Where the numbers come from.

15 to 25 percent recoverable IT spend in year one

The Three-week Cost Optimization Initiative and the Two-week Vendor Rationalization Initiative cite this range. It is the conservative end of published consolidation and rationalization benchmarks for mid-market organizations. Year-one recoveries above 25 percent occur but require either deep SaaS sprawl or a pre-existing renewal cliff.

Sources: Forrester research, BetterCloud State of SaaSOps, Zylo SaaS Management Index.

20 to 30 percent SaaS spend reduction from consolidation

Mid-market companies typically run between 100 and 250 SaaS applications depending on whose benchmark you trust (BetterCloud puts mid-market at ~106 apps; Zylo's 2025 SaaS Management Index puts the 501-to-2,500-employee range closer to 255). Consolidation alone (before contract renegotiation) recovers in this range.

Sources: BetterCloud State of SaaSOps 2024-2026, Zylo 2025 SaaS Management Index, Productiv State of SaaS.

~30 percent of digital transformations meet target value

Cited on the Three-week Change Readiness Initiative page. Boston Consulting Group research consistently puts the success rate near 30 percent. The remaining 44 percent produce limited value and the remaining 26 percent produce none. The cause is almost always change management, not technology.

Source: BCG: Flipping the Odds of Digital Transformation Success.

88 percent of AI POCs never reach production; 95 percent of GenAI pilots produce no measurable ROI

Two separate measurements of the same pattern. IDC and Lenovo report that 88 percent of AI proofs of concept never reach production. MIT NANDA's 2025 research found 95 percent of generative AI pilots in their sample produced no measurable ROI. Both are cited on the Two-week AI Technical Readiness Initiative page. Root cause is usually data readiness, not model quality.

Sources: IDC + Lenovo AI research, MIT NANDA.

83 percent of organizations plan agentic AI; 29 percent feel ready

Cited on the Six-week AI Security and Compliance Initiative page. Cisco's 2026 State of AI Security report is the source. The gap is controls (identity, scoped permissions, action logging, kill switch).

Source: Cisco State of AI Security 2026.

Annualized Loss Expectancy (Hubbard & Seiersen)

ALE = Single Loss Expectancy (SLE) multiplied by Annual Rate of Occurrence (ARO), with each number expressed as a defensible range rather than a point estimate. SLE is grounded in asset value and exposure factor. ARO is grounded in industry incident data and the organization's own history. The methodology, applied throughout the Security Posture, Board Governance, and AI Security Initiatives, is documented in Doug Hubbard and Richard Seiersen's How to Measure Anything in Cybersecurity Risk.

Source: How to Measure Anything in Cybersecurity Risk (Wiley, 2nd edition).

NIST Cybersecurity Framework 2.0 (February 2024)

NIST CSF 2.0 is the voluntary framework most US boards now expect their companies to align to. Organized around six functions: Govern, Identify, Protect, Detect, Respond, Recover. The 2.0 release added Govern as a top-level function, which put boards on the hook. Used as the structural backbone for the Three-week Security Posture Initiative.

Source: NIST Cybersecurity Framework.

NIST SP 800-131A Revision 2 (March 2019)

"Transitioning the Use of Cryptographic Algorithms and Key Lengths." Used as the authoritative reference for cipher deprecation (notably RC4) across the RC4 readiness briefings, compliance violation analyses, and any cryptographic control discussion.

Source: NIST SP 800-131A Revision 2.

NIST SP 800-53 Revision 5 (September 2020, updates through 2025)

"Security and Privacy Controls for Information Systems and Organizations." Used for FedRAMP-adjacent assessments and for the SC-13 (Cryptographic Protection) finding language in the RC4 compliance briefings.

Source: NIST SP 800-53 Rev 5.

NIST SP 800-171 Revision 3 (May 2024)

"Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations." Maps directly to CMMC Level 2 requirements (Requirement 3.13.8 for cryptographic protection during transmission, 3.13.10 for cryptographic key management).

Source: NIST SP 800-171 Rev 3.

SEC Item 106 of Regulation S-K and Item 1.05 of Form 8-K (Final rule December 2023)

Item 106 requires the annual 10-K to describe the board's oversight of cybersecurity risk and the management process for assessing and managing material risks. Item 1.05 requires disclosure of material cybersecurity incidents within four business days of the materiality determination. The clock starts at the materiality determination, not at incident detection. Cited on /for-board/, the Three-week Board Technology Governance Initiative, and every CISO-altitude page.

Source: SEC Final Rule 33-11216.

Delaware Caremark doctrine (Sorenson 2021, Bingle 2022, current jurisprudence)

Directors of Delaware corporations have a fiduciary duty of oversight over mission-critical risks. Pure cyber-failure Caremark claims have mostly lost at the pleading stage: the Delaware Court of Chancery dismissed the SolarWinds derivative suit in Construction Industry Laborers Pension Fund v. Bingle (Sept. 6, 2022) and the Marriott derivative suit in Firemen's Retirement System of St. Louis v. Sorenson (Oct. 5, 2021). Exposure has shifted toward cases where the company issued materially misleading statements about its cybersecurity and the board cannot show a process to verify those statements. Cited on /for-board/ and the Three-week Board Technology Governance Initiative FAQ.

Source: Harvard Law CorpGov Forum analysis.

HIPAA Security Rule (45 CFR Part 164, with NPRM December 2024)

Cited on the Four-week Compliance Readiness Initiative and every RC4 healthcare briefing. The existing rule treats encryption as an addressable specification under 45 CFR § 164.312(a)(2)(iv) and § 164.312(e)(2)(ii). The HHS December 2024 NPRM would move encryption from addressable to required for ePHI at rest and in transit, and would add a compliance-audit standard at least every 12 months.

Sources: 45 CFR § 164.312; HHS HIPAA Security Rule NPRM.

PCI DSS 4.0 (mandatory March 31, 2025)

Cited on the Four-week Compliance Readiness Initiative. As of March 31, 2025, the 51 future-dated requirements that were optional best practices in 4.0 are mandatory. Requirement 4.2.1 mandates strong cryptography for cardholder data transmission. Requirement 8.3 covers authentication. Requirement 12.3.3 requires a documented cipher inventory and remediation plan.

Source: PCI DSS v4.0 Document Library.

NYDFS 23 NYCRR Part 500 (Second Amendment, phased through November 2025)

Cited on /for-board/ for the CISO attestation language. The board or senior governing body must have sufficient cybersecurity understanding to exercise oversight, require management to maintain the program, and review the annual CISO program report.

Source: NYDFS cybersecurity guidance.

CMMC (Cybersecurity Maturity Model Certification)

Cited on the Four-week Compliance Readiness Initiative for defense-contractor briefings. CMMC Level 2 and Level 3 requirements map directly to NIST SP 800-171 and NIST SP 800-172. CMMC certification is a contract requirement for many DoD contractors.

Source: DoD CIO CMMC program.

FFIEC IT Examination Handbook (Architecture and Operations booklet, updated 2024)

Cited on /for-board/ for OCC, Fed, and FDIC-supervised institutions. The board approves IT strategy aligned to risk appetite, receives regular Architecture, Infrastructure, and Operations governance reports, and is educated to review performance.

Source: FFIEC IT Handbook.