This month's special edition of the Diligent Minute features insights from Renee Murphy. Renee shares her take on the latest findings from Diligent Institute and what they mean for the board, C-suite and senior leaders. 

Companies with advanced cybersecurity ratings create nearly four times the amount of value for shareholders as companies with basic security ratings, according 

to a report from Diligent Institute and Bitsight

. This empirical data reveals that the average cybersecurity rating of companies with a cyber expert on both the audit and the specialized risk committee is a very respectable score of 700. Companies without a cyber expert on either the audit committee or the specialized risk committee is a significantly lower 580.

For the uninitiated, cybersecurity ratings are like credit scores: The higher the score, the better. So, you might ask, what are some of the factors that have the most impact on an organization’s cybersecurity score? One key factor is the engagement level of the CISO.

While this might already be an accepted convention in security teams everywhere, the Diligent Institute and Bitsight research is the first time we have seen the correlation between the engagement level of the CISO and the overall security of the organization.

To be better engaged in the organization, and in turn help elevate the organization’s cybersecurity score, CISOs can take these four actions:

Embrace cybersecurity risk committees because they are worth the effort.

 Anyone who has worked in an organization large enough to require committees knows that they are a challenge all their own — especially when it comes to security risk meetings with the business. Bringing product, finance, human resources, facilities and others together to discuss their security risk and accept their responsibility in the mitigation strategy takes a level of political will that few CISOs are accustomed to wielding. The key is in making sure the culture of the organization is reflected in any program requested by the committee. I once had a security team say they need to have a program that is fast, friendly and fun — that was the corporate mission. So, we created a cross-functional cybersecurity program that reflected that culture.

Work with audit to participate in audit committee work. 

If you are wondering why this is not a default for organizations, it is to preserve auditors’ independence. Sometimes referred to as letting the patients run the asylum, using your own security team to test their own work is decidedly not in the audit handbook. However, working with audit on the security risk affecting the organization allows them to scope their audits appropriately. With appropriate scoping, CISOs can bring to light the gaps in the security program and work to close those gaps with the help of the audit and compliance teams, and report that up to the audit committee. If I can impart anything on a CISO, it's that your internal auditor is your ally, not your adversary.

No, trust me. You really do want to work with audit. 

With the CISO’s fate tied to the board in the U.S., and as cyber regulations increase worldwide, working with audit will go a long way in ensuring that the business and security are aligned and working correctly. If you are a CISO and you are not leveraging your audit community, you are working too hard on compliance. Don’t test your own controls; that is a job for internal audit. Don’t wait for the audit cycle to get feedback on policy and standards;engage audit early and often for guidance and feedback. They can maintain independence while keeping you from driving off a cliff.

Use ITGRC as a framework to coordinate these efforts. 

Ultimately, ITGRC (information technology governance, risk and compliance) is the key to a CISO’s successful execution of strategic priorities. All the board-level strategies 

highlighted in Diligent Institute research

 have security risks that require mitigation. But there are also 

 for improved employee experience, improved customer experience and upside in other parts of the business. An engaged CISO can use ITGRC to help execute on the board’s strategic priorities. This has the dual benefit of helping the board achieve their priorities (always a good thing!) and engaging the CISO in more aspects of the business. 

And that has the follow-on effect of helping elevate the company’s cybersecurity score at the same time. It’s a win for the CISO and a win for the company.

Read the full report from the Diligent Institute and Bitsight: 

How engaged CISOs boost overall organizational security: 4 steps to take

Superintendent evaluations are tools that allow the school board to measure and assess how the top administrator is doing their job. In fact, 90% of superintendents say they receive annual performance reviews by their school board, according to an 

. However, missteps and inconsistency in the evaluation process can fracture the working relationship of the school board and superintendent, which in turn can be detrimental to the district and its students.

Case in point: Four members of a Pennsylvania school board sued the superintendent and three of their board colleagues to rescind the superintendent’s evaluation. They argued that their feedback was not included in the overall positive evaluation of the superintendent, even though superintendent had met the goals set out for him by the board. Although the lawsuit was later dropped, the damage had been done. The superintendent later announced that he was leaving the district at the end of the school year when his contract expired.

A strong working relationship between the 

 is essential for school districts to perform at their highest level. The quality of that relationship can be linked to higher job satisfaction for the superintendent and lower leadership turnover. When done with thought and care, evaluations can strengthen the leadership team and allow the board and the superintendent focus on the goals of the district.

The importance of well-structured evaluations

Holding regular, well-structured superintendent evaluations help ensure the superintendent’s actions align with the board's vision and goals for the district and its students. A solid evaluation process encourages continuous improvement in the district. It builds trust with the superintendent and staff. It can enhance community trust, as well, particularly when the results are made public. A process that focuses on the measurable goals and outcomes can give the superintendent the confidence and security to withstand controversy and community criticism for unpopular but necessary decisions.

Superintendent evaluations are seen as so important that states require boards to perform them and mandate the frequency. It’s also common practice to include the evaluation process in superintendents’ contracts. According to the AASA survey, 46% of superintendent contracts specified the process, measures and indicators to be used in the formal performance evaluation.

Clearly defined indicators in evaluations can also keep subjective measures and personal conflicts out of performance evaluations. Superintendents should be assessed on their performance in measurable goals and outcomes. Evaluations should be conducted fairly, constructively, and with the primary goal of supporting continuous improvement. A good evaluation process removes personal bias from the equation.

School board members should strive to keep personal opinions, grievances, and political stances out of superintendent evaluations. When they don’t, superintendents can find themselves rated highly some board members and unsatisfactory by others.

Wendy Birhanzel, the superintendent of Harrison Schools District 2 in Colorado Springs, Colorado, said in an 

 on superintendent evaluations that she values the clear evaluation criteria in her district’s evaluation process. “I think we get into trouble when objectives and the process are not transparent and leave room for people to be evaluated based on political allegiances or certain decisions that were made that we might not agree with,” she said. “This takes the ambiguity out because it’s transparent and lays out what we’re looking for and the policy it aligns with.”

Evaluations should not be a pro-forma exercise that’s done because the state requires it. A robust process can provide focus on established goals and strategies, which can be adjusted when needed. Evaluations should be done on a regular schedule, and include at least a mid-year check in, if not more.

The superintendent should know when they are hired how the board plans to evaluate their performance. Some superintendents have measures written into their employment contracts. The board and superintendent must agree on what success will look like for the superintendent and how that success will be measured.

The evaluation goals should align with the district’s strategic plan and include measures for the district and student performance. The goals must be measurable and quantifiable. The board and superintendent should develop the goals together. The board should then adopt the goals.

The school board and superintendent should agree on the assessment tool they will be using. Some states have requirements on what tool boards should use. State school board associations provide assistance and 

The evaluation should be an ongoing process. Boards should hold at least two meetings to evaluate the superintendent: a mid-year check-in, and the end-of-year evaluation meeting. Some boards talk about superintendent goals throughout the year to ensure the superintendent is supported in meeting the goals and objectives set out for them.

Have a goal-setting session every year. Upon careful review, it may be that some goals will carry over from year to year with different tasks. Change happens in increments, and too many different initiatives can cause the superintendent and the district to lose focus. Goals need to be well thought through and based on critical issues as decided by the board and superintendent.

Have a goal-setting session every year. Upon careful review, it may be that some goals will carry over from year to year with different tasks. Goals need to be well-thought through and based on critical issues as decided by the board and superintendent.

Consider carefully including feedback from staff and community members. If you tread cautiously here and ensure that the comments won’t be used in a punitive way, including staff and community feedback in evaluations can offer insight and perspective. This feedback should be in support of a quantifiable goal like all other feedback.

Consider performing a board self-evaluation. Some boards evaluate themselves before setting the superintendent’s goals and objectives for the year. Boards that do this are modeling continuous improvement for the superintendent and the district and hold themselves accountable for the success of district goals.

Decide what you will release to the public from the evaluation. The meeting to evaluate the superintendent may be held in private session but check your local open meetings laws. However, releasing a version of the evaluation to the public builds trust and accountability for the superintendent and the board.

Choosing a board management software partner for evaluations

The superintendent’s evaluation is a priority for school boards, and it’s essential to have the ability to collect and track data and information to see how goals are being met. Board management software such as Diligent Community can help empower your board to conduct effective superintendent evaluations.

Diligent Community can track and store metrics and measurement that can be easily accessed, sorted, and put in a chart or other visual system.

The software allows school board members to support their ratings through evidence by looking at meeting minutes on the platform to help them remember what happened.

 for their evaluation, including data on progress toward goals and board actions that may have changed their ability to meet a stated goal.

You can store reports on the document library that help identify superintendent strengths, weaknesses, and areas for improvement. Boards can also collect data for their self-evaluation.

Staff and public feedback for the evaluation can be collected and stored through the platform.

 and how it can help support your school board as you evaluate your superintendent. Request a demo today.

Diligent

Blog

How engaged CISOs boost overall organizational security: 4 steps to take

Tips for school boards tackling superintendent evaluation

Solutions

Resources

Company

Your Data Matters

Diligent

Blog

How engaged CISOs boost overall organizational security: 4 steps to take

Tips for school boards tackling superintendent evaluation

SolutionsSolutions

ResourcesResources

CompanyCompany

Your Data Matters

Solutions

Resources

Company