Podcast S5E4 | Privacy & Security at Zoom: Lynn Haaland

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio – a show to connect, celebrate and champion women in risk, regulation, and compliance. Sharing insight and perspectives from the most influential members of our global Risky women network on the latest developments, we need to think about, the challenges we should all talk more about and the innovation we are most excited about governance, risk, and compliance. Bringing together the hundreds of senior women professionals already connected with a new emerging group of leading women and men. I’m Kimberley Cole, your chief risky woman.

Christine Halvorsen 0:36
Welcome back to Risky Women Radio, where we’ll be talking about risk and compliance and looking ahead at the views from amazing women who are taking on risk and are able to tell us what’s next in the world of risk management. I am Christine Halverson, Managing Director of Protiviti and I have the pleasure to introduce today’s amazing woman who has always been a role model for me, Lynn Haaland. Lynn is Zoom’s Chief Compliance Ethics and Privacy Officer, and Deputy General Counsel. She is an expert in governance and compliance for multinationals, privacy law, and US cybersecurity law. Previously, Lynn was Senior Vice President, Deputy General Counsel, Global Chief Compliance and Ethics Officer and Chief Counsel to Cybersecurity at PepsiCo. Lynn, it’s great to see you today.

Lynn Haaland 0:36
Thank you so much, Chris. It’s great to be here. And thank you so much to you and Protiviti for the invite for today.

Christine Halvorsen 1:31
Great. And so I think as we have the conversation, first, I would love to tell the audience more about your background, right with all that you’ve achieved in your very esteemed career, right, how you came to join Zoom as Chief Ethics Officer Compliance and Privacy Officer, and how you know, your world from from government to commercial has gone for you.

Lynn Haaland 1:55
Thank you so much. Yep. So, as you mentioned, I started as Zoom’s Chief Compliance and Ethics Officer and Privacy Officer and Deputy GC in January 2020. So that was, if you recall, about six weeks before COVID came to the US. And before we experienced the lockdown here, of course, it was already in China, and already in Italy, and in many, many other places, including New York, where I’m based, and we just didn’t really know it yet. But from January to March, I was busy, you know, learning the ropes and meeting everyone in California and at Zoom HQ, and really just thrilled to be here. And then of course, the world turned upside down. So maybe we get to that story a little bit later. But it was just really wonderful. I previously, as you mentioned, was SVP and Chief Compliance and Ethics Officer and Chief Counsel for cybersecurity on the legal side, which was just a terrific job, terrific experience, obviously, a large company, you know, a Fortune 100 company, also based in New York, which is what brought me out of the US government for that compliance opportunity. And what was so great about PepsiCo, it’s a obviously, you know, again, very important CPG company, globally, lots and lots of presence 26 languages, I think over 200 countries, you know, lots of places, really, really exciting place to learn the business learn and specifically what I mean is the compliance business, right, learn the job, being in the chief compliance and ethics officer job. And then also the privacy and legal team dealing with cybersecurity and privacy rolled up to me. So terrific place for me to learn the ropes out of government, my first in-house job. And then after I left PepsiCo, I was looking to go into tech, just as you know, the importance of the technology sector in the United States, really, to me, in particular, as someone with a legal background, and a lawyer. In particular, for me, I thought that’s really where cutting edge legal issues and cutting edge issues more broadly, would arise and we’re being encountered, and all kinds of creative people are in the tech sector, as you know. And so for me I was looking for that opportunity to go into tech. And I was able to connect with Aparna Bawa, who’s our Chief Operating Officer, our COO here at Zoom. And she and I spoke and, you know, the rest is history, as they say. So that was a really exciting move for me. And I’m still learning and growing every day at Zoom, which is terrific.

Christine Halvorsen 4:21
And I think that’s the point, right? I think as in our careers, especially as women, right, and we’re juggling multiple things at once, sometimes, you know, children and other things to continue to want to improve on yourself as well. Right? And to continue to want to grow your background, your experience into other areas of the foundation that you’ve built. And so everybody listening today, I think Lynn is a pure example of that and doing that every day and continuing to want to learn and be curious about what’s on the horizon. And really Lynn, to your credit to be able to still influence things that are going on in the government regulations by taking that step into the tech world with your background and with the new regulations that we’re going to talk about a little bit here that are coming around big tech being on the forefront of that in your position. So, but before we get to that, really talking to you, you know, joining in 2020 6 weeks before the pandemic hit big here, obviously Zoom’s business, you know, everybody thought the pandemic was going to be, you know, quick and easy and get out. Well, we’ve learned that’s not the case. And Zoom really, you know, was on the forefront of really providing capabilities to people in their workforce to be able to continue to do business and actually change and scale, how they do business, even to this day that I think will continue to influence the workplace. And so with that, and you joining six weeks before, what was the environment like at Zoom and scaling? And then you having just been new to the company? What challenges did that bring for you from a risk and compliance challenge as well?

Lynn Haaland 5:49
Well, where to begin? Where to begin? Even though I have your question right in front of me, Chris, it’s where to begin. So it’s true. I think in those early days, unless you were really an expert in the medical profession, I do think many of us thought this would be over quickly. And of course, that’s not been the case. And I think it’s fair to say that this is not just in Zoom’s interests. But I think it’s in all of our interest to think about what’s the future of work? I don’t know about you, but I don’t think we’re going back to Monday through Friday in the office. Right? And I mean, I mentioned I’m in New York, you know, Zoom is headquartered in San Jose, California, Silicon Valley. And there are many, many terrific companies out there who have decided to employ some kind of video platform, hopefully, many have chosen Zoom, but, you know, in order to get the talent and to capture that talent where they can. And so I think in addition to that, people have realized that maybe instead of being in that Washington, DC traffic, I know, you and I have known each other in that area of the world, you know, rather than sitting in that traffic for three hours a day, maybe it’s better to, as you mentioned, you know, see your kids or work out downstairs, or take a walk or maybe read a book, you know, try to keep abreast of the latest privacy regulations, whatever, you know, works for you. But I do think some form of hybrid work is here to stay. And if anything maybe that and figuring out how to take care of yourself a little bit, maybe those will be the silver linings of all of this. But that’s maybe another conversation. I’m not an expert in any of that. But back to 2020, March 2020, things did turn upside down. As I mentioned, you know, our hearts went out to everybody. We were very fortunate, of course, to first Zoom, those of us at Zoom to be sort of the right product, right place right time. I do just want to mention that we provided at one point we were talking about the fact that we have provided them to schools over 125,000 schools is my recollection. And I just want to say it sounds really cheesy, but I’m so proud of that. And I think many many of us are proud of that. You know, I have kids, many folks here, whether you have kids or have a teacher in the family, or of course we all went to school at one point. But the idea of being home with little kids and not having the ability to have something for them to do. That’s heartbreaking. So to the extent that we at Zoom, were able to help folks keep things going and keep their kids engaged and help out with the schools, I just want to say that that’s something that we’re all really proud of.

Christine Halvorsen
Well, just on that, too. It wasn’t just kids, I actually was going to Georgetown, I just started Georgetown to get my executive MBA, right. And so it was, is the class gonna get cancelled, because it was an in person, right? That was the big thing for the cohort. And they quickly pivoted, and we use Zoom. And it was perfect. It actually worked perfectly as we moved through the class. And it was seamless on the integration, which was fantastic. So not just for kids, it was adults as well.

Lynn Haaland
That’s great. Thank you for mentioning that, Chris. And if I may, I’ll also put a plug in, I’m an adjunct at Fordham Law School, the Fordham University’s law school, and you know, with March 8, and there were whispers of the university closing, and I just thought, you know what I’m going to do tonight’s class via Zoom, I’m going to send the invite and just tell the students, you know, a global compliance and ethics course, I said, Hey, let’s just try it. I want to see just before because I don’t know what’s going to happen next week. And sure enough, we got on the Zoom that night, and I believe the university closed the next day.

Christine Halvorsen 9:20
Oh, God.

Lynn Haaland 9:20
So yeah, it was sort of just in time, and I had to learn how to teach and, you know, try to keep people engaged in this medium, too, but anyway, it was that was great. So at the time, you know, when I started mid January, I’ll just go back and talk a little bit about Zoom’s, growth and how we built the compliance and ethics and privacy teams. We had a couple of folks at the time when I first joined, we had a couple of really terrific security professionals who dealt with the compliance of the security program specifically, but I was the first person hired to build you know, what we call the, you know, an effective compliance program for DOJ and SEC guidance under SOX and Dodd-Frank and so forth for a public company. As you all know, you have to have an effective compliance program. And that doesn’t just cover security. That’s, of course, writ large, you know, your code of conduct and your policies and all that good stuff. So I came on board. And in that time, while of course, being in the pandemic, and worrying about all of our families, and everybody on our side as well, we’ve grown the program, we have five teams now that roll up to me and over 80 compliance professionals and lawyers. So it’s been quite a journey.

Christine Halvorsen 10:33
Yeah, I mean, growing that and scaling that quickly, while also providing the service you did to customers is fantastic. So you know, talking through that a little bit more going from like a startup, which Zoom was past a little bit past that phase. But now scaling up right. So do you have any advice for technology companies moving kind of from a startup to growth mode in establishing that successful framework you talked about around SEC and DOJ and any other compliance issues, you may think that would come up for them?

Lynn Haaland 11:01
For sure. So at Zoom, I referenced it briefly. But you know, we were really a business to business, we were b2b, even though the company had been around since 2011, it went public in 2019, if I remember correctly, but it had always viewed itself as b2b. And then all of a sudden, we’re thrown into this situation and working hard, just like everybody else, to adapt. And then we were b2b, to sort of b2c and schools and all of that. So we had quite a journey of trying to do our best to make sure that we had materials and training and assets and just things to sort of turn from that group of users that traditionally had had their own IT departments. You know, we had always worked with large banks and financial institutions, hospitals, universities, that tend to come with a whole department of IT professionals and people who say, Where’s your manual? Let me go install it. And let me check the settings. So we found ourselves in those early days, looking to put out more blogs and put out some training and say, here are your settings and those types of things. It has been an incredible journey. And I would really encourage anybody in the startup mode best you can, of course, to start thinking about your privacy and security, and getting that built into your culture as quickly as possible. So in particular, for tech companies, and I know the question didn’t ask about tech companies, but we’ll maybe discuss that a little bit more here today. But when you’re going from that startup mode to explosion mode, which if it happens to you good for you, I hope, you know, I hope you get that opportunity. But really, really, really, you need to start thinking about privacy and security as competitive advantages for your business. It’s not just because I tell you to or regulator tells you to or it sounds, you know, sexy and interesting to have privacy. Actually in many parts of the world, people consider it a fundamental right, as you know, I mean, with GDPR in Europe, and how are you going to embed that into your business to make sure things are efficient and humming along and not just tacked on after the fact?

Christine Halvorsen 13:06
I absolutely agree with that. I mean, obviously, prior to coming to Protiviti, I was with Amazon Web Services, right. And security was built into everything we did from the ground up and all the compliance pieces were built in. So it made it it was already part of the processes as you were moving forward, right, which made it easier instead of going back and retrofitting things, right. And when you see the tech companies, startups that are retrofitting, they’re getting themselves in trouble. A lot of times with FTC and FCC as they move forward. So some great advice there. I think when you talk to startups, right, and you think through that, I think one of the concerns they have and I ran into this at AWS is not having compliance and privacy slow down the innovation. And so how do you get over that culture piece? How does Zoom do that in a way that doesn’t slow down their innovation and ability to scale?

Lynn Haaland 13:54
That’s a great question, Christine. Look, I think there’s always going to be that narrative that floats around out there that whether it’s compliance or ethics or privacy or security that unfortunately, a lot of innovators do believe that it slows down the gears, right, the magic, but if you think about it, by tacking it on after the fact, that is what’s going to slow you down. I mean, that’s the issue, it really is that you need to give those groups as best you can, you need to give those groups a seat at the table. And really, you should be thinking about privacy and security by design, right and build that into your product development process would be my two cents. Because if you find out at the end, that whatever awesome, amazing thing that you’ve just built doesn’t comply with GDPR or doesn’t comply with CCPA. Or you didn’t think about something that’s really key to one of your customers because again, they really do want privacy and security and they want their tool and their vendor and their companies they deal with to be in compliance, right? That’s the advantage for them if it’s built in. And so if you don’t have it if you build this amazing thing and you get to the end and you’re ready to go to market and you have to fix something, my argument, of course, is that’s the costly way to do it. Right? That’s much more expensive than if you got that insurance policy, talk to your SMEs, right? Your subject matter experts on whether it’s security, privacy, export, you know, whatever that thing may be for whatever market, if you can kind of have those conversations on the front end, and make sure that your processes by the way, this is I’m moving into part two now trying to get the voices on the front end was number one. The second thing I would just say is that when you have a process, you know, I say, I alluded just now to conversation, right? Getting a seat at the table. But ultimately, you need to build some processes, or you’re just not going to, it’s just going to be reinventing the wheel every time. Right? And so risk professionals, compliance professionals, it sounds a bit, you know, like it’s the catchphrase, forgive me for it. But you need to make sure your processes are repeatable, scalable, auditable. And once you have that, you won’t be slowed down. Because your team’s going to know what you’re going to do it over and over and over again, in a predictable way, you know how much time things take, and then you’re not going to have that nasty surprise at the end where you’re not ready to launch because you have to go fix a bunch of things.

Christine Halvorsen 16:12
Great advice. Absolutely agree 1,000%. And so you know, it goes back to that term smooth is fast, right? So when you have versus, you know, trying to speed through and you’re on a bumpy road, right, you’re gonna get slowed down. So…

Lynn Haaland 16:25
That’s right. I think one of my colleagues also says, go fast, but don’t rush.

Christine Halvorsen 16:29
Oh, that’s a good one, too. Yeah, see, we got got a couple of T shirt slogans going on!

Lynn Haaland
Right? We got to get the posters written up or whatever,

Christine Halvorsen
Some Risky Women T shirts as we go! That kind of leads us into, you know, a discussion I would like to talk to you about to about the top privacy issues you see in the technology industry, not just across Zoom, but in the technology industry, and kind of the challenges in privacy and compliance that you see coming on the horizon.

Lynn Haaland 16:58
Sure. And if I may, I’ll just sort of carry that last thread of conversation forward a little bit, I really do think that good process, Good process, again, scalable, repeatable, auditable will help you and one of the talking points, I think, for compliance folks everywhere. And this also, I think, works for privacy is make your processes transparent, and predictable. Right? If to the extent that you can, you’ve got a great process, people know where to go for help number one, your privacy and your compliance, people should always be a resource, try to pitch yourself, right, not as the internal affairs police, people have heard me say this before, you don’t want to be IA you want to be the librarian, you want to be like, how do I get this done, please help me get this done. Please help me innovate and build. So you want to be a resource. And then if whatever you’re trying to do to get things done with integrity, and get it done in the right way, you know, whether it’s privacy or compliance, if you have your process and your conversations, your parameters are transparent, and people, your innovators, your employees, they know what to expect. They know how to go get an answer, they know how to get something done, you’re just going to make it faster, you’re just going to overtime, I really believe that you’re going to be helping to drive innovation, and not be slowing down that innovation. So I think that does continue to be an issue for privacy, we’re going to turn to the privacy world for a moment. Of course, everybody in the past couple of years, we’ve been talking a lot about data transverse right, which ramps to decision and in June 2021, the court approving SCCs, standard contractual clauses to enable those cross border data flows. We already know that many, many companies are working to retrofit those SCCs and get all that going. But you know, it’s still gonna continue to be an issue I think for some time to come. We also have, of course, DC the US finally sort of joining the conversation with the proposed right American Data and Privacy Protection Act. Which is a big deal. I don’t know what you think about its chances of getting passed. But this is the furthest we’ve gotten so far.

Christine Halvorsen 19:04
Correct. Yeah.

Lynn Haaland 19:05
So you know, it’s at least the US is kind of joining the conversation and our government is jumping in and trying to see because it really is tough when you want to operate in all 50 states, not to mention 200 countries around the world, as I mentioned for PepsiCo, right. It’s really tough to have to have different privacy regimes everywhere. And listen, the people want to buy things on the internet, right? People want to spend time on platforms, people want to be doing business and having their, seeing their friends and family. So all of that I think is hear to stay. It’s just a question of how are we going to manage it? And those are the big issues for a while.

Christine Halvorsen 19:43
Yeah, you’re absolutely right. And I think yeah, in the US, I’m glad the conversation is finally happening. And you know, we’re starting to get more to the tactical conversations and kind of thinking strategically about it. And we’re seeing that the chances to pass maybe but hopefully to all the different states coming up with their different privacies and having to respond to those. I mean, those are just, again, things that slow down that innovation, right, because you’re having to respond all the time. But that transformation that’s occurring right now in the regulatory space around privacy and compliance across the world. The thing is, I think everybody’s relying on the internet now to be this open platform that they can use and have these great capabilities across the world. But at the same time, governments are now putting regulation and kind of not, you know, it’s not the global internet anymore. They’re kind of saying, hey, if we’re, if you’re in the US, these are what you have to follow. And so companies are trying to meet their customers’ demand at the same time to meet the regulatory demands in this transformation. And I think that’s a hard place to be. And right now, especially when the regulations are new, there’s not a lot of structure around them, right? There’s not a lot of like, what are you actually expecting? How do we put these things in place? So, you know, the technology companies are investing in this, but are we doing it the right way? And so it’s one of those that is going to be some time to come in and make sure everybody’s doing it, right, I think it’ll get there. But in the interim, I think there’s a lot of job security and behind privacy and ethics right now.

Lynn Haaland 21:06
Security and privacy.

Christine Halvorsen 21:09
Yeah, exactly. Exactly.

Lynn Haaland 21:10
Right, I have to say that I really don’t think anybody thought 5-10 years ago that we would have this extent of splinter net to just use the buzzword, right, I don’t think we actually thought that there would be this degree of everybody regulating their own airspace, if you will, to this extent. And it’s a super interesting conversation about whether the promise of the internet you know, whether it’s commerce and information and learning and all that good stuff, the more positive sides of the internet, right? Whether that promise has really been fulfilled, but if you are doing business, internationally and globally, and you, you know, you need to do your best to comply in all of those various places. And again, it used to be that you could sort of pick GDPR as your high watermark. And you might be okay. Now, maybe I would recommend you pick GDPR and then but you have to you have to localize you’d have to also be paying attention to all the various places, even just domestically, right in 2021 we had Virginia and Colorado pass. Now I know they’re not effective yet till 2023. But we’ve got to worry about that. And we’ve got laws in UAE, South Africa, Oman, maybe Thailand, you know, of course in China. Yeah, right. Yep. So there’s so much happening, as you’ve suggested, and you’ve stated, Chris, that it’s naturally different states, different sovereigns want to control and protect their citizens. And they do that by passing regulations of all kinds, including protecting the internet as a space. But if every country institutes its own custom regime, it gets very expensive and complicated, for sure.

Christine Halvorsen 22:42
Yeah, absolutely. And I was just recently looking at this too, even in Latin America, they were probably the furthest behind right now. But they’re trying to use GDPR as their baseline to move forward. But they’re not sure if they’re going to do that. Right. So it’s a whole other region of the world that hasn’t had these yet and you haven’t think about and just throwing that on top of everything. So I think, as technology companies are making decisions on where to do business, right, because you have to make those business and operational decisions of where do we want to expand to these are things that they have to be taken into consideration as well as part of their overall plan, not just what is the total addressable market in the country? It has to be, Okay, well, we’re gonna do that what are the compliance privacy and security apparatus and processes? We need to put around that? And what is that cost going to be? What is the tail on that, I think has to be considered as well.

Lynn Haaland 23:29
That’s right. And, of course, those of us who are, you know, on this side of the risk industry, right, and who are worrying about risk all day long, we would argue, as I said, before, that that investment is worth it, do it on the front end, because that’s your insurance policy, don’t do it on the back end, right. It’s much cheaper to buy that insurance policy to use a silly analogy. But before you’ve broken your leg in a car accident, rather than after.

Christine Halvorsen 23:51
Yeah, and I was just actually listening to a podcast last night around cyber insurance, right, and cybersecurity insurance and how the premiums are going up 200 to 2,000%, right now, around ransomware. And also your cybersecurity postures and how there’s over 500 in the US insurance companies that offer the cyber, you know, insurance and companies are deciding to maybe self insure now and instead invest that time and money into their compliance privacy and ethics programs instead. And so it’s a business decision that you have to make. And I think making sure you’re secure, like you said, and building it into your culture from the start is the way forward is the best practice that everybody should be following.

Lynn Haaland 24:29
Yeah, and if I didn’t make this point earlier, if I may just layer that on a little bit, which is that do think about the culture of your company. You know, if you’re coming in, whether it’s as a compliance professional or Chief Compliance Officer, what worked at your last role may not work the best at your next role. So you have to really think about what is the culture of that company? Try not to sound like a lawyer all the time, right? Try not to be lecturing everybody. I made the joke about being a librarian. No, please, no disrespect to librarians everywhere, right? But you really want to be somebody again, where people view you as someone who can help drive results and drive innovation, rather than being somebody who’s wagging the finger and telling everybody what to do. So I would think about what works for your company, you know, are you on email? Are you on chat? Do you have digital signage? Or do you have live presentations? Do you have employee resource groups? Or do you have brown bag lunches? What ways right, whether it’s compliance or privacy, what ways works and resonates for your audience? And on any given day, of course, that audience can change, whether it’s executives you’re trying to train or whether it’s your folks, right, who are building and innovating and creating great stuff. So it’s important to just pause maybe and think about that and try many, many different methods, of course, too.

Christine Halvorsen 25:45
Exactly and I think understanding the risk tolerance of your culture as well. Right, how much risk you’re willing to assume and not assume, I think is, is a big one, obviously, coming from government, me coming from government and going to AWS, the risk tolerance was a little different on both sides. Right, and seeing that, so I think that’s a big one. And I I think, to your point, I think it’s really important to talk about upskilling the workforce, and you’ve mentioned a couple different ways to reach them based on your culture, but not just the workforce, the workforce to come. Any advice on that on? How do you keep this fresh in the minds of your employees? What upskilling programs do you think are necessary? How do you think the future generations are prepared for this?

Lynn Haaland 26:25
That’s a great question. I do think that in terms of the challenges within a business, and I think you always have to think about tone at the top, and trust. And in my last role, we talked about, you know, doing business the right way, you can use any number of phrases, and Zoom, we talked about doing business with integrity, you know, customers, and users, the public, your customers, your clients, people would prefer to deal with people that they trust, you know, when I’m buying something out in the market, or I’m asking somebody to help me hiring somebody to help me, you know, in the house, I was joking earlier, my AC is broken. So you know, when I’m hiring somebody, you know, an AC Heating and Cooling company, that you want to hire someone that you trust, you want to feel like you might get ripped off, and they’ll charge you more just because you’re not an expert in that area. So in addition to thinking about compliance, and how to drive home, you know, the messages in a myriad of ways for your own company, what works for your own culture, of course, per the DOJ and SEC guidance there, there are those required elements of a compliance program in particular, and you want to think about tone at the top right, in the tech industry, and how do you focus your employees, when things are moving really, really fast, you do need to think about tone at the top, you’ve got to convince your customers, your regulators and your own employees, again, that you’re being thoughtful about the way that you make decisions. I would say, you know, some companies, of course, have historical issues around trust and customers and the public and the end users, people really want to know that companies are doing their best to protect their information and protect their data. And so it’s really important for senior leaders, then to set that message that tone at the top to say that, you know, we’re doing business with integrity to make that a priority in terms of, again, just reinforcing that with the employees, most employees are going to try to do things the right way. It’s just that when they’re in a crisis, you know, when we’re in a crunch time, we have to remind people and you need to just build that muscle memory so that they know not to throw it out the window just because things are busy, right? So don’t at the top. Another big challenge, I would say facing compliance teams and any regulatory team, any legal group that needs to worry about the rules and regulators is how do you convince management to share that message with you? You know, it’s not just that compliance, or risk or internal audit, or HR should be in charge of ethics or privacy or security, right, the security team can’t do security alone. Everybody knows, intellectually at least whether they know it at their core, that’s the challenge. Everybody knows intellectually that you should not click on that link in your email that looks suspicious, right? But you have to just train over and over and over again. So that when people are going fast, and they’re bombing through their emails, especially on a mobile phone…

Christine Halvorsen 26:28
That’s the one!

Lynn Haaland 26:39
Really good, they’re getting really good at them now, like the old days, you know, right? I know this from nearfield to Christine, but in the old days, like there were spelling mistakes, and maybe the logo didn’t look quite right and whatever, but we’re on these phones, right, all day long. So that kind of training and just reinforcing that and being careful, like everybody’s got to own that. It can’t just be that the security, you know, the CISO or the privacy officer has to be the one not clicking, everybody has to not click. We need that tone at the top and we need to also try to seek ways for the individual employees to be invested in all of these areas too. Because otherwise, I don’t want to use another teacher phrase but you’re only as strong as your weakest link. And I don’t mean the employees are weak, the employees are a huge force for good. But we have to just keep that training and that messaging, I think refreshed so that when you are in a hurry, and you’re doing important things, people keep that in mind.

Christine Halvorsen 30:15
Yeah. And I think that is so important to mention that, you know, the employees having a voice to be able to report things to that they see that maybe suspicious and getting the feedback, if they reported, it could be nothing, but at least they get the feedback, because what I found is you can build that into your culture. But if employees don’t get the feedback, and the next time they see something, they’re like, well, it wasn’t even handled. So why should I even report it? Right? So making sure you have that feedback loop built into everything as well.

Lynn Haaland 30:40
Absolutely, no, that is one of the things we talked about a lot from a compliance organization perspective, is that you want to build a speak up culture, you know, maybe you don’t, there’s a hotline, of course, that’s required as a public company, you all know, but are people using it? Are they calling anonymously? Are they brave enough to leave their names? Are they naming people? Or are they just giving abstract allegations? Are you responding to them? Now, a lot of times, to keep the investigations confidential, you can’t always report back to the reporter, oh, we fired a bunch of people, or this person got their commission taken away, or this person got a coaching. But, you know, I would, to your point, try to find ways to make people who call in feel heard and respected. And even, you know, all of your employees to the extent that you can, going back to DEI right, again, as compliance officer, I’m not in charge of it. But I want to support HR in promoting diversity, equity and inclusion, because the more people feel that they’re heard, the more that they’re going to, you know, appreciate the training, the more they’re going to feel invested in that business and that workplace, and they’ll keep us safe from whether it’s for privacy perspective, or security perspective, or financial reporting, whatever that is you want, of course, you want employees to feel heard, and so that they will speak up.

Christine Halvorsen 31:53
Yeah, absolutely.

Kimberley Cole 31:57
This episode is brought to you by Protiviti. Protiviti is a global consulting firm with deep expertise in transformation, risk management and compliance. Partner with Protiviti and face the future with confidence.

Christine Halvorsen 32:15
I’m gonna just kind of pull the string a little bit on the DEI piece, if you don’t mind, I think the other thing that is so extremely important about DEI, in tech, and in any company for that matter, is having that diversity, equity and inclusion, because your customer base is built up of the globe. And if you don’t have that perspective, it doesn’t give you some of those benefits from being able to hear the employees that have those perspectives and building those into your capabilities and services that you’re providing to the globe. And so with that, you know, it’s definitely something that I think tech sees a lot more than maybe some other companies, right in that because they’ve kind of built that in a little bit to their culture. But as we know, right, especially, you know, women in tech, right, seeing more and more, which is great. I can remember I was a programmer, god, I’ll date myself back in the 90s, right, and software developer, and kind of not a lot of women in tech at that time. But moving through that, and it’s great to see that that’s happening more, but just, there’s such a good focus on it right now. And I think it’s a fantastic, like another transformation that’s going on across the industry that we consider that. And then I think the next transformation, right is really what we’re doing around ESG. And really thinking about the environment and sustainability, right, and the globe around all that. And so just curious, you know, what is Zoom doing around ESG? And what do you see going on in the tech industry around ESG?

Lynn Haaland 33:39
Sure. Well, I mean, as you know, companies organize their ESG initiatives and a variety of ways. You can put it in lots of different departments. The SEC, of course, has proposed rules, so many actually, financial and audit groups, and departments are taking the lead on ESG. Maybe in a company, you’ve got your IR your investor relations, taking the lead, you know, it can be compliance, it can be in your ethics or integrity office, etc. So, but no matter where ESG sits, look, the E and the S and the G have been around a long time, right? It’s so it’s a bit of a buzzword right now to talk about ESG. But these are super important concepts, of course. And I think the way I would approach it, or the way I would advise for my two cents, is to talk about for your company in your business, what are the areas that are most important to you? What are the issues that you put in the ethics bucket, the social, you know, governance, bucket or governance, right for your E and your s and your G? Where do you put those issues? And what are the most important issues for you? What do you ESGing about what are you worrying about in that area? So is your company using fossil fuels? Like do you want to think about that? Or you know, maybe like Zoom, maybe you’re good for the environment, which is one of our plugs, right? So you do want to assess the company’s environmental and social issues for the E and the S and think about where can you improve? You know, we talk a lot on the compliance side, of course, about risk assessments, huge, huge priority for DOJ and SEC over the past few years, is what is your company’s risk assessment program look like. And if you don’t have the money to do you know, a full on compliance risk assessment every year, well, then you’d better lash up and partner up with internal audits, you want to partner up with finance, you want to talk to, if you have an ERM enterprise risk management program, look at all of the ways because risk risk is that thing is going on all the time, right? It’s not just one group that owns it. So whether you have a full blown ESG program or not, and have the resources for that it should be cross functional, someone should take the lead to kind of think about that initiative, and think about for your company, again, what is your top environmental issue? What is your top social issue? And then what is maybe your top couple of governance issues? Hopefully, that’s already humming along somewhere. And then you know, where do you need to dial up the maturity? And maybe you focus on those items for a year or two. And then where are you doing better? Or maybe that could be you know, in year two, or year three, and then you circle back. So it’s just important to do that risk assessment for yourself and see where you are and what things you want to focus on. You can’t focus on everything all at once, unless you’re just a huge, huge place, right? But it’s even there, you want to focus on to pick a couple of things, what are those ESG issues that you want to worry about, and then dial that up? And I think, you know, for your strengths to focus on the positive for a minute, think about packaging them and communicating about them in an authentic way. Hopefully. Not just because it’s a fashion right to talk about it. But think about what are you actually doing that supports those ESG buckets? And, you know, start to talk about that.

Christine Halvorsen 36:48
Yeah, and I think what we’re seeing is kind of some trends coming out of it too, right. So you have your internal ESG actions that you’re taking. And like you said, it can be set up in various ways. But then what we see is, are companies who, obviously third party vendors, right, and the whole world built off of third party vendors. So having those same expectations, once you set your ESG values and core responsibilities, making sure that the third party vendors that you’re going with also share in those core values and ethics that you have around it too, and making sure they’re complying with it. And then again, across government, right, we’re starting to see government contracts come out saying what is your ESG posture? So I think overall, like you said, having program however it’s set up and established done and but it’s definitely a bigger problem than just what are you doing as your company, it will impact you if you’re a third party vendor to impact you if you’re doing business with the government, either way. So there’s something that yeah, it is a buzzword, but you know, it’s definitely something that is gaining momentum. You know, another compliance risk that you had to take on as part of that ERM that you’re talking about.

Lynn Haaland 37:48
Which is not to say it’s not important, right, even though I use that phrase, but a couple of times, but look, we talked about in the past couple of years, we talked about issues with supply chain, right? And remember going all the way back, I knew you know, this one, well, going back to Target, right, and it was their AC company, that was the entry point for one of those cybersecurity attacks. I mean, there’s the supply chain issues, which people have said called it value chain over the years. So you want to clean up what you can in your own business. And then you do need to start to think about who your partners are, and your vendors and cascading those obligations, so that you can try to maintain that trust with your customers.

Christine Halvorsen 38:24
Yeah, absolutely. And I think that’s what it is, try to maintain trust obviously, the cyber supply chain area that I am very interested in and looking at, obviously, the executive order 14017 was written around that, if you’re doing business with DOD, you have CMMC right, that is trying to protect this supply chain for the government, and even EO 14028, and the Cybersecurity Executive Order addresses that a little bit as well. But what needs to be done there. But I just think from that perspective, the attacks are increasing in the next two years by 400%. And I think it’s just an attack vector and looking at the statistics that I’ve looked at first started coming out with, you know, advanced persistent threat actors, so kind of more of your government actors. But now hacking groups realize it’s a vulnerability and that companies are trying to catch up to plug that vulnerability. And so it’s you have more people now making that vulnerable. And I think that new Cyber Security Council that came out of the executive order just released the first report a couple days ago on Log4j, saying how bad that’s going to be right it’s kind of like a COVID disease now across tech because of that vulnerability that came out of a supply chain attack. And so yeah, definitely an area that obviously I’m very interested in from my background, but an area that is very concerning. And well you know, what the third party vendors bring to your business, they’re very important, but at the same time you have to know what those vulnerabilities are.

Lynn Haaland 39:45
If I may Chris, I’ll throw out another plug, which is the Council on Foreign Relations also just released an independent taskforce report. I haven’t had a chance to read the whole thing yet it really just arrived but it is called Confronting Reality in Cyberspace. And again, independent taskforce report, they have some great recommendations in there. And that’s one of the things that got me thinking about training employees, yes to protect the company and because it’s the right thing to do, and because it’s required, but also to sort of get us ready as a country, about how do we train our kids and better train our workforce to just really be first competitive, but also to protect us and to be smart about the future? What’s coming in the future. When we think about wearable technology and self driving cars and all this stuff that’s coming. If you don’t have access to technology, and you don’t understand it, and don’t have the training, you’re not going to be as well positioned. So obviously, lots to think about.

Christine Halvorsen 40:42
Yeah, absolutely. Lots to think about. We actually there was just a recent article, one of our Protiviti colleagues put out about what does the class of 2030 look like in the age of cybersecurity and technology. And what was interesting to me was in the cybersecurity field, we have millions of positions open right now, right, but even by 2030, they’re still expecting a shortage of 3.5 to 4 million people who can actually support the cybersecurity need in that. So if anybody has any kids in that age range, I do, and they’re interested in technology, maybe cybersecurity is the way to go. But I started out in cybersecurity very early on. I mean, Lynn, you and I work together on a lot of issues around terror issues to the internet and cybersecurity matters. And I was telling someone the other day, they asked me about cybersecurity, and I said, Well, when I you know, grew up in the age of cybersecurity, it was cybersecurity. Now, it’s cybersecurity of IoT, like you said cybersecurity of cloud right cybersecurity of robotic cybersecurity of MedTech, like EdTech, isn’t it like they’re very specialized areas now, right, because of all the great capabilities that have been built out, especially with cloud technology right now coming on the forefront. But now you have to be an expert in just database or storage security. So there’s definitely specialties that are coming out of this as well, which is great to see the industry growing and transforming with it, but at the same time to have this shortage is a little scary for the world. Right?

Lynn Haaland 42:03
Yeah. I mean, I do actually look forward to reading the report. But it’s, it hopefully will spur some people to action, but it sounds like a bit of a scary message to that we have that shortage.

Christine Halvorsen 42:12
Yeah. So hopefully, one of my kids will be part of that number and then drop it down.

Lynn Haaland 42:18
Yeah, ready to go.

Christine Halvorsen 42:20
So I just wanted to talk to you a little bit about, we’ve talked a lot and thank you for all the valuable information you provided. But my question to you is, how do you measure a successful compliance and privacy program? What is the best way to know that it’s having the impact it needs, that you are helping drive that innovation that you talked about earlier? And then to show your team the successes that they’re building all the time to give them that feedback?

Lynn Haaland 42:45
Well, you know, there are a lot of standardized metrics that people use, whether it’s for a privacy program or a compliance program, of course, we tend to go off the 11, 10, 11, 12 elements of an effective program per the DOJ and SEC guidance. But you want to be looking at your program again, is it working? When you do your risk assessment, do that risk assessment, What is happening in your company? What is happening in your industry? You know, what are the family jewels that you want to protect in terms of data protection and information security, but also what are the areas where your particular business might be weakest and lacks some maturity. And then also in terms of the industry, and again, we talked about partners and vendors and the value chain and all of that. So do that risk assessment for your compliance program, if that’s your specialty, and then take a look at those areas where you really need to be improving things. The good news is that DOJ expects continuous improvement. And so you will always have a chance to do more, even if you believe you’re really really good in something, you know, every year or two, you might want to go back and revisit that and just make sure. There’s lots of metrics. That’s a long way of saying you’ve got those elements. And then you’ve got lots of ways to measure how many people are you training? How many people are doing their training on time? I mentioned earlier, you know, the hotline, how many folks are calling into your hotline, and how many people are leaving a name versus anonymously? You know, Ethisphere has some terrific statistics about businesses and companies that have these really robust, speak up cultures also tend to retain employees better, and they tend to be competitive in the stock market. So there are lots of measurements out there that people use. How do you then really judge success, though, because things will go wrong, right? Whether it’s cybersecurity attack, god forbid, or an employee messing up and clicking on something or whatever it might be, things do go wrong. So you have to also think about not just kind of things that are standardized metrics, which are good, but you want to think about too, what’s your response time? How are you building that resiliency? First you have to recognize the issue and identify the issue if you’re not a subject matter expert, right, and somebody dealing with risk or privacy or cyber every day, does your employee who has some other really important job? Do they recognize the issue? And then as a company as a team, do you have the resiliency to figure out what went wrong? How do you stop the bleeding? How do you treat the issue? How do you, you know, take those lessons and do your after action report. And maybe there’s an opportunity for some remediation, or additional training or some tone at the top, those types of things are really I think, where you start to see your ROI, your return on investment of compliance, and also you start to see some effectiveness. So a really simple metric of course is, maybe you had 10 calls to the hotline, one quarter, and you had, you know, 75, the second quarter that shows that people are learning how to call in, that’s terrific. You know, I always tell people, it’s not, it’s a good thing that people are calling it, sometimes Senior Management gets nervous. Oh, there’s too many calls. No, no, no, there’s no such thing. What you want to look at, of course, is your substantiation rate? And what are the types of issues where you need corrective action? So there’s lots of metrics out there, you should look at them, you should try to employ them. But then the sort of second round, maybe a bit more sophisticated analysis, is are people really understanding the message? And are we building that resiliency as an organization of spotting an issue? And how do we how do we learn from it?

Christine Halvorsen 46:22
Absolutely. And I think that kind of goes to where kind of compliance and privacy and security programs are going, right? I think they’re maturing over the years, and it was always the interest of the board, or the C suite that had those metrics, and they were the ones that cared, and the employees were hands off. So now it’s no more an individual sport of the C suite and board, it’s actually a team sport of the whole entire organization, right, to be responsible for this and having those, again, in building that into your culture and the values of your company. So…

Lynn Haaland 46:49
Absolutely, no, I love that. Chris, if I may just echo that for a second. You know, I was an athlete when I was younger. And I think being part of a team, you know, also being in US government, that I think is something that many people in government have in common too, is that you just enjoy being a part of a team. And to the extent that you can make that work in your business, I do think that’s a nice way to talk about it. And it could work for your culture, if it does great if it doesn’t try something else. But some people talked about families, you know, business as a family, I like to think of it as a team. And each department has their crushing responsibility and tasks for the day, the week, the month, the year that they need to deliver on. But as we talked about earlier, it’s really important to try to build those assurance functions in as something everybody worries about whether it’s privacy, cybersecurity, compliance, ethics, doing business with integrity, those are things that everybody should own, not just you or me, because if you leave it to one little corner, not going to work. So having that, you know, really trying to make it a cross functional effort and having business folks own that piece of it and understand how it does drive results and drive innovation. It may be challenging, but it’s worth the effort.

Christine Halvorsen 48:05
Absolutely. And just on that great, that team environment, kind of the last question here is having worked in government, and now in commercial, how important is that public private sector relationship and forming that team around the compliance and the regulation, cybersecurity and privacy? How important do you see that?

Lynn Haaland 48:24
It’s really huge, I really do think it is. And I think that’s something that, again, not pretending to be the expert in all of these areas. But from my experience, at least having been in USG and now in the private sector, on each side of that fence, I think there’s sometimes can be a lack of understanding. And so the more that we can talk together, obviously, again, everybody’s busy, and everybody has their own perspective and their own, you know, KPIs and things that they’re trying to drive and accomplish. But the more that we can have those private public partnerships, in particular, I think in areas like cybersecurity and privacy, where you may not know that a cyber attack is occurring until someone from the FBI gives you a call and says another company has experienced this. And if that first company doesn’t share, then the next company may not be able to prepare itself. Hopefully, they’re preparing already. But you know, so the things like that, of course, I think are really key, and building some kind of understanding so that we can mitigate and respond to these types of threats. I think it just makes everybody stronger if we’re able to build those coalitions.

Christine Halvorsen 49:28
Yeah, thank you. And I think especially in the US what you’re seeing now, right? It’s not just FBI right now you have CISA taking a bigger role in all this. You have FTC, FCC, DOJ starting to take bigger roles in all this even Department of State from a global perspective, right to the report that you were mentioning. So I think there’s a lot there that now as a whole of government that instead of an individual sport is becoming a team sport with DHS in there as well. Right. So I think even the government’s are recognizing that and trying to figure that out too. So lots of different people to coordinate with but I think like you said it makes your organization even stronger to kind of know what’s on the horizon and what’s coming, so you can be more proactive. Well, Lynn, thank you so much for your time today. This brings us to the end of this episode of Risky Women Radio. And thank you again, for all your insights, your thoughts, and your willingness to really share what you’ve learned along the ropes here of you know, coming from government going and scaling with a company that has been fantastic for communities and working towards providing the capabilities and services that it has in a time that was really hard for everybody. And we look forward to our next podcast episode in December. So thank you, Lynn.

Lynn Haaland 50:37
Thank you so much again, for the invitation, Chris, to you and to Protiviti I really appreciate it and great to see you and talk about some of these important things today.

Kimberley Cole 50:46
Thank you for listening to this exciting episode of Risky Women Radio, to connect, champion and celebrate women in risk, regulation and compliance. I’m Kimberley Cole, based in Hong Kong. For more information on the Risky Women global network, head to our website, and the episode notes and please be part of the ongoing conversation by subscribing to this podcast, connecting with us @RiskyWomen on Twitter, or even reaching out to me directly by email.