well, Chris, a couple of different things. First of all, I think we need to simplify what we can expect. Let's start with the small business we're caring was we can, and she mentioned a lot of the expectations from those organizations because they are most vulnerable and they have no resources to really implement complex solutions. So in many, many ways, we need to take the lens, I'd say, of the smallest, most vulnerable in the technology areas of these companies and then work to the bigger companies. The bigger companies have the resources and the expertise and money and they'll do the best that they can do, in my opinion. However, it's the other area that we need to focus on. That's why we created CRI and Karen is running that for us. But that was the whole point of that. The other thing is I really do believe that you needed a combination of marketplace incentives as well as government oversight and regulation. Both are required, by the way. So not the meaning, this approach, which is more leaning towards the government approach or through inspection or procurement and those sorts of things versus the other. But we always believed in the Obama commission that if you had a way to be, that there was a positive gain to invest in cyber, i.e. insurance as a mechanism so you could get insured, therefore cover some of your risk and your liability, that would help drive adoption faster than strictly over the government regulatory mechanism to get the necessary investment made to prevent these going into the future. So one of the things that's in pillar three of the president's plan touches exactly on the cyber insurance area, Sam. And I'd like to ask both you and Karen about your thoughts about one, the concept that the administration is proposing here, which is to create a federal cyber insurance backstop in their words. And it goes on to articulate the fact that the administration will assess the need for and possible structures of a federal insurance response to catastrophic cyber events that would support the existing cyber insurance market. In developing this assessment, the administration will seek input and counsel with Congress, state regulators and industry stakeholders. Karen, maybe we could start with you from the work of the CRI. What is your assessment of where the cyber insurance marketplaces today and will an initiative like this from the federal government accelerate the development and the robustness of the cyber insurance marketplace or will it return? Well, the cyber insurance market, cyber insurance itself is really evolving. And I think what if you really take a look at this, some of the bigger insurance companies, you know, we're starting to back away from some of this. This is why the administration has this in there, because if you can attribute or do attribution for an attack to a nation state, then the insurance companies are saying, hey, we shouldn't have to pay for that, that the federal government should actually help defend, as Sam was saying, the most vulnerable. And a lot of times the most vulnerable, they're in a supply chain, or they're somewhere in the distribution or the ecosystem for larger companies, which then becomes the opening into those larger companies. So everybody is really interconnected. I think as this moves forward, and I know Congress is looking at it, and there's a couple ways to look at this problem, they're looking at legislation, in order to be able to incentivize it to be able to put some tools. I personally think it should be part, this is Karen Evans, this is part of the work that we're doing in CRI, that it should be part of the business insurance. I'm a small business myself. And so it should be part of business insurance, and that maybe this whole evolution of cyber insurance, because companies see that gap, and they're going into it is actually going to even cause more of confusion for small and mid-sized businesses thinking that, okay, my business insurance, this is I use technology in my business, and my business insurance should cover this, how much should it cover? And I think that that's part of what Sam is talking about too, is because no business doesn't use technology today. It's the way that you use the technology and how you go forward. And this is why CRI, again, you know, I really love the mission space, is to be able to help small and mid-sized businesses really understand what some of these business issues are. But as we've been talking all along here, it becomes a choice of where are they going to apply their resources. And to get an additional insurance policy, when you don't really understand the landscape overall, you're going to opt to the side of accepting the risk because you don't understand it, and you're going to think it's covered by your business insurance. Sam, thoughts about the insurance marketplace? It seems like it has been slow to develop in the cyberspace. But on the other hand, Karen's point about, well, maybe it shouldn't be a category end of itself. Maybe you ought to be a category, a subcategory of business insurance generally. I actually think it's a pretty good suggestion that Karen brought up because the problem is if you have a unique policy, then you have to come up with the guidelines or risk factors associated with the unique policy. And then, therefore, I'd say the mechanisms to audit whether the company has put those mechanisms in place. If you make it as part of your standard risk practices, from a company perspective, you should view this as just another element of risk that you'd have in your business. And therefore, that should be covered as well. Now, there's a lot of hesitancy, and I do understand that, as far as the insurance companies are concerned, because they don't have the mechanisms to actually assess risk and damages. In property insurance, Chris, it's easy to assess damage.  If your brand is damaged because you've lost some data, how do you assess that damage? And although we would all say subjectively, yes, of course your brand is damaged because you can't be trusted, but how do you financially quantify that? And that's part of the challenge, I think, to defend the insurance industry that they have is how do they actually put together a policy that is assessed risk and can therefore cover the associated damages in event of cars. So do either of you see movement on the ability for the insurance industry to figure out the model that makes assessing the risk more immediate and more practical? Karen, have you seen any movement? I think that there is movement with some of the companies that are actually moving forward trying to do the assessment of risk, right? And so there are certain companies like risk recon, like Bitsite, there's like three or four other of them, that if you use that in conjunction with some other services that you can get a more holistic approach of how people see them, right? And there are a lot of companies that are also emerging as it relates to supply chain, because as Sam said, it's one of many risks that you have to look at your trading partner. The other point that I wanted to bring up, which is in that national strategy of what you read, Chris, is that people are hesitant to establish some kind of backstop in this particular area because it's like, oh, are we going to end up incentivizing the wrong behavior? And are we going to say, oh, okay, if cyber insurance develops as a separate instrument unto itself, okay, well, I'm not going to buy because if there's a catastrophic issue and it's related to a nation state, and I haven't really done my part, but I'm part of that overall landscape, well, then I can tap into this pool. And so I don't have to invest my own resources. And so this is part of that balance that I think Sam was talking about is like, how do you really go forward and construct it in a way? And we've done it. There are other models that we can look at more in depth. For example, and I think they talk about this a little bit, but I know we've all talked about in the past when we're looking at this is flood insurance. And a regular insurance company isn't going to ensure you if you live in a flood plain, but we want to develop flood paying so the government becomes a backstop if you're living in a flood plain. And so that one's pretty easy. But as Sam points out, it's really hard in an automated technology area about assessing the risk and what is the damage? Sam, any movement that you're sensing from? And I guess the question I'd add on for you is is there a role for technology here? Are you saying technologies come forward that will help the insurance industry automate the risk assessment? Yeah, because a couple of different things. Well, one of the things that we recommended in the Obama commission has actually been implemented, which is you might argue much of our surprise given there are two different administrations after President Obama. But fundamentally, a lot has been done and a lot of progress has been made. Insurance has been the slowest, in my opinion. And we've worked, we've met with a bunch of different companies myself, folks from Homeland Security and CISA met with a bunch of the leaders of those companies and the like. And yes, it is a difficult problem. But I also think at the end of the day, there's an economic consideration going on, although no one ever admits that. And they just can't see the economic value of having this type of unique plan. And maybe if it's embedded in their normal business insurance practices, there would be economic value as far as they're charging mechanisms, that's my point, when I say economic value. Now, I mean, I'm cynical, so I'm assuming there must be something because you imagine some of the big insurance companies perhaps would have done something significant by now, and they really have it in my observation. So the other thing I thought that I'd have, which is create a competitor, which always works, that somebody they have to chase, and maybe like it's in the early days of credit, it's established in the Commerce Department or Treasury or someplace like that. And it's a temporary mechanism, where all of a sudden there's an alternative to them. And then perhaps they will respond because competitions that are the marketplace. I find that a lot of these large institutions don't move quickly when it's just government pushing them to do so. We've broken this episode into two parts. In part two, the discussion is around data stewardship and responsibility, software security and liability, and cybersecurity market forces versus regulation. With Sam Palmisano, Chairman of the Center for Global Enterprise, and former Vice Chair of President Obama's Commission on Enhancing National Cybersecurity, and Karen Evans, Managing Director of the Cyber Readiness Institute, and former CIO of the U.S. Department of Homeland Security, as well as a number of other cybersecurity leadership roles in the U.S. government. There are two other elements of Tiller 3 that I think are worthy to talk about before we move on to some more general questions. One would be, Sam in particular, there's a section in here about holding the stewards of our data accountable. It talks about how organizations, when organizations that have data on individuals fail to act as responsible stewards for this data, they externalize the cost onto everyday Americans. I know that you have been leading an organization of leading companies, and it's called the Data and Trust Alliance. We've had actually episodes on this before, but it seems to me that the President's cybersecurity plan has validated the mission and the motivation for starting the DMTA. Could you talk a little bit about what you see the companies and the DMTA and the marketplace doing along this lines of being more accountable stewards? Chris, it's an excellent point. Since we started the initiative, they've addressed multiple areas around data issues, especially in the point of view of bias within the data, and there are 25 extremely large companies. If you add them up, there's over 7 million employees, so they're very large companies. The CEOs participate to build a little bit on your point, but having said all that, they came up with a whole set of processes that affect HR and procurement and how they operate, dealing with the transparency of the data there for the bias in the data, so that you don't have bias reflected, whether it's in hiring, promotion, pay, all the associated practices around human resources. They've also done more work around mergers and acquisitions to have a data practice, so you analyze data as an asset component to that to ensure that you are avoiding a lot of the risk that could occur if you buy companies that have not had, I'll call it, appropriate protections of that data. The last one that they're working on today, quite honestly, you think of the providence of the data itself. Where is the source of the data? The importance of that, Chris, is because the issue with the sourcing is the transparency, so that regardless of how you apply it and how it's used, you talk about where it came from and how it's being used, and therefore how your business benefits as a result of that. I mean, it gets down to one word, which is called trust, and more and more, if you look at these regenerative AI solutions and technologies that are out there, it's going to get down to trust at the end of the day. I think business has a role to lead in that environment versus rely on government regulation to figure out how to actually do this. Karen, as the former CIO of the Department of Homeland Security, you have any thoughts on the accountability of data stewardship? I have a lot of thoughts in this area, and I appreciate everything that Sam was saying, but I can tell you, in my former role, I had the opportunity to actually handle our incident response as it relates to SolarWinds. And one of the big questions from our oversight committees was, how come DHS didn't be, how come they couldn't detect it prior to private industry seeing it, right? And the challenge is that our data stores aren't as vast as private industry data stores are. We just don't have them. And if you follow a lot of this process, what ends up happening is all the companies, and I believe in market forces myself, are saying, sure, we'll give you access to that data for a price. And everybody's arguing back, saying it's my data in the first place, so I should be able to have access to my data. And so that's part of the data stewardship here. If you're going to hold a federal agency accountable to really manage the risk and manage those services and keep them running, regardless of what is happening, then I have to have visibility into my own data. I'm not saying give me access into everybody else's data, but I am saying you have to give me visibility into the services that you're providing for me, because I can't do it all myself, right? So this is a partnership with industry, but I have to be able to analyze my own data. And the other part that they're talking about with this, which I also think, if we get all the way back to our original discussions, is when the credit bureaus were all hacked, and then they passed on the cost of remediation of everything they did on to either the users of that data, which is every company, anybody who does anything with credit, and the actual users themselves, and then me as a user is responsible for cleaning up my own data, which they end up reselling and jacked up the cost because they had to do remediation on their infrastructure in the first place. So that's got to stop. And I don't know, without working directly with industry, what is the best way to move forward to make sure that the data to Sam's point, you can trust in it, but that it's being protected appropriately. Okay, so before we move on to more general questions, there is one last section of tiller three that I would like to go a little bit deeper on it. We touched on it very quickly, which is shifting the liability for insecure software products and services. And for our listeners who happen to be in the IT services and software business, this is particularly important. Sam, let's start with you. How do you envision business models and business operations changing in the software and IT services sector if this liability is now shifted over to them? And if the administration in its own statements is successful at working with Congress in the private sector to develop legislation establishing liability for software products and services? Well, Chris, I'll start with the first thing, which is how do you define liability? And the problem is, as you know, it's a combination of the provider and the user. So is liability only on the provider of the technology or the services company offering the technology, or is it how people use the technology? I mean, for example, people that misuse technology in multiple different ways in society, you tend not to penalize the provider of that particular kind of technology, whatever it happens to be, because they use it multiple different ways, and you just really can't limit its usage. So my point is, though, it sounds like a very good thing to do, you know, right? Because, therefore, it would stimulate quite honestly this idea of design security from day one, design it in day one, which is really the goal. I mean, if you had security designed from day one, it would just make it more difficult for the people to hack into these systems. Look, it doesn't mean it's going to go away, it just makes it more difficult and therefore more sophisticated, more expensive. So a lot of these small things that occur probably won't occur. Having said all that, the definition of liability, you could just create a whole series of litigation, which the trial lawyers would probably love by the way, you know, right, that no one can conclude whether it was the product itself or the use of the product itself. So it's really a hard thing to do. I think quite honestly where I would start on this is not on worried about imposing liability. I would encourage a stand-in around what it means to design from software from day one, create the built materials for software so you can expect the vulnerabilities are, and then the companies that do that well should be rewarded and then the ones that don't should be penalized. I mean, I'd come at it that way versus create a whole new segment of the legal industry so the only ones benefiting are the trial lawyers. Yeah, hopefully we can use a model and create incentives for a race to the top as opposed to the race to the bottom, which is trying to mitigate and eliminate risk and liability exposure on behalf of a company. Karen, any thoughts on the software industry and what kind of models and operating changes we're going to see if this goes through? Well, this is one of the ones that's what is old is new again. And at a high level, everybody agrees with everything Sam says. At a high level, everybody agrees secure by design. And a lot of these fit on a bumper sticker like secure to market versus first to market. The challenges in the definition, they'll get one level further down and talk about due diligence. And, you know, if you can define the due diligence and separate out the issues of what Sam is saying, like did the developer, the software provider due due diligence, and then was it used by a criminal element because there was something in there that they hadn't thought about and it wasn't exploited. And that has always been the rub moving forward. One of the biggest things that came out when that strategy was actually released is there is a part of there and it talks about harmonization of regulations. And so the industry folks are actually asking, are you going to harmonize regulations first and then issue new ones where you seek out? So are you going to issue new ones and harmonize later? Because if you issue new ones and harmonize later, that's going to like increase the cost. Now we're full circle back to the other questions that you're asking is, you know, I'm going to have to pass on that cost to the consumer in order to be able to take it to market. And can I actually get these principles built into the culture of my organization in order to be able to develop it in a way that, you know, I've done everything I can that's humanly possible to secure this so that a small business can implement and not necessarily have to think about it. Seems like it's a huge challenge, but one that's so structurally important that we have to do something around it. It won't be easy because think about all the discussions on date of privacy and any trust, how long they've gone on. That'll be short cycle relative to this. Yeah, this is probably a little bit more pervasive. Everybody in the world, as Karen says, has a point of view relative to this. Trying to put that into legislation is going to be pretty hard to do. Let's talk a little bit about some market oriented or general things that the U.S. actions and cybersecurity like that president's new strategy, as well as those actions from other nations around the world seem to be telling us that there's little appetite for allowing companies to voluntarily opt in when it comes to cybersecurity.  Do you think we've come to the point where market forces are no longer enough to encourage organizations to take the appropriate steps to protect their own businesses? So will we have more of a command and control approach to regulation than we've had thus far? It seems like based upon our conversation that you see that happening, but just relative to government actions, do you see this trend not only moving forward but being locked in? Karen, how about if we start with you? So I'm going to go to the Karen and a stick approach here. I do think the whole idea of voluntary participation or voluntary opt-in, I just don't see that working because we've been trying it for the last 25 years. And so some people do it well, some people don't. I do think as you continue to go forward that some type of regulation is going to happen. So you can either be part of the solution and get ahead of it. And I think some of the incentives of what the federal government in the United States can do, and I think other governments are looking at this to see how the United States implements it, is the incentive of the federal marketplace itself. It's a big chunk of change as it relates to acquisitions, over $70 billion in the federal market. And Congress has given it several different tools to be able to implement secure products. So the piece then gets back to, okay, if I have the money because there's a modernization fund now that has like billions of dollars in it, and I have different bodies that allows me to take intelligence information, mix it in with acquisition information, and then give guidance out. Now how do you incentivize businesses to actually then deliver the solutions that the federal government needs? And that's through the competition. So if you know you can win a contract and it's not mandatory, so it's optional. You don't have to participate in the federal market. But a lot of companies do and they want to have that business. I think that's where you can get some of the incentives and drive some of the products because they're going to have to develop them for the federal government. You're not going to maintain two different development cycles. You're going to try to gain as much efficiencies as you can. And I think that the way the federal government's going to move forward is, okay, we'll put our money where our mouth is and we're going to only buy these types of products. Yeah, that will be an important milestone. The federal government and its purchasing power has always been a major factor in economic and societal change in many respects, and the ability for it to act as an incentive or a catalyst for marketplace response will be very interesting to see how quickly that can materialize. Sam, any thoughts about the marketplace and opt-in forces versus conscripted requirements? No, I'm more curious. Let's take the administrative side of a government because you have to separate out the defensive intelligence. But let's take the civilian side of government, dot gov, not dot mill. Actually, within the procurement guidelines, they also could become a standard for corporations as well. I mean, if assuming that it works and it doesn't impede innovation, then I think you could see the adoption rate move from the government into... They'll give me an example in the PC industry. When the government started purchasing directly, that actually lifted Dell. I mean, that was their first user base was the government, right? Now, everybody just buys everything electronically. It started in PCs, but it's gone everywhere, I needless to say.  So that's my analogy I'd make here. So I sort of agree with Karen now you have to separate out intelligence and defense and all the rest of that here. Let's just take commercial environments. I think she's right. And I think that could lead to more kind of a commercial adoption. But that's the carrot again versus the stick because you can decide you don't want to sell them in governments. And that's fine. You can decide you don't want to sell the large companies. I mean, nobody's making you do that, right? You could define your market as something else and then be very happy there. Now put ourselves in the seat of that CEO or business leader who has this opportunity ahead of them to either follow a carrot strategy or a stick strategy. What questions, Sam, if you were a CEO, would you be asking your board and your senior leadership team today about cybersecurity and how your company is going to be positioned both in the marketplace as well as in the regulatory compliance environment? And then Karen, maybe we can come to you. Yeah, I'll start. I mean, basically CEO or the board, whatever perspective you want to take on this, Chris, fundamentally it's risk. It's no different than all the other factors of your enterprise risk. And all large companies and mid-sized companies have enterprise risk models today that are broader than just strictly financial risk. They're much broader today as result of some of the other areas of we've had problems with in the past. This is just part of that. So part of that process in the corporation, it goes through the audits of all the other areas of risk. It's rolling off to come up with an enterprise level model. A lot of that came out of the LA financial crisis because they lost control of the risk factors in the banking system. And we're seeing that again, by the way. But nonetheless, fundamentally, that's how you should think about it as enterprise risk. There's audit, there's controls, there's the board level function, there's committees of the board. You know, all that stuff already exists. So I would just include that as part of that. Now the other thing I would do quite honestly is I think you need people on the board who can ask the right questions when they come into the board or on the audit committee when they come in. And so therefore the skillset of the, it could be a CEO with a technology background. It doesn't have to be a deep technologist per se, but at least they understand the issues and can ask the right questions to make sure that there's a check and balance in the process. Karen, some of your members in the cyber readiness institute at the largest corporations in the world and certainly some of the most revered brands. What questions should their CEOs be asking of their board or their senior leadership team to make sure they're positioned properly? And not just the CRI members, but of course any corporation? Well, I think it's the same question over and over again. And this goes back in my history. You alluded to this. I think, you know, my government experience just never goes away. I had the opportunity, Chris, to handle the very first hacking incident in the federal government in 1996. And it's what happens in the immediate aftermath. And so when you ask, like, I love serving on audit committees and people think I'm nuts, but that's usually, you know, like the question I ask, it's not what's going to happen 30 days later. Everybody's really good at the 30 days later. It's like, what happens?  What happens within the first 24 hours of an incident occurring? And most companies have a hard time answering that question, like who's in charge? You know, what's the communications plan? How are we going to respond? Like everybody kind of goes off and does their thing, but the CEO is the one who has to answer. In my case, it's always the secretary of, you know, of the department or agency that has to go out and talk publicly to the president of the United States and to the American people. And it gets back into the trust. So what happens within, you know, the first 24 hours and nine times out of the 10 companies can answer that question of who's in charge and who's leading in the first 24 hours. Yeah. And Chris, what I would do is once you establish it, you have to rehearse it. You know, you have to practice this. A terrible thing was 9-11, but at IBM, we had disaster recovery as part of the process. Who to convene? Who led? Who knew? Who called? So immediately when that popular plane hit the tower, the system just kicks in. And we got the people, all the stuff that goes on, including getting all the people out of the city, right, has to happen. So, I mean, it's no different with that to me, to Karen's point. All those processes need to be established, and then they have to kick in immediately, whereas the manager team knows exactly what to do when that occurs. So Karen, if a company wanted to establish that playbook and then also do those rehearsals, are those the kinds of things that the Cyber Readiness Institute can help with? Or do you know of other parties that could help? Well, absolutely, especially, you know, we're very focused on small and mid-sized businesses, but I do know large companies that have talked to me about using our materials, because our materials are offered for free. We do put together a playbook. And the way I describe it is, when you finish the CRI program just around these four core areas, which is automatic updating, phishing, multi-factor authentication, securing, removable media, you end up with a business continuity plan. And so a small business or a large business means some of the large businesses that I've talked to, they use it for their annual training to Sam's point. And then they exercise it out to see if people really know, you know, okay, if it's a small one, how does it continue to escalate? How do you handle this? And then, you know, we have sample communications, emails, things like that, that you send out. And the reason why I'm really excited about it is because it's not the dollar's commitment for small and mid-sized businesses, it's actually the time commitment to understand because then you're creating a culture. So as you continue to grow, because we want all small businesses to grow to be medium and then large, you've already established this culture. So it's just, you've got the core pieces and you keep building the pieces, like Sam said, more and more onto it so that all the risks associated with the enterprise then can be addressed in your business continuity plan. So you want to build cybersecurity muscle memory? Yes, I do. All right, well Sam and Karen, thank you for being with us today. But before we leave, we always like to ask our guests to give our listeners one strategic insight to consider. And we call it our emerging critical issues moment. And in one word or one phrase, tell us what issue you see on the horizon doesn't necessarily have to be about cybersecurity, but since we've been talking about it, feel free to go there. What issue do you see on the horizon that business leaders need to put on the radar that they may not be doing so today? Karen, why don't we start with you? So mine isn't necessarily going to be about cybersecurity, but it is going to be about an issue that we covered, which is the reliance or the use of machine learning artificial intelligence. I would answer the question and say why answer the question. I've been a lot of these large CEO events and they asked me about cyber. I say you should assume that somebody's already penetrated your systems. So what do you do about it when you leave here tonight? How do you build that muscle memory of rehearsal? I just believe some foreign entity of some kind is already in there, especially if you're doing anything in technology or biologics or pharma or finance and critical industries. You just have to assume they're there whether you know it or not. Okay, great. Thank you very much. We'll come back to these insights and future shows, but I want to thank you very much for your taking the time to be with us today. You've been listening to The Get, sponsored by the Center for Global Enterprise, celebrating 10 years of convening global enterprise leaders around the most important business transformation issues.