Latest / Calm Under Fire / Karina Klever

Transcript

Karina Klever · Calm Under Fire

• Col. John Boggs: Welcome to Calm Under Fire. I'm Colonel John Boggs, president of Fortitude Consulting, an executive leadership development and coaching firm. And our guest today is Karina Clever. Karina has spent more than two decades helping organizations navigate risk, compliance, and security in environments where the consequences of getting it wrong are significant. As founder and CEO of Clever Compliance, She works across industries to build governance and risk systems that go beyond checklists and actually protect what matters. Her work sits at the intersection of accountability, decision-making, and leadership under pressure, especially when the risks aren't always visible. Karina, welcome, and thank you very much for being here today. Karina Klever: Thank you so much for having me on. It's a pleasure. Col. John Boggs: Wonderful. Well, Karina, can we go ahead and jump right into it? Karina Klever: Yeah, absolutely. Col. John Boggs: Perfect. Karina, now risk and compliance often operate in the background until something goes wrong. When does that pressure become real for leaders? Karina Klever: So I always used to say that the Sony hack was one of the best things that happened to our industry because before that people didn't really care. was back, know, cybersecurity was like an afterthought. But that kind of, I think, was the impetus to very many in our industry that started to really, really take note. So I think that we unnecessarily confuse ourselves and we listen to folks around us who really upsell opportunities to keep clients confused and companies confused and if we kind of look through that and align our GRC program to our true real operations, it's actually Col. John Boggs: Mm-hmm. Karina Klever: a much easier go. It's not as complicated as we've made it all out to be. And so if you kind of hyper focus on the most important kind of golden egg components of your business and Col. John Boggs: Mm-hmm. Karina Klever: you put the right protection in place there, it tends to go a lot easier. And one of the things I see companies missing a lot is data classification. They use templates and hence the danger in checkbox compliance. They use templates that are made available to them and they don't really know where their data is and they don't really know what kind of data they have. They really don't know what... data travels to their vendors or maybe their vendors' vendors. And so unless those tough questions are asked and checkbox compliance is accepted, the risk is Col. John Boggs: Mm-hmm. Karina Klever: great for all of us. And the data breach shows it, especially in the healthcare industry. Close to 90 % of Col. John Boggs: this. Karina Klever: all Americans have been part of a HIPAA violation and have had their data lost. Col. John Boggs: Wow. Wow. Wow, that's, that's mind numbing 90%. Karina Klever: It's publicly available data. It's publicly available data on the OCR, HHS OCR breach portal page. And every so often I go and I just pull down the numbers of individuals affected across the US and it's usually upwards of 300 million people. Col. John Boggs: Wow. Wow. Okay. I've got to stop and ask over here. You said something that was rather significant to me. It kind of caught me off guard actually. You said, keep the clients confused. mean, IT is confusing enough. Cyber is even more confusing. So what benefit keeping them confused? How does that work? Karina Klever: Well, I've unfortunately seen far too many, and so I used to live in the corporate kind of world with large teams and Col. John Boggs: Mm-hmm. Karina Klever: a lot of politics and bureaucracy. And kind of why I chose to open Clever Compliance, because I have the ability to just say no to that kind of stuff when I'm running my own firm, right? So. There are... firms who come out under the preface of this very confusing beast called the GRC and Col. John Boggs: Mm-hmm. Mm-hmm. Karina Klever: they like to come in and really scare people and scare executives and keeping those executives scared and trusting and hoping that there's not ever going to be a question about what they're saying because they come in with an authority. Col. John Boggs: Mm-hmm. Karina Klever: It's a great moneymaker. Look, at the end of the day, it's a super duper moneymaker because Col. John Boggs: God. Karina Klever: I mean, look, if I have, you know, a framework with 300 controls. And maybe the Col. John Boggs: Mm-hmm. Karina Klever: company really needs to have 150 controls based on their size, their maturity, their industry, Col. John Boggs: Mm-hmm. Karina Klever: their true operations. Col. John Boggs: Mm-hmm. Karina Klever: How about I come in with 1500 controls, call a proprietary, staff a whole bunch of people, and just embed myself there for a few years and keep collecting? Col. John Boggs: Wow. Karina Klever: salary, right? But it happens all the time. Col. John Boggs: Sounds like you just talked about the federal government. Karina Klever: Well... And there's a ton of different examples, a ton of different examples, and it's a great, they call it land and expand. So instead of really coming in and saying, hey client, you know what, really what aligns to your true operations is these 150 controls over here. Let's get those done. Let's identify the stuff you're already doing. Let's document it. Let's gather that evidence. Let's make sure that that evidence is ready for there for the auditors. Let's knock that out and then we'll grow into anything else that you believe might be necessary. No, because if that client is scared, because what Col. John Boggs: Mm-hmm. Karina Klever: are they told all the time? You're going to jail. You're going to pay penalties. That's the name of the game. Col. John Boggs: Absolutely. Karina Klever: And so now if you have the client nice and scared and they have a budget, let's make let's make 1,500 controls out of those 115 guarantee ourselves work for a few years. Col. John Boggs: Ouch. Karina Klever: So now here comes the opposite. So now in retaliation of that accepted practice, now comes checkbox compliance, all these GRC platforms, right? Just checkbox, checkbox, checkbox. Now... In some cases, that's incredibly appropriate. In some cases, AI is just a godsend. And those integrations are just godsends, right? Because I don't want to go around and ask the admin every single month, hey, can you show me your Active Directory list again and make sure that nobody terminated is in there? Because I need a screenshot for my evidence, and I'll put it in my folder, and then I'll share it with the auditor when they get here. So in some cases, integrating that workflow, automating that workflow, fantastic. There's a big movement called GRC engineering. There's a few people that I know out of that. So sometimes that's very appropriate. It doesn't work across the board for all GRC requirements, right, and all compliance controls. But if you make it appropriate for your true, again, it always comes down to your true actual operations, right? I always use this example, biotech company, pharma company, was at 21 CFR, right? So you've got Col. John Boggs: Yes. Karina Klever: to adhere to FDA guidelines. One of the rules, I think it was titled 135, 115 says, if you make goat milk ice cream, you have to use goat milk, right? And it's part of the law. It's an actual real true control in the law. Col. John Boggs: Makes sense, okay. Karina Klever: Makes sense. However, the pharmaceutical company I was at didn't make any goat milk ice cream. Because they make drugs. They don't make goat milk ice cream. Col. John Boggs: Mm-hmm. Karina Klever: But guess what the consultant for him came in and said? Well, Col. John Boggs: Uh-huh. Karina Klever: here's our three people. We gotta go find that goat milk ice cream proof for the goat milk ice cream. So, so, so we see you have a funny look on your face and it's completely unnecessary. Col. John Boggs: Yeah. Karina Klever: But that unnecessary spin is what we see a lot in compliance, not just goat milk ice cream, but a whole bunch of other things. Col. John Boggs: Wow. Karina Klever: That, I mean, some of the statements are just absurd. And these consulting firms will bring in staffers that they're charging you a boatload of money for. to go look for controls that don't even really apply to your true operation. I think that is the tragedy in what's become of this industry. GRC is made to be the original dashboard. Core GRC principles are very, very, very, they make sense, right? That you have a document, the published document, the document has a control. If the control fails, you open up a risk registry item, a mitigation kind of plan for it. You update the control depending on the root cause. You know, maybe you update the control in the document or you say, hey, I accept the risk or I transfer the risk to my vendor. The Col. John Boggs: Mm-hmm. Karina Klever: life cycle of GRC... is incredible when established without all of the noise. The basic GRC principles are beautiful, but you have to strip all the noise away from making it work the right way. Col. John Boggs: Okay, so now you've been pretty clear that checkbox compliance is not enough. That's just not going to do it. So why do leaders fall into that trap? Karina Klever: It's easy. It's easy. It's just, right, people like check boxes. Check, check, check. I have to check a few things, right? People like check boxes. Hey, just keep Col. John Boggs: Yeah, that's true. Yeah, that's true. Karina Klever: me honest. I have a list I take to the grocery store. My wife gives me a honeydew list. Col. John Boggs: Hmm, yes. Karina Klever: Checkboxes are familial to us, right? We know how to navigate in those places. And when vendors come in with checkboxes, you trust that they know what they're doing and they're gonna guide you the right way and they're gonna go find the stuff that they need to make you compliant. so, unfortunately, not asking about what the contents of those checkboxes are is really where people fail. And then the other thing is, know, fundamentally, hierarchically, you know, we have that pyramid in corporate America, right? Top of the pyramid is we have your sea level. and then you have people under that sea level that report things to that sea level and what you want it to be are the things that you are, hey, give me a heads up. Tell me the truck's gonna side swipe me. Tell me something's gonna fall apart. Tell me something is breaking and I need to pay attention to it. But fundamentally, because of the way many of our organizations are structured, there are a bunch of of yes men or women underneath that sea level who make it their job to tell that sea level we're good. Everything, let me give you a dashboard. I'll show you all green. A lot of it's cherry picked data, right? So what ends up happening is that sea level is sitting there going, hey, we're good. I can go golfing. I can go hang out with my friends because I've got people Col. John Boggs: Good. Sure. Karina Klever: I trust underneath me that are like, A-okay. Col. John Boggs: Mm-hmm. Karina Klever: But they make it their job to not worry their boss. And because of that, this conflict happens. Because they're not digging, and those risks aren't vocalized because now they don't want to be. They don't want to be accused. Well, I have a risk in my department. I want you to know about it, dear boss, dear C-level. Well, Col. John Boggs: Mm-hmm. Mm-hmm. Karina Klever: what are you doing to fix it? Why is it there? What have you done? Why are you putting me at risk? Why did you even write down that we have a risk, damn it? I don't want the auditors to see this. And so now comes this very odd. catch-22 situation, right? Because the person under the sea level wants the sea level to feel calm and everything's good and not post Col. John Boggs: Mm-hmm. Karina Klever: those risks out, but unless you're actually managing true controls, you don't have a sense of real risk. Col. John Boggs: Wow. Wow. So what, so how, what, what does a leader to do? How do they stay grounded? How do they, how do they protect themselves? Karina Klever: They ask a lot of questions. And the number one question they need to ask is, how do these controls actually relate to me? Right? Like, Col. John Boggs: Yeah. Karina Klever: explain, just let's have a conversation. Let's sit down around a table and have you walk me through how the controls you're telling me I have to implement actually relate to my company. Enlighten me. Col. John Boggs: Wow, how these controls actually help me. Okay. Karina Klever: How do they apply to my company? Because there might be a hodgepodge of regulations and frameworks in those spreadsheets. And a Col. John Boggs: Mm-hmm. Karina Klever: lot of the firms call it a proprietary list, quote unquote, because they have systems that align to those, right? So what they Col. John Boggs: Mm-hmm. Karina Klever: want to do is they just want to give you a check box using their language and a cute little gauge. One of the dangers is So let's say out of, I don't know, 100 controls, only 42 of them actually really apply to my operations. But what if some of the other ones just I'm not mature enough yet? Or I've outsourced the risk for. So let's say out of 100 controls, now remember frameworks, there's a difference between frameworks and regulations. Regulations are the law. Right? So regulations you have to adhere to, or you have to explain why that control doesn't apply to you. frameworks are written by people like me and you with a long history and long stories and a long career that sit around a table. We ain't got much better to do. So we order pizza or sushi or salads and we sit around a table. put on our glasses Col. John Boggs: my. Karina Klever: and we're like, hey, let's pontificate. What if this happens? What if that happens? Why from this industry? I'm from that industry. I had this one experience once I had a similar experience. How about we write this? But what's the number one most important thing in a framework? broad applicability. So these Col. John Boggs: Mm-hmm. Karina Klever: frameworks are written by design to not be applicable to your industry, to your size, to your tech stack, to how many locations you have, to your maturity. They're written by design to be ethereal and vague. NIST CSF v2 on page 2 at the very top of the abstract, nobody reads this part, they go down the controls, page 2 says this is not prescriptive. This is to be used by any organization, any size, and any industry. So the part that we're all forgetting to do is we take this framework and we literally Col. John Boggs: Mm-hmm. Karina Klever: transfer it into our organization and then we start jumping hoops. What needs to happen is we take this framework, we make it appropriate for our true operations, and then we show Col. John Boggs: Mm-hmm. Karina Klever: those controls being met. Col. John Boggs: Okay. Karina Klever: And that middle part is what we're all missing. And so when I have 100 controls, but 42 of them apply to me, it means I'm making 100 % of the controls that apply to me. That's 100 % compliant. It is not I'm failing 58%. It's a very different optics. And it's having the right Col. John Boggs: Mm-hmm. Karina Klever: people in place to be able to have that conversation with the auditor. Col. John Boggs: Wow. So. This, can, my, this is just like, this is scary stuff here. This is, this is, Karina Klever: It's loaded. It's loaded. It's loaded. Col. John Boggs: this is loaded. This is scary. So how, how does a, I mean, talk about pressure. So how does a pressure expose the true culture of an organization? I mean, are they compliant? Are they living on the edge? Do they, do they even know they're living on the edge? Karina Klever: Probably not. So they're so busy working on satisfying the checkboxes and checkbox compliance that they're leaving huge gaping holes in their infrastructure. This is how we're losing all of our data. This is where all of these breaches are happening. You go download a GRC tool, you fill in a template. Yep, I got vendor management. But where does that vendor management relationship end? At the contract. What does the contract usually say? We're not responsible for the data you put in our system. You agree to all subservice organizations that we choose, regardless of where they are. We're not going to notify you if we or one of our subservice organizations loses your data. 100%. I can show. Endless, endless contracts that say exactly these things. But so now let's look at the sequence of events. I'm a company. I have checkbox compliance. I use their template. I call my vendor management tool, done. My vendor management policy, done. It has ethereal controls that you can't really, okay, I do risk once a year. All done. That does not now translate into the contracts that I have with my 40, 60, 80, 120 clients. And now those, all of my vendors from there, I've given them permission to take my data and send it on and send it on and send it on. Now what does this mean? Eventually that data is gonna end up somewhere completely uncontrolled, probably in some foreign country, probably without an HVAC or a, know, Halon system or raised floor UPS devices, right? I mean, it's gonna end up who the hell knows where, no access controls, and this is where our data gets siphoned. the time and we have identity theft and we have our personal health information completely violated, As consumers, everything we put up on social media, stop putting pictures and videos of children online, please. I cannot beg this enough because just like you think the good guys are watching, the bad guys are watching too, it's so easy to do geofences. The principal down at the middle school down the street from my house, she knows me by my first name, they have a bullet board outside and some admin likes to go in there and say happy birthday Suzy Smith you've already instantly given a geo fence and a date of birth on a child you can guesstimate a name on and an address because they're within a three-year range now start looking at social media you know their dog's name they post holiday pictures you know what their living room looks like you know where they work because they're posting stuff from from lunches Why? I actually had a tragedy with a very close friend of mine recently whose daughter went to go apply for colleges, college financing, and her claim was, her application was denied. Turns out someone in a different state stole her identity when she, 10 years ago, which you should have made her like six years old, five, Col. John Boggs: huh. Karina Klever: six, seven years old, racked up quite a set of purchases to the tune of $400,000. And Col. John Boggs: my gosh. Karina Klever: there were snowmobiles and trailers and trucks and all of these things that this person had bought is using all of this actively and just stopped paying. So now she goes to apply for student loans and she's declined. She owes a half a million dollars at 16 years old. And Col. John Boggs: 16 years old. Karina Klever: she can't get a job, right, because she's not passing background screens. This costs the family, I'd say about $100,000 between attorneys in this state, attorneys in that state, all of the... law enforcement people and she falls behind several years from all of her peers who end up going to college and tragically she commits suicide. because she's so fish out of water, right? She doesn't belong, her friends have gone on and just didn't have the coping mechanisms. And so it's an absolute tragedy. Lock your kids' social security numbers down. Nobody needs to know your kids' names. Nobody needs to know your kids' Nobody needs to know where you live. What kind of car you're driving? Stop. Col. John Boggs: my, my, this is tragic. Karina Klever: That's just tragic. Yeah. Col. John Boggs: Okay, now you've worked across industries and various frameworks. What stays consistent about leadership when the complexity continues to increase? mean, what you're talking about sounds so simple to do, but it is, yeah. Karina Klever: It is. We've made it more complex. We've made it more complex than what we needed to. We need to just focus in on, and I always, you know, this is a good one I use with clients all the time. You're a castle. There's plumbing in the castle. There's electricity in the castle. There's rooms in the castle. There's treasure in the castle. Col. John Boggs: Mm-hmm. Karina Klever: There's dungeons in the castle. You put the bad guys in the dungeon, right? And the castle has a moat. What's in the moat? How deep is the moat? Are there alligators? Are there electrical eels? How wide is it, right? And what's your drawbridge? Erex's control. So your network security diagram is your perimeter security controls. What's your mode? How are you keeping people out? And your security architecture is give me the blueprint of your castle. You don't start painting a house, you don't start building a house with what color is my couch. You don't start building a house with where am going to put the picture on which wall. You start building the house with an architect and blueprints and plumbing and electrical diagrams and where's the wall going to go? What's my foundation going to look like? Do I have city water? Do I have well water? Right? So those are the basic things you need to really identify very carefully. And now that drawbridge allows access into your castle and that's your access control, your VPNs, your permitted patterns of accessing your castle. So when I explain it this way, if we focus on that, there can be 12,000 lines in a checkbox list. I don't really care. Where are my security controls? How am I keeping the wrong people out? The right people in? How am I protecting my stuff? Do I have a lock on the door that contains the the castle treasures? Okay, Col. John Boggs: Hmm. Karina Klever: show me the lock for your most important data, your Golden Egg data. And when you talk about it in these very simple principles, people's light bulbs go off. Because then they're like, Col. John Boggs: I mean. Karina Klever: what have I been doing for a year and a half spinning around in a circle with Col. John Boggs: Mm-hmm. Karina Klever: these aimless people walking around my hallways asking for controls that I don't even know that I, I don't even know what department does goat milk ice cream. Col. John Boggs: Mm-hmm. Karina Klever: There's people walking around looking to make sure that we're using goat milk ice cream for goat milk for goat milk ice cream. But no one even says, do we even make goat milk ice cream? But it's on the checklist. So we gotta go find it. Col. John Boggs: Yeah. We don't even make ice cream. It's on the checklist. my God. my God. Well, Katrina, how does a leader keep from getting overwhelmed with all of Karina Klever: Asking a lot of questions and making sure their compliance program is aligned to their true operations. So know your business and Know which controls you can actually satisfy Know who owns gathering all of that evidence whether it's systemic or whether it's human And and make sure that you're pulling together Controls that are just really appropriate to you that you can confidently say this is what we do and then you can confidently say I know I have a hole here. I know that I have a gap. This is my risk. So I can focus in on my risk and actually make it applicable again to my true operations. We keep missing that piece. We're more focused on the checklist than we are on our true operations. Col. John Boggs: operations over the checklist. You said the golden eight. Karina Klever: Golden egg. Yeah. So here's a sad reality. We are data hoarders in our industry. I have spoken to very many executive decision makers, technology and not, where I say, you know, once we identify where the golden egg, where the most important data is. So ISACA principles tell us, I think, five to 10 percent. Okay, fine, let's call it 20 percent. Let's double it. Let's say 20 percent of the data that we actually use on a daily basis satisfies data minimization, data purposefulness requirements. It's true to our true operations. This is our most important golden egg data. Usually it's good to come in with four different data classifications. Your most, most, most important one. The stuff that's restricted based on a role, like finance has access to SAP, like, right, or payroll, right? So you have role restricted stuff, then you have operational stuff, like you have some more constructions, maybe three versions ago. If you lose it, it's really not the end of the world. It's not really public data, but it's not like, we close our company down if we lose this data. And then there's publicly available data. So public data is probably upwards of almost, I'd say 80 % in some companies, know, safely 60 % of some companies. But guess what you're told by the person selling you cloud storage and encryption? You have to encrypt everything. And the person in the leadership position who's afraid of having that liability will say, well, yeah, I guess we have to encrypt everything. So now this publicly available data, which really should be purged in about two weeks, all of a sudden becomes Col. John Boggs: Mm-hmm. Karina Klever: this incredible weight to now you're responsible for this data. Why are you even keeping it? Not only why are you keeping it, why the hell are you spending money encrypting it? And so now, because we love to data hoard, and we would rather save everything, opposed to carefully structure our data and classify our data, now we have too much data. So now we're responsible Col. John Boggs: Mm-hmm. Karina Klever: for this weight of too much data. And you know, I have a bunch of ethical hacker friends, and what do they always say? Well. Takes me about five minutes to hack in. And if I have the little data set versus the big data set, guess which one I'm picking? The bigger one, of course. This is the same five minutes. So Col. John Boggs: Bigger one, yeah. Yeah, my. Karina Klever: why do you want to hold on to that publicly available data, that public data? Why do you want to store it and encrypt it and be responsible for it? Get the hell rid of it. Right? So again, we're, we do that with other things. We do that with tools, right? We have three, Col. John Boggs: Mm-hmm. Karina Klever: you know, three leaders. who each bring in their favorite suite. So now we have the same exact alert, which by the way, usually generates out of the same exact place. But we now we have that alert on the blue screen and the green screen and the red screen, orange screen, yellow screen. And now we have technicians sitting there doing swivel chair operations completely burning out. Because they don't know which the hell screen to look at. Because a lot of the functionality is repetitive, again, comes down to knowing your own business. What are your requirements when you turn on a tool? Know your own business. Not what the salesperson tells you today. Not what you saw at RSA. Not the whiz-bang thing you saw at Black Hat or Defcon or wherever you went, right, for whatever conference. Not that. What are your company requirements so that you can pick a tool that satisfies your company requirements? Col. John Boggs: So. think I already know the answer to this, but I'm going to ask it anyway, just to reinforce. When leaders are responsible for protecting what others can't see, What do they need to remember most? Karina Klever: So. I think fair transparency and accurate transparency is very important, right? And asking those questions is really important. And it seems like the higher up we get, the easier it is and the more enticing it is to say, I've got a team that can handle it. But if you're not aligned to your company strategy and you don't understand your company's most important data and operations, it's very hard to build controls around the area you don't understand. So I mean, when I... So I'm not a pilot and I've never flown a plane. And Col. John Boggs: and Karina Klever: this is the equivalent of me walking up to a client and saying, well, did you check the gauge to make sure that it said 100? And they'll be like, what the hell? But we do that all the time. We ask questions that are relevant to our true operation. So that alignment is just critical. And with that come expectations, expectations of your GRC team. expectations for the roles and responsibilities of your executive staff, the leaders that that executive staff appoints. What does a successful control look like? And that has to be from the top all the way down to the bottom. It has to be present and it has to be part of daily operations and it can be a bad thing. There's a lot of people out there that are like, GRC? Well, I don't know. Don't write it down. Just don't write it down because if the auditor comes and asks us for it and it's wrong, we'll get dinged so better let's just not write it. So they play ostrich, right? They try to make it go away and they're really shorting their own people. mean, you know, during the wildfires here in LA, it's a little over a year ago now, we had clients... where the DRBCP documents said, blah, blah, do this thing frequently. The word frequently. What the hell's a frequently? They're calling us. Does frequently mean next week or every five minutes? Because my house might be burning and I can't find my wife and kids. What's Col. John Boggs: Right. Karina Klever: a frequently? Col. John Boggs: What is frequently? Yeah, very good. Karina Klever: Drill it! Drill that DRBCP plan with your people. And what are you focused on in your DRBCP plan? Your most important golden eggs. Because if the public data goes away, who the hell cares? Do you know where your golden eggs are? Col. John Boggs: Wow. Wow. Okay. Well, let me, let me go right here. You got a new, you got a new CEO and he's, he or she is taking over for the first time and suddenly they're faced with, well, we, and this is what we're doing with cyber. What question, what's, what's the question they should be asking their folks? I mean, I'm, the new guy. Karina Klever: Show me the internal or the external audit report, your latest one. Col. John Boggs: Ooh, show me the money, show me the external and internal. Karina Klever: external or internal right? I mean you might not have an external auditor. Show me your latest internal audit report. What did they find? Now unfortunately the answer might be, we don't have one. Col. John Boggs: gosh, okay, what does that mean? Karina Klever: And so if that's the answer, then you say, I need to see your certification against something. Like, what are we following? Show me how we're aligning to a framework or regulation. Show me those controls. Col. John Boggs: Katrina, this has been amazing. This has been amazing. Let me ask you, so for leaders and organizations that want to move beyond compliance and truly strengthen how they manage risk, how do they reach you? And could you tell us a little bit more about your company, Clever Compliance? Okay. Karina Klever: Yeah, sure. So. So I started IT in April 1989. I'm intentionally aging myself as a computer operator and I became a computer programmer on an AS400. And I did project program management up to a PMO director level and then an old colleague called and an old boss called and said, get these auditors off my back. And I'm like, you've got the wrong number. I know nothing about auditors. And he said the magical word, name your price. And there proceeded, 20 years of working in corporate America at which point I saw some very unethical things happening that were being accepted as norm and I left and I opened up clever compliance almost 10 years ago now and we pride ourselves on being tool agnostic. I don't care what tool you have, what GRC tool you have, what tech stack you have, let's look at the core GRC principles and make sure that your GRC program aligns to your true operations. We are also very proudly a company that does a lot of teaching. I think that in this world of excessive sales, we're kind of losing the GRC principles altogether. And I'm doing all I can to teach people on our team how to really decipher it and putting good, proper GRC principles in place. We have a very broad range of industries that we work with and company sizes that we work with. And we work on a very broad range of regulations and frameworks across very many different industries. So it's all very, very interesting to me. I've had a passion for it since 2002, really, when I started this leg of my career. So we are on LinkedIn. Unfortunately, we don't post as much as we should be We have a wonderful team. Some are visible on LinkedIn. Some are not by design and we We have very very happy clients who just have auditors Literally end up hugging us at the end of the audit cycles because they get to now see Really what the company is about what the true operations are and and and how How the company is putting forth the direct security measures, right? Which is really what most auditors care about the most. yeah, I'm at Karina at clevercompliance.com. And the other thing I do want to say very quickly is a colleague of mine, Mike Andrews and I, we do a monthly event on LinkedIn. It's called the GRC Room. We have many, many hundred up to several thousand people that register for this event. on May 20th. Our topic is how to govern agentic AI. It's something at the kind of tip of everyone's tongue. And so we are bringing in an expert. We do have an expert every month that joins us. We've been doing this 17 to 18 months now and our attendance is absurd. Mike and I decided many years ago when we first started talking about this that we would not be sponsored by anyone. We never pitch a tool. We never pitch company. We never pitch a product. We have a safe space where people in the GRC industry hop on and listen to just good, basic GRC and cybersecurity principles that will help them. I am very regularly at RSA and Black Hat every year and love to meet people in person and chat it up with them. Col. John Boggs: Wonderful. Karina, me your email address one more time. Karina Klever: Karina at clevercompliance.com. Col. John Boggs: Rena at clevercompliance.com. All right, folks, you just got schooled on compliance. my gosh, I hope you didn't miss any of this, but take, hey, take a moment, go find her on LinkedIn and make sure that you're not doing goat milk out there and paying for it. Okay, folks. Well, hey, Karina, thank you very much. Thank you once again for coming on. I greatly appreciate it. And for those who are listening, leadership is too serious to take light. So please make sure that you're standing firm in your leadership, particularly in your compliance. And that's it. And I'll see you all on the next go out here. Thank you. Thank you, Karina. Karina Klever: Thank you for having me on. Thank you. Col. John Boggs: Bye now.