What have you learned? What would be your top one, two or three lessons from dealing with the cyber crisis?

In many ways, it's the same as dealing with any crisis, that the problem's never as you first think it is, or as it's first presented to you, and that you will be working in an environment that's dynamic with incomplete information, with stressed individuals, not the exact team that if you planned it would be there, or someone will be on holiday, someone will be uncontactable, all of those sorts of things.

So having pre-agreed processes and structures, and having built a bit of that muscle of working under stress through whether it's simulations or whatever, I think one of the key things I've learned.

I think that communications is just absolutely critical.

The technical problem may be manageable, but how it's communicated, the narrative internally, externally, with regulators, stakeholders, it's a long list.

Because I've seen organizations manage an incident technically, but have lost control of the narrative.

But what do you think makes a good lawyer in a crisis? Yeah.

Yeah.

hill.

And the board's job and the chair facilitates making sure that we create an environment where management can tell us what's going wrong, what they don't know, what they're concerned about, and where we can have a really constructive debate, bringing in those different perspectives.

And walk away with management having a very clear understanding of what is concerning the board, perhaps thinking about things differently.

I think good boards help lift management's eyes up and out.

You have to be very deliberate in looking out.

And so really good directors and chairs ask really good questions, and the chair then synthesizes it so management walks out understanding where the board sits.

And board agendas are finite.

What do you think?