The Data Stream – Episode 10 with Craig Hoffman

So last question, setting aside AI, since I know we spent quite a bit of time there, What should organizations be paying more attention to right now? What's that one thing you'd tell every in-house counsel to pay attention to today?

It's not new or different or unique.

It is risk assessment and governance.

If you talk to security experts, you might hear them say, right now is really dynamic.

You have to be fluid.

Things are changing rapidly.

When you hear things like that, that doesn't reassure people and that doesn't allow people to have an approach or a method to address the risk.

And I think taking that kind of, it's fluid, it's dynamic, it either leads to people throwing their hands up and saying, well, why try? Because I'm just going to be overrun by AI.

If you look at the tools you're using and your program and your data and use some data about incidents occurring, you can come up with what you think your most significant risks are.

You can look at your existing controls and decide how effective do we think our controls are at mitigating that risk.

And that can help you identify areas where it makes sense to spend more time and effort improving your controls and your approaches to further mitigate your more significant risk.

And you can continue to update that quarterly every six months or so as technology and use of technology develops, that helps you have a consistent approach to it.

And it's also something you can use to explain if something does go wrong.

Here's what we tried to do to avoid this.

Maybe we weren't perfect.

Maybe we didn't get it completely right, but it wasn't because we didn't try and do it the right way.

That kind of explanation goes a long way with third parties like regulators.

It may not help you as much in litigation, but it at least arms your, if you need to engage an expert to talk about your standard of care, it gives them something to use to say, this company had the right program.

They were trying to do it the right way.

Maybe it wasn't perfect, but that's not the standard.

Fantastic.

Well, look, I don't know.

I find that somewhat comforting, which is to say, if we keep the governance and risk-oriented fundamentals in place and stick to process, odds are you'll have a better outcome.

As I said, I find that somewhat comforting at least.

But Craig, thanks so much.