What board directors admit about their cyber skills
Powered by Single Fin
Welcome to this week’s edition of CIOsurge!
In this edition:
Steven Singer on the call list that didn’t hold up to outside scrutiny
Why restoring a system and trusting it are two separate problems
Only 36% of directors are very confident in their board’s cyber skills
Stay sharp. Stay ahead.
Getting IT Ready for a Private Equity Sale
A lot of CIOs in our community work at companies that are PE-owned, part of a roll-up, or heading toward a sale. Steven Singer, CIO and COO of a 110-plus-year-old food distributor, has been through a couple of these events. His first lesson is about the documentation nobody thinks about until due diligence.
His team was well documented on business continuity and disaster recovery. The gaps were in the small stuff.
“Like who is on the call list? Who are you calling? Did you keep it up to date as people transition jobs and roles and titles over the years or even change phone numbers?”
Buyers look well past the surface-level financials. They want to see processes and improvements, and an outside auditor will spot habits an insider has stopped noticing.
“And when you’ve worked somewhere for so long, you get kind of tunnel vision on, this is just the way we do it.”
His second lesson is to find your technology debt before the buyer does.
“Know your technology debts up front. You’re going to have them and know where they are.”
Many of those decisions probably predate the current CIO. What matters is that your three-to-five-year plan is detailed enough to show how you’ll get out of them. Steven uses laptop refreshes as an example. A CIO might plan a four-to-five-year cycle, an owner might stretch it to six or seven, and a PE firm with more operating capital may simply want everything replaced. When the buyer uses choices like that to push the valuation down, you want an answer ready.
“You can say, you know, here’s what we were planning on doing, and here’s the explainable variance that allows us to say, this is why we didn’t do that, right?”
He also flags the CIO-CFO relationship. Buyers will check whether IT and finance budgets actually line up, or whether miscellaneous spending is scattered around the business.
The takeaway for technology leaders: run your IT organization as if due diligence starts next quarter. Update the small documents, write down your technology debt with a plan to retire it, and make sure every past tradeoff has an explanation you can defend.
🗓️ CIOsurge Executive Forums
Our closed-door dinners for CIOs, CISOs, and senior IT leaders. Off the record, with no vendor pitches. Seats are limited, and every registration is approved by our team.
Atlanta | Tuesday, December 8 | 5:30 PM ET
Proving ROI on AI Beyond the Pilot
At Chops Lobster Bar, with panelists Sundari Parekh (TrendAI), Shanief Webb (CISO, Headspace), and Jason James (CIO, Acumatica). I’ll be moderating. We’ll get into the frameworks, metrics, and hard lessons from AI programs that had to prove their worth to the CFO and the board.
Request an invite
New York | Thursday, January 28, 2027 | 5:30 PM ET
Sunday, 4am: Your AI Agent Has Been Hijacked. How Do You Respond?
An AI agent your business built has been hijacked, and client data is leaving. The room works through the attack together, stage by stage, and leaves with an incident file to take back to the team. Moderated by Christopher Frenz, CISO, Rectangle Health.
Request an invite
Restoring Systems Is the Easy Part of Recovery
Greg Sarich, CIO of Quest Software, argues that disaster recovery has long been built around one question: how fast can we get the business back online? In today’s environments, spread across on-premises, cloud and SaaS, with identities and permissions changing constantly, a restored system can still carry a compromised identity, a changed configuration, or a way back in that an attacker left behind. He calls this “complexity sprawl,” and it makes it hard to know what you are actually recovering to.
His answer is to do the work before an incident. He treats inventory and dependency mapping as recovery capabilities, decides in advance who has the authority to declare an environment trustworthy enough to return to production, and tests the organization’s decision-making along with the backups. He also warns that if the knowledge needed to run the plan sits with one or two people, you have a resilience problem whatever technology you own.
This week showed why this matters. Attackers used a stolen ConnectWise Cloud Backup credential to get into Microsoft 365 tenants, and CISA warned that SafePay deliberately wipes backups before encrypting. Recovery infrastructure has become a target. Steven Singer found the same gap from the diligence side. His DR plans were well documented, but the call list hadn’t kept up with years of role changes. Pick your three most critical systems this quarter. For each one, write down who should have access, what it depends on, and who decides when it’s safe to bring it back. If that person can’t answer without calling around, your plan has drifted from reality.
— Zack Tembi
Most Boards Have a Cyber Framework, but Few Trust Their Own Skills
BDO surveyed more than 200 directors at U.S. companies. Eighty percent said their board has a clear governance framework for overseeing AI adoption and cybersecurity risk, but only 36% were very confident their board has the skills to carry it out. Directors were far more confident in management, with 88% saying their executives have the expertise needed.
Fifty-seven percent named accelerating change in AI and cybersecurity as a top concern for the next six to 12 months, ahead of trade policy, regulation and geopolitics. Forty-five percent said cybersecurity and data protection is the skill their board most needs to add, up from 35% last year. Roughly a quarter admitted that crowded board agendas have pushed cyber and AI oversight down the list.
That 88% is a vote of confidence in you, and it gets tested in the first hours of a serious incident. Directors who have never seen how recovery decisions get made will ask hard questions at the worst possible time. Before year end, invite one or two directors to sit in on your next tabletop exercise. Let them watch the team decide what comes back first and who signs off. An hour of that will teach them more than a quarter of slide decks, and it gives the 45% who want more cyber fluency a real place to build it.
— Zack Tembi
🗞️ At A Glance
💡 CIO Spotlights
Mohit Sharma, Global Chief Information Officer, LTM
Named Global CIO at LTM, the IT services and consulting company formerly known as LTIMindtree
Joins from Wipro, where he most recently served as Regional CIO for APMEA and Head of Service Excellence
Previously held Wipro roles as Business CIO for Global Business Lines and as General Manager and IT Head for Digital Operations and Platforms
Earlier career includes technology leadership at A.P. Moller-Maersk
Brings experience across IT strategy, information security and global technology operations
