topic Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election in Welcome

Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

mencik — Fri, 19 Aug 2022 13:14:31 GMT

Myself, Diana Contesti, and Richard Nealon are all trying to get onto the ballot for the upcoming ISC2 Board of Directors Election and need your support. For information about us and how you can help, see:

Stephen Mencik petition
Diana Contesti petition

Richard Nealon petition

Thanks for your support.

Stephen Mencik
CISSP, ISSEP, ISSAP

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

denbesten — Fri, 12 Aug 2022 20:22:43 GMT

I post to suggest extending your platform to encourage future independent candidates by simplify/improve the petition process. Today's process has the following problems:

Members need to disclose "non-public" information to the candidates -- their email address and member id.
Candidates have a highly burdensome data collection and organization effort.
(ISC)² must extend a significant effort to audit ad-hoc data.
There is no apparent mechanism for members nor candidates to become aware of nor to fix any data defects.
An unethical candidate could use information collected in a prior year to forge endorsements.

A little bit of help from (ISC)² would go a long way towards simplifying the entire process. Imagine, for example, that it were possible for Stephen to advertise a link "https://isc2.org/dashboard/iendorse?email=steve@mencik.com" that upon member click:

Authenticates the member via login to the member-dashboard.
Validates the member is in good standing.
Validates the candidate is in good standing.
Prompts the member to confirm their endorsement.
Records the endorsement in a database.
Emails both the member and the candidate at their "email of record" to memorialize the event.

If something like this were implemented, workload disappears for just about everyone, including the (ISC)² auditor.

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

wimremes — Sun, 14 Aug 2022 09:06:18 GMT

Discussions

@denbesten wrote:
I post to suggest extending your platform to encourage future independent candidates by simplify/improve the petition process. Today's process has the following problems:

Members need to disclose "non-public" information to the candidates -- their email address and member id.
Candidates have a highly burdensome data collection and organization effort.
(ISC)² must extend a significant effort to audit ad-hoc data.
There is no apparent mechanism for members nor candidates to become aware of nor to fix any data defects.
An unethical candidate could use information collected in a prior year to forge endorsements.
A little bit of help from (ISC)² would go a long way towards simplifying the entire process. Imagine, for example, that it were possible for Stephen to advertise a link "https://isc2.org/dashboard/iendorse?email=steve@mencik.com" that upon member click:
Authenticates the member via login to the member-dashboard.
Validates the member is in good standing.
Validates the candidate is in good standing.
Prompts the member to confirm their endorsement.
Records the endorsement in a database.
Emails both the member and the candidate at their "email of record" to memorialize the event.
If something like this were implemented, workload disappears for just about everyone, including the (ISC)² auditor.

Discussions about this has been had before but given that petitions, by design, challenge the organization and its board any failures in the process could be seen as obstruction by the organization (or the board). I personally like the self-nomination process but I specifically did not follow it this year because I felt the Board was not ready for that challenge. When I was on the board we gradually opened up nominations and the influx of candidacies was a real challenge. Fully open nominations were 100% going to be a disaster, especially with a Board that has not met in person for quite some time.

I like the suggestion of some kind of button as a core functionality of member profiles. Especially because petitions aren't just meant for elections but also to bring items onto the board's agenda. I think this can be considered as part of involving the membership more in the Board's decision making.

I have endorsed the other petitioners' candidacies. It's going to be a tall order to add even one candidate to the slate but I am hopeful that we can do it!

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

denbesten — Mon, 15 Aug 2022 17:46:22 GMT

@wimremes wrote:
@denbesten wrote:
...simplify/improve the petition process....
Discussions about this has been had before but given that petitions, by design, challenge the organization and its board any failures in the process could be seen as obstruction by the organization (or the board). I personally like the self-nomination process but I specifically did not follow it this year because I felt the Board was not ready for that challenge. When I was on the board we gradually opened up nominations and the influx of candidacies was a real challenge. Fully open nominations were 100% going to be a disaster, especially with a Board that has not met in person for quite some time.

I like the suggestion of some kind of button as a core functionality of member profiles.

So, something reminiscent of We the People. I felt that was a great attempt at engaging the constituents. I especially like the thought that issues generating enough buzz deserves a bit of Board attention and a response of some sort ... even if just "we are aware of the issue, but can not comment on ongoing personnel/legal matters". And just like We the People, the thresholds can be tweaked over time to ensure a steady stream without a flood.

Allowing ourselves to stop because "...failures ... could be seen as obstruction..." would be "allowing perfect to become the enemy of good". The way to avoid this is building (earning) trust. Trust builds tolerance; lack of trust builds conspiracy theories. In this case, one first builds in audit evidence (emailing both parties, showing on-going tallies, etc) so that failures become obvious with a focus on data preservation. Then, when problems do occur, be transparent -- both in reporting the problem and in explaining the mitigation along with any lingering impact.

Nothing really specific with (ISC)² here. This is just fault-tolerant product design and a customer-focused approach.

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

wimremes — Mon, 15 Aug 2022 21:49:54 GMT

Yeah, and the Bylaws provide for that with the petition process for elections and bringing items to the board. Arguably, 500 member votes in an organization that has 150.000 members should be seen as relatively low. 0.33% is virtually nothing. It's extremely hard to gather those 500 member votes though.

That speaks more to the engagement and actual involvement of the membership than to the efficiency/transparency of the defined processes.

I'd say that member engagement should be a high priority for the board on an ongoing basis. An organization with 150k members where less than 2% actually give a sh*t is dysfunctional and requires significant introspection.

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

mencik — Tue, 16 Aug 2022 01:33:01 GMT

@wimremes @dcontesti

Even though the above is on the Election FAQ, per Graham Jackson, General Counsel and Corporate Secretary of ISC2 (see email below), the organization will not send an email on our behalf. Note that the referenced date of August 3, 2022 is long after the election process started. In other words, the ISC2 Organization decided to change the rules in mid-stream. At the very least, that is not fair. Also note that 85 people nominated to be on the Board of Directors. Yet, only 5 were chosen for the 5 vacant slots. This means the Nominating Committee/Board of Directors never had any intention of this being an open and fair election. I can't believe there were not at least 5 additional qualified candidates out of the other 80. What this means is that the Nominating Committee/Board of Directors decided to hold the election with themselves as the only voters and then ask the membership to ratify their decision. That is wrong and unethical.

Every member of the current Board that voted for this has violated the Code of Ethics and should resign immediately. Oh yeah, it was stated this was unanimous. Even the incumbent selected did not recuse (at least it was not noted). Specifically, the first 3 Canons of the Code of Ethics were violated:

Protect society, the common good, necessary public trust and confidence, and the infrastructure.
Act honorably, honestly, justly, responsibly, and legally.
Provide diligent and competent service to principals.

I contend their actions of not nominating more than 5 people and changing the rules in mid-stream, and then refusing to discuss any of this, despite multiple complaints, violates those areas I have highlighted.

I suggest the Board resign in total, and the 85 names be presented to the membership to choose 13 replacement Board Members.

Email from Graham Jackson in response to our request to have ISC2 send an email on our behalf.

Dear Diana, Richard and Stephen,

Thank you for reaching out regarding the (ISC)2 petition process. As noted in our August 3, 2022, email, (ISC)2 will not email on behalf of petitioners.

In 2021, the (ISC)2 Board embarked on a review of the organization’s nominations, governance, and committee structure practices to ensure that we are creating an inclusive organization that is well poised to serve the needs of the profession into the future. The Board has compared current practices to those of similar global associations, as well as discussed and debated practices in two member-led taskforces. As a result, several recommended improvements were submitted to the full board for consideration, including changes to create a more inclusive board nominations process by hosting an open call for nominations with all (ISC)2 members. The Board approved this recommendation and more than 85 members took advantage of the new open call, which was followed by a rigorous review and interview process.

I appreciate you pointing out the language in the FAQ. The correct instructions were included in the August 3 message to the members announcing the 2023 (ISC)2 Board Slate. I will ensure that information is corrected, and I apologize for the confusion.

More information will be forthcoming regarding governance changes in keeping with our commitment to transparency. Please keep a look out for more details.

Kind regards,

Graham

Graham Jackson
General Counsel & Corporate Secretary

(ISC)², Inc.
311 Park Place Boulevard, Suite 400
Clearwater, FL 33759
United States

Office: +1 (727) 683-0771

www.isc2.org | gjackson@isc2.org

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

dcontesti — Tue, 16 Aug 2022 05:32:26 GMT

@TrickyDicky @mencik @wimremes

I do not believe the Board is acting ethically nor potentially working within the guidelines of the Articles of Incorporation. The rules of the game seem to keep changing as if to suit them.

Even if the changes were planned, they should have been announced from DAY 1. This is a sign of sloppy management of processes and playing catch up.

I also cannot fathom that 85 people submitted their names for consideration and the best the board could do was to present 4 new people and 1 current board member.

(ISC)2 is becoming an organization that puts out paper certificates that may not be worth the paper they are printed on.

This organization is acting in poor faith. We will speak out of both sides of our mouths and NO ONE will notice.

Someone said it best "A CROCK OF XXXX"

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

wimremes — Tue, 16 Aug 2022 07:41:57 GMT

As I have mentioned to others before, the actions of the board (and now management) throughout this year's election at least appear to be contrary to its responsibilities under both ANSI27024 guidelines and IRS 501c regulations.

ISC2's Board and Management have no intention to hold a fair election this year.

At this point I do not care about the success of my petition a single bit. I believe the current BoD, as a whole, should resign and be charged with Code of Ethics violations.

Obviously, Ethics complaints are outside the realm of possibilities because the current BoD *is* the Ethics committee. Even if they wanted to consider the complaints, the committee wouldn't be able to do it as the committee members that are Board members would have to recuse themselves, removing quorum. I rarely assume malice but all of this is shaping up to be a well thought out plan being years in the making.

Thank you Zachary Tudor for leading OUR organization to the lowest of lows. I expected nothing less from you.

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

JoePete — Tue, 16 Aug 2022 11:31:10 GMT

@mencik wrote:

Every member of the current Board that voted for this has violated the Code of Ethics and should resign immediately.

That may be a little over the top. I agree there is an incongruity between how this process is proceeding and the way it should be handled under law, bylaw, and the standards for rules of order. The core issues of election and so forth are contained in bylaws - something only amendable by a two-thirds majority vote of the members. A @GJackson apparently wrote to you:

The Board has compared current practices to those of similar global associations, as well as discussed and debated practices in two member-led taskforces.

The board took it upon themselves to change the process. I'm not sure I would call that unethical as much as misdirected. The product of the board's research and its subcommittees should have been put into a document, shared with the members, and produced some recommended bylaw changes. While in their current state the bylaws are so poorly worded that they permit a process where the board could basically declare no elections (because they could simply reduce the size of the board by one-third of the current seats) to open write-ins (because the bylaws permit that too).

But I am really curious what other global associations the board studied. I've never come across a member association or the like that has a board design and election like this. This kind of design where the board essentially picks itself and its successors is something you usually see in structures where there is a huge disparity in equity among membership (e.g., you have a single founder who most of the shares). Those with the equity want to preserve or preserve the direction. However, we're a much different animal (150,000 peers).

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

mencik — Wed, 17 Aug 2022 02:56:18 GMT

I see the Election FAQ has now been updated to remove the statement about sending an email on behalf of a petitioner. It is a good thing that we have time-stamped screenshots.

Why is it that such action can be completed so swiftly, when all of the concerns raised in this and other threads go ignored? This is exactly the lack of transparency that we the members have been complaining about. The message being sent to the membership is, "We don't care about your concerns. Just send us a check every year."

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

dcontesti — Tue, 16 Aug 2022 15:25:47 GMT

So a little history here:

Both Wim Remes and I (Diana Contesti) were past-chairs of the board but yet neither one of us seem to be qualified in the eyes of the existing board to be members or even considered for the ballot.

Richard Nealon also petitioning, was Secretary for the organization and chaired numerous committees.

My two cents:

Each chair should build and improve on what past chairs have put in place, this was the case with Pat Myers who followed Jim Wade. They looked at processes and tried to make them better. I did the same and so did Wim. No process is perfect out the door.

However I wonder what the five candidates bring to the floor that two past chairs cannot????? Maybe some politicks going on????

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

wimremes — Wed, 17 Aug 2022 08:08:46 GMT

Just for transparency, I did not partake in the self-nomination process.

I had several reasons for this, the main one being that I did not believe that the board had the capacity and resources to handle dozens of self-nominations, especially given the very short timeline. I did start the process but, if my memory serves me well, I stopped after the first few pages of questions did not even start to touch on a candidates capabilities to serve on the board.

I definitely wasn't wrong about my main reason. The board selected 5 candidates for 5 positions out of 85 submissions. It feels like they ran a hiring process more than a nomination process. They "hired" for who fits in their image of a board member and denied the membership choice.

I know it doesn't mean anything to them but I can't even start to explain how disappointed I am in the people I once considered my peers. Some of them even my mentors.

Maybe I am most disappointed in myself for not ensuring that the membership would have the tools to recall a board that has forgotten who they serve.

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

Peter — Wed, 17 Aug 2022 10:16:48 GMT

Given ISC2 is the Trump Tower of the security world, that tells me they think they have a 98% approval rating due to the silent majority.

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

wimremes — Wed, 17 Aug 2022 10:51:05 GMT

@Peter while nothing about this should be surprising, I'm looking at a Board that I served on until 4 years ago (I rolled off at the end of 2018 due to term limits) and that was set up for success. With that I mean:

We had implemented term limits
We had a framework to renumerate the CEO not solely on financial goals but also on impact to the membership (I negotiated CEO contracts twice as Chair of the Board)
We had a product management framework to continuously assess the performance of certifications
We had a dedicated, independent, and performant Ethics Committee that wasn't "aligned" with the Board

What I am witnessing right now is very disconcerting. I'm seeing people that were part of the Board the first few years of my service (Houser, Melnick, Slay) and people that I worked with at the tail end of my service (Tudor, O'Neill, Friedman) to establish all of the above throw all of these things out and seemingly delegating to management fully.

At this point all I can assume is that the new CEO is much stronger than the combined capability of the Board at running a business and applies their understanding of certifying CPAs to our profession. It's extremely saddening to observe. The Board has allowed our association to be ripped from our hands and doesn't even realize it.

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

JoePete — Wed, 17 Aug 2022 17:28:34 GMT

@wimremes Thanks for the background and your viewpoint. In my experience, I think many industries have this struggle between boards and management. To me, it gets back to governance. You need to draw the lines of responsibility. Every board is bestowed with both strategic and executive power to start. Through bylaws, and policy they delegate out some of that executive authority to officers, employees, committees and so forth. Ultimately, though, the board is at the top of the food chain.

Good executives, however, know how to drive a board. That's not a bad thing. As I am sure you experienced, board members move in through a revolving door with a range of experience, capabilities, and agendas. A good manager knows how to focus a board. But again, it's done through governance. Good policy from the board sets a template for decision making and allows that continuity from board to board. That's not to say a successive board can't change the parameters set by a prior board (or even the policy), but a well written policy off the bat identifies the key metrics and steps. A new homeowner can change the paint color, windows, etc., but they likely working within the walls and footprint. Only in the most dire situation do you bulldoze the house and rebuild.

Honestly, I don't think the (ISC)2 membership is so engaged that we can act on these issues. Personally, I am not in a position to pass judgment on the current board or management. I do surmise, from a lifetime of experience, that we seem a little top-heavy on management for a member association with very limited infrastructure. But one of the challenges for organizations, especially in the face of board turnover, is that management ends up being more stable than the board. Whether intended or not, management starts being the keeper of vision and continuity. What's usually around the corner is dysfunction as management starts doing the board's job (maybe because the board doesn't know its job), and boards start poking their nose into operational issues because that's what gets people's (and those who elect them) attention.

It does seem a crucial time and thanks for shedding light on these crucial issues.

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

ericgeater — Thu, 18 Aug 2022 00:48:57 GMT

You're stating concerns that you believe affect the membership at large, and I completely agree that terms like transparency and ethics tend to arouse an alignment within a group who are, shall we say, innately aware of the importance of clear, just, unbiased leadership.

I think your campaign would greatly benefit from succinctly hearing exactly how your concerns would benefit me as a member. Because, at this point, I'm only aware that there's a beef (or cause célèbre, or struggle, or what have you) with an organization who -- like any other organization -- has the express right to establish its governance as its leadership sees fit.

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

mencik — Fri, 19 Aug 2022 13:20:22 GMT

@ericgeater wrote:
You're stating concerns that you believe affect the membership at large, and I completely agree that terms like transparency and ethics tend to arouse an alignment within a group who are, shall we say, innately aware of the importance of clear, just, unbiased leadership.

I think your campaign would greatly benefit from succinctly hearing exactly how your concerns would benefit me as a member. Because, at this point, I'm only aware that there's a beef (or cause célèbre, or struggle, or what have you) with an organization who -- like any other organization -- has the express right to establish its governance as its leadership sees fit.

Do you have any idea what is discussed at Board meetings? I don't, and meeting minutes are kept secret.

Do you have any interaction with the Board to suggest programs that might be of value or just to ask questions about specific policies? Have you ever received a reply from any Board member? I have not.

Did you know that the Organization has a policy of not disclosing the policy statements they have to the membership? That's what I have been told.

Do you realize that 85 people were nominated for this year's Board election and only 5 were selected to be on the ballot? Did you know there were 5 positions up for election? That means that we are not allowed to vote on who we want to be on the Board, we only get to affirm the choices the existing Board made for us.

With all of those concerns, how do we know where our money is really being spent? Is it worth having a CEO that makes over $1 million per year, or a General Counsel that makes over $350 thousand? Maybe, but I don't know. Do we know that the expenditures that are reported are correct?

Honestly, I don't get any benefit from this organization other than having a ticket punched for my job. But I am trying to get involved in order to find out what is going on behind the scenes and see what can be done more for existing members, rather than just selling training and exam seats.

All I want is to see the Board add 5 more names from the 80 nominees not selected, and give the membership a true choice. I'm sure there are at least 5 of those 80 that are more than qualified. I will not be upset if I am not one of those 5. We deserve choices.

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

gidyn — Thu, 18 Aug 2022 07:22:48 GMT

I can buy from Walmart without the foggiest idea or care of how they're governed. That's how the overwhelming majority of "members" view ISC2. Not as a membership organisation, but a certification vendor.

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

wimremes — Thu, 18 Aug 2022 07:42:05 GMT

@ericgeater wrote:
You're stating concerns that you believe affect the membership at large, and I completely agree that terms like transparency and ethics tend to arouse an alignment within a group who are, shall we say, innately aware of the importance of clear, just, unbiased leadership.

I think your campaign would greatly benefit from succinctly hearing exactly how your concerns would benefit me as a member. Because, at this point, I'm only aware that there's a beef (or cause célèbre, or struggle, or what have you) with an organization who -- like any other organization -- has the express right to establish its governance as its leadership sees fit.

Eric,

You make good points. Personally I have elaborated on many of these things at https://www.be-represented.org.

To your direct question, I think we are at a crucial time for our profession. We are seeing fragmented debates about licensure across the globe. There are concerning examples from Australia, Singapore, Japan, the UK, the US, and many other countries. There is a documented workforce shortage in our industry. Organizations and individuals around the world are continuously hammered with devastating ransomware attacks.

The association operates globally as a 501c6 expressly to protect our shared interests as security professionals and, as its Bylaws state, to deliver value to society.

I may not be fully aligned with the other petitioners and might ask questions differently but at the core we as members deserve to be informed about how (ISC)2 is applying its funds to protect our shared interests and to deliver value to society.

I disagree with your assessment that (ISC)2 has the express right to establish its governance as its leadership sees fit. The articles of incorporation, the association's Bylaws, its 501c6 status, and its certifications' ISO17024 significantly restrict what its leadership can do. Changes to the Bylaws can only be implemented after approval by the membership. This is primarily where the Board, over the past 3 years, has changed its approach. When I was on the Board, and I believe the same goes for @dcontesti and @TrickyDicky , we understood that the Bylaws were written succinctly and quite openly. It was our policy to take a very conservative reading of the Bylaws. Most recently the Board seems to have reversed that and it currently applies a very liberal reading of the Bylaws. Running a slate with only 5 candidates for 5 open seats is an example of that. It is not strictly against the Bylaws but it is definitely against the spirit of the Bylaws. This also goes for the composition of the Ethics committee and the merging of the Ethics and the Bylaws committee. These are 3 governance actions that are questionable at best considering all limiting factors mentioned above. If the association continues on this path, ISO17024 accreditation and 501c6 status may even be impacted.

The Board overseeing the CEO should ensure that the organization focuses on its 2 stated reasons for existence.

As a member, or generally as a security professional, you would greatly benefit from an association that finds its focus back, that is committed and involved on furthering our profession and not just by giving away 1 million free entry level certifications but by actively helping politics and society globally understand what they can expect from a security professional and how to recognize professionals from amateurs. Not to mention providing society information, insight, and tools that help to protect itself.

All that said, (ISC)2's Board is supposed to be elected by its membership. The upcoming election, if no petitions are successful, is just a confirmation of the Board's will. It's counter to anything we should reasonable expect from a representative Board, to the basics of the association's 501c6 status, and to the association's claims on its Form 990 submissions.

Re: Petition to be on the Ballot for the 2022 ISC2 Board of Directors Election

wimremes — Thu, 18 Aug 2022 07:46:20 GMT

@gidyn wrote:
I can buy from Walmart without the foggiest idea or care of how they're governed. That's how the overwhelming majority of "members" view ISC2. Not as a membership organisation, but a certification vendor.

I think that is a fair assessment but then I'd argue that the association can do what the members expect from it for much less than $18,75 million per year.