117
More Connected, More at Risk Addressing Cybersecurity Concerns for Your Organization August 15, 2019

More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

  • Upload
    others

  • View
    3

  • Download
    0

Embed Size (px)

Citation preview

Page 1: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

More Connected, More at RiskAddressing Cybersecurity Concerns

for Your Organization

August 15, 2019

Page 2: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

About Me

2

• Director – BKD Cyber

• Over 25 years experience

• Technical assessments (networks,

applications, social engineering)

• Governance and compliance (FFIEC, PCI,

NIST, ISO)

• Help companies build or enhance

cybersecurity programs

• Retired Army Lieutenant Colonel

• Married, 4 children

Page 3: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Latest Statistics Show Less Breaches

0

200

400

600

800

1000

1200

1400

1600

1800

2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018

446

656

498

662

421

471614

783780

1091

1632

1244

REPORTED BREACHES BY YEAR

Page 4: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

However, the Impact is More

2017

1,632 breaches reported

197,612,748 exposed records

2018 had over 2.25 times more records

exposed in 76% of the number of breaches

2018

1,244 breaches reported

446,515,331 exposed records

Source: https://www.idtheftcenter.org/2018-data-breaches/

Page 5: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

5

Myths on Cyber Crime

Cyber security is

handled by our IT

department.

You’ll know right

away if your

computer is

infected or

compromised.

Only certain

industries are

vulnerable to

cyber attacks.

Small &

medium sized

organizations

aren’t targeted

by hackers.

1 2 3 4

Page 6: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

6

The Realities……

Source: Verizon Data Breach Investigations Report

Small businessesaccount for the majority of data

breaches

Approximately 60%

Around 30% of small and medium sized businesses

suffered a cyber attack in the past 12 months

Page 7: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

7

The Realities……

Source: Ponemon Institute 2018 Cost of Data Breach Study

Companies that

contained a breach in

less than 30 days

saved more than $1

million vs. those that

took more than 30

days to resolve

Mean

time to

identify a

breach

197 days

Mean

time to

contain

69 days

You’ll know right away if your computer is infected or

compromised.

Page 8: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Only certain industries are vulnerable to cyber attacks.

8

The Realities……

Page 9: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

9

Page 10: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Source: Ponemon and Keeper Security

study10

The Realities……Cyber security is handled

by our IT department.

Page 11: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Cyber Crime is Still #1 & Growing

72.1%

9.2%

14.2%

4.3%

2016

Cyber Crime Cyber Espionage

Hacktivism Cyber Warfare

77.4%

14.5%

4.7% 3.4%

2017

Motivation Behind Attacks

81.8%

12.9%

2.8% 2.5%

2018

Source: Hackmageddon, https://www.hackmageddon.com/2018-master-table

85.5%

9.4%

3.2% 1.9%

Q1 2019

Page 12: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

The Dark Web

What it is & what it isn’t

Page 13: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

What is the “Dark Web”?• Less than 10% of the internet is accessible through

typical search engines

• The Deep Web is a part of the web that contains

the most sensitive information

• The Dark Web is the part of the deep web that is

intentionally hidden

• Requiring an anonymizer to access (ex. Tor)

Uses .onion link; links often shift

Tor – The Onion Router

The Black Market of the Internet!

About 4%

of Internet

Source: CISO Platform

http://www.cisoplatform.com/profiles/ blogs/surface-web-

deep-web-and-dark-web-are-they-different

Approximately

90%

The remainder

Page 14: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

What Can I Find on the Dark Web?

Page 15: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Types of Sites on the Dark Web

Marketplace

Anything is for sale

• Drugs

• Stolen credit cards

• Personal identities

• Passports

• Driver’s licenses

• Health insurance

cards

• Other compromised

information

• Dates

Forums

Discussion forums that cover

information that could be

useful to a hacker

• Common vulnerabilities

• Information about

organizations

Paste Sites

Large data dumps that

are never removed

Social Media/Chat

Rooms

A place for hackers to

share information more

privately

Search Engines

Just like regular search

sites, but for the dark

web

Page 16: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Some Items for Sale

All images are

actual screenshots

from the dark web

Page 17: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Even Wire Transfers

All images are actual

screenshots from the

dark web

Page 18: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

How Much Could I Get for Your Credit Card On the Dark Web?

About $1

Page 19: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Carding Forum

All images are actual screenshots from the dark web

Joker’s Stash is the

most popular “carding”

forum on the dark web.

Credit cards just $1 each!

Page 20: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Carding Forum

Health insurance

card sold for just

over $62

Page 21: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Health Insurance Card for Sale

Page 22: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Hackers for Hire

Page 23: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

How Are You Targeted?

Things to look out for…

Page 24: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Attackers Try Easiest Way to Penetrate

• Phishing/spear phishing

• Social engineering

Job opportunities

Accounts on LinkedIn, Facebook

• Malware campaigns

• SQL injections on websites

• Public Wi-Fi

Page 25: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Phishing Schemes are Popular

25

Page 26: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Shadow IT• Shadow IT refers to IT devices, software & services outside the

ownership or control of IT organizations

• Departments will often do this to

Circumvent bottlenecks

Avoid slow processes

Rely on familiar software

Compatible with mobile devices

Work with legacy applications that are no longer supported

• It is easy to attain software as a service (SaaS) solutionsSource: Gartner IT Glossary, https://www.gartner.com/it-glossary/shadow

Page 27: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Risks of Shadow IT• Rutter Networking identified

Increased risk of data loss

Increased risk of data breach

Inefficiencies

Cybersecurity risks

• Since acquired outside of IT procurement channels, security is often overlooked

• Gartner predicts that by 2020, a third of all successful attacks will be against their shadow IT resources

Source: https://www.rutter-net.com/blog/4-security-risks-of-shadow-it

Page 28: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

What Would a Hacker Take?

Knowing how a hacker would

compromise your environment

Page 29: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Red Team Digital Attack Simulation• An attack simulation that mimics the real activities a hacker would take in your environment

• Still provides the network penetration testing results

• Collects data & information a hacker would want

• Ability to place notional malware & threats

Page 30: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Breach Life Cycle• Attacks are generally carried out in four stages

• These four stages are often referred to as the “breach life cycle”

• The further the progression, the greater the risks

Infiltration: breaking in & establishing foothold

Propagation: in the network & moving around

Aggregation: collecting data & critical information

Exfiltration: taking the information outside of the organization

Infiltration

Pro

pa

ga

tionAggregation

Exfiltra

tio

n

Page 31: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Breach Life Cycle in Action

1 2 3 4

MINIMAL

IMPACT

MAXIMUM

IMPACT

TIME FOR DETECTION & RESPONSE

1. Infiltration

2. Propagation3. Aggregation

4. Exfiltration

Page 32: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

How the Red Team WorksLeadership engages red team

Red team hackers break in (infiltrate)

Red team propagates & aggregates

Once detected, red team shows exfiltration data

Provides feedback to security team

Publishes the report

Page 33: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Red Team Benefits

• Simulated attack scenarios from real-world threats

• Demonstrates true offensive techniques to organizations

• Identify return on investment for cybersecurity solutions

• True ‘quantitative’ risk analysis

• Focuses on what’s valuable, data & assets

• Designed to improve a security team

• Still get the penetration test report plus more

Page 34: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

MitigationSteps

A few things you can do to

reduce risk…

Page 35: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Know Your Inventory

• What do you want to protect?

• Who do you want to protect it from?

• How likely is it that you will need to

protect it?

• How bad are the consequences if you

fail?

• Classification of inventory

Page 36: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Educate Your Team

• Technology is no substitute for employee

education

• Include the board, executives & vendors

• Knowledge is power

• Do not discourage false-positive

reporting

• Document & distribute security policies

• Develop & rehearse a robust incident

response program

Page 37: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Patch Your Systems

• Applications

• Databases

• Operating systems – servers,

workstations, etc.

• Anti-virus/anti-malware – engines &

signatures

• Third-party applications

Page 38: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Limit Access

• Control use of administrative privileges

• Limit access based on need-to-know

(least privilege)

• Limit & control remote access

• Do not share credentials

• Consider multifactor authentication

• Limit the use of portable media

• Don’t forget physical security

• Encryption is key, especially when data

leaves your organization

Page 39: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Human Factor is Still the

Weakest Link

• Remember physical security & limiting

access when the following arrive

UPS

Coming in from corporate IT

Service people or technicians

Exterminator

Flower delivery

Page 40: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Incident Response

40

Respond to an Attack

• Identify most likely attacks/threats

• Build steps to RESPOND, not REACT

• Include team leaders from all aspects of the

organization in scenario testing

• Everyone (not just IT) must be able to

respond

• The “business machine” must keep running

Page 41: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Cybersecurity Insurance

41

Are You Actually Covered?

• Do not fill the application out alone

• Management, IT management & legal council should

be involved

• Wrong, partial or inadequate answers can void the

policy

• Perform annual reviews of the policy

• Reviews should take place after major changes in

infrastructure

• Changes in available coverage amounts should be

part of the annual review

› Determine if strong cybersecurity controls are in place

Page 42: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Final Thoughts

42

Before or after the breach

The Cybersecurity bill will be paid

Page 43: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

The Next Generation• CyberPatriot is the National Youth Cyber Education

Program

• Created by the U.S. Air Force & sponsored by Northrop Grumman

• Inspires K-12 students towards careers in cybersecurity or other science, technology, engineering & mathematics (STEM)

• Preparing youth with skills critical to our future

https://www.uscyberpatriot.org/

http://www.northropgrumman.com/CorporateResponsibility/Pages/CyberPatriot.aspx

Page 44: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Questions?

Page 45: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

bkd.com | @BKDLLP @RexSecurity @BKDCyber

The information contained in these slides is presented by professionals for your information only and is not to

be considered as legal advice. Applying specific information to your situation requires careful consideration of

facts & circumstances. Consult your BKD advisor or legal counsel before acting on any matters covered.

Thank you!

Page 46: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

The information contained in these slides is presented by professionals for your information only and is not to be considered as legal advice. Applying specific information to your situation requires careful consideration of facts & circumstances. Consult your BKD advisor or legal counsel before acting on any matters covered.

BKD, LLP is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website: www.nasbaregistry.org.

Page 47: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Telecommunications Accounting

Seminar

Financial Benchmarking in a Fiber World

Marty Fredericks, CPA

Page 48: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Overview

Benchmarking

Methodology

Telergee Study

BKD ClientLink

48

Benchmarks to

Watch – Then and

Now

Thoughts Moving

Forward

4

5

Page 49: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarking Methodology

› “Benchmarking” defined

• “A measurement of the quality of an organization’s policies, products or

services, programs, strategies, etc., & their comparison with standard

measurements, or similar measurements of its peers”

49

Page 50: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarking Methodology

› Objectives of benchmarking by comparing your company to

others

• To determine what & where improvements are needed

• To analyze how other organizations achieve high performance levels

• To use information obtained to improve performance of your entity

50

Page 51: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarking Methodology

› Benchmarking in the telecommunications industry is ever

evolving

• Networks change

• Revenue sources & $ amounts change

• Lines of operations come & go

• Borrowing of funds happens

• Mergers & acquisitions take place

51

Page 52: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Telergee Study

› Telergee is an alliance of seven CPA firms throughout the U.S.

that specialize in audits of independent communications

companies

› Annual benchmarking study launched in 2001 as the “definitive

source of rural telecom performance data in the U.S.”

› Historically had roughly 200 entities participating in the study

52

Page 53: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Telergee Study

› Four classifications of ILECs presented

• Cooperatives on average schedule

• Cooperatives on cost

• Corporations on average schedule

• Corporations on cost

› With the 2018 study (2017 data) additional section added for entities

that elected to receive model-based support (A-CAM or Alaska Plan)

53

Page 54: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Telergee Study

› Benchmarks developed using the median as an average

• Median more accurately reflects the ratio values than using a straight

average by eliminating the influence that very high & very low, unusual

financial statement values, can have

› Individual scorecard provided to companies that completed the

Telergee Data Collector comparing themselves to other similar

entities

54

Page 55: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Telergee Study

› Pros of the study

• Pretty good database of companies from around the United States

• Data Collector allowed for a lot of information to be imputed & analyzed

• “The Telergee 20”

• Snapshot of 20 key metrics

• Various subsections that were provided

• VOIP, Video, CLEC, Wireless, etc.

55

Page 56: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Telergee Study

› Cons of the study

• BKD providing & inputting more than half of the data

• Almost “too much” information that made it difficult

• To release the study timely

• For managers/boards to analyze what benchmarks were really important to their

company’s success

• With the migration of more & more companies to A-CAM becoming

evident, increased focus was needed on this group of ILECs

56

Page 57: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

BKD ClientLink

› BKD’s benchmarking product

• In conjunction with iLumen software

• Free to clients

• Allows for various industries & the ability to compare one industry to another

• Simple report modifications with a lot of flexibility

• “Living and breathing” study & reports

• Very similar database to Telergee with less required manual input

• Uses medians (much like Telergee)

• Goal is to provide the most important benchmarks to our telecommunication clients without the confusion that comes with too much information

57

Page 58: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

BKD ClientLink

› Sections of telecommunications benchmark report

• Cover page

• Allowing for multiple benchmarks columns & filters

• Flash reports

• Financial statement percentages

• Ratio analysis

• Balance sheet breakdown & trends

• Revenue, expense & income statement trends

• Ratio analysis

58

Page 59: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

BKD ClientLink

59

Page 60: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

BKD ClientLink

60

Page 61: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

BKD ClientLink

61

Page 62: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

BKD ClientLink

62

Page 63: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

› The key to any benchmarking study is to determine what benchmarks are the most

important to highlight with the most relevance for the entire group within the study

• Some indicators will be relevant every year, while some go in & out of importance as the

landscape of the industry being analyzed changes

• More importantly, what was once a favorable benchmark in a certain industry can now be an

unfavorable one as the industry evolves & grows

63

Page 64: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

› Reviewing key benchmarks from past years (Telergee, 2008 and 2013)

and comparing them to current figures (ClientLink, 2018) can tell you a lot

about an industry & what your company needs to do today to “chin up” to

the rest of the industry

64

Page 65: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

Gross plant investment per access line

65

$5,595

$8,351

$13,219

$-

$2,000

$4,000

$6,000

$8,000

$10,000

$12,000

$14,000

2008 2013 2018

$/Line

$/Line

Page 66: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

› Gross plant investment per access line

• 58% increase from 2013 to 2018

• Some large plant investments have been made over the past five years

• Greater than investments from 2008 to 2013

• Many companies have upgraded copper to fiber facilities in the past five years

66

Page 67: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

Operating revenue per access line

67

$1,599

$2,198

$2,941

$-

$500

$1,000

$1,500

$2,000

$2,500

$3,000

$3,500

2008 2013 2018

$/Line

$/Line

Page 68: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

› Operating revenue per access line

• 34% increase from 2013 to 2018

• As access lines have declined, revenues have not

• Increased regulated revenues per access line due to conversions from cost to average schedule or switch to A-CAM

• A lot of diversification not dependent on access lines that have grown revenues

68

Page 69: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

Operating revenue per employee

69

$275,000 $314,000

$354,000

$-

$50,000

$100,000

$150,000

$200,000

$250,000

$300,000

$350,000

$400,000

2008 2013 2018

$/Employee

$/Employee

Page 70: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

› Operating revenue per employee

• 13% increase from 2013 to 2018

• Increase not nearly as high as the increase of operating revenues per access line over this period (34%)

• Diversification that has grown revenues has often come with the need

for additional staff as well

70

Page 71: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

Operating income/margins per access line

71

$181

$243

$339

$-

$50

$100

$150

$200

$250

$300

$350

$400

2008 2013 2018

$/Line

$/Line

Page 72: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

› Operating income/margins per access line

• 40% increase from 2013 to 2018

• Comparable to revenue increase per access line over this period

• 11% of revenues hitting operating margins in both years

• While diversification has helped grow revenues, which is great, the non-traditional operations are not as profitable

• Important to keep this in mind as companies venture off into more & more non-regulated activities

72

Page 73: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

EBITDA to operating revenue

73

40%

42% 42%

39%

40%

40%

41%

41%

42%

42%

43%

2008 2013 2018

%

%

Page 74: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

› EBITDA to operating revenues

• Unchanged in 5 years and very little change in 10 years

• Operating cash flow as percentage of revenues has remained very

consistent

• Operating revenue growth hasn’t increased EBITDA margin

• You would have hoped this percentage would have gone up some with the increase in revenues, but as alluded to with the previous indicator with diversification, the costs of operations have risen as well

• Still a pretty solid number when compared to other industries & stability can be a good thing

74

Page 75: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

Net income/margins per access line

75

$185

$287

$467

$-

$50

$100

$150

$200

$250

$300

$350

$400

$450

$500

2008 2013 2018

$/Line

$/Line

Page 76: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Benchmarks to Watch – Then and Now

› Net income/margins per access line

• 63% increase from 2013 to 2018

• Larger increase than operating revenues or operating

income/margins per access line during the same period

• Non-operating margins up almost 3x times as much in

2018 as compared to 2013

• Even with a decent amount of borrowing since 2013, interest expense hasn’t brought down non-operating income/margins

• Companies’ bottom line numbers a lot more dependent on investments & other non-operating items & less dependent on operations as compared to the past

76

Page 77: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Thoughts Moving Forward

› Benchmarking will continue to be important to the industry

• Know where your company stands against your peers every year

• Know the reason your numbers go up or down each year as your

company changes

• Make the operating adjustments necessary to improve the stability &

long-term viability of your company

77

Page 78: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

78

Continuing Professional Education (CPE) Credit

Page 79: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

79

Continuing Professional Education (CPE) Credit

Page 80: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

› Webinars, seminars & articles

› Many are CPE-eligible

› www.bkd.com/thoughtware

• Telecommunications

BKD Thoughtware®

80

Page 81: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Marty Fredericks, CPA

[email protected]

515.223.0159

81

Page 82: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

bkd.com | @bkdllp

The information contained in these slides is presented by professionals

for your information only and is not to be considered as legal advice.

Applying specific information to your situation requires careful

consideration of facts & circumstances. Consult your BKD advisor or

legal counsel before acting on any matters covered.

Thank You!

Page 83: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Telecommunications Accounting

Seminar

Market & Economic

Update/Investment

Considerations for Excess

Reserves

Nick Withrow, CFA, CFP®

Alex J. Hunter, CFP®

Page 84: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Our goals

for today

Provide a general market & economic update

Review investment

strategies &

considerations for

excess cash reserves

Review excess cash

reserve case studies

84

Page 85: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Economic Review

85

Page 86: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

After 10 Years of Expansion, the U.S. Economy

is Poised for Further Growth› U.S. economic growth is slowing from 2018’s pace, but is projected to

maintain at trend levels

› While the cumulative level of GDP growth has been underwhelmingduring this expansion, its length is record setting

› The U.S. consumer is confident & supports the economy

› Global manufacturing has slowed as uncertainty surrounding trade issueshas persisted

› The Federal Reserve has communicated its intent to lower interest ratesin response to weak inflation data & softness in the international economy

› Predictions concerning the timing of the next recession abound, but keyleading indicators suggest continued growth in the near term

86

Page 87: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Length & Strength of Expansions

87

Source: BEA, NBER, J.P. Morgan Asset Management. *Chart assumes current expansion started in July 2009 & continued through June 2019, lasting 120 months so far. Data for length of economic expansions &

recessions obtained from the National Bureau of Economic Research (NBER). These data can be found at www.nber.org/cycles/ & reflect information through June 2019. Past performance is not a reliable indicator of

current & future results. Guide to the Markets – U.S. Data are as of June 30, 2019.

Page 88: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Economic Growth & the Composition of GDP

88

Source: BEA, FactSet, J.P. Morgan Asset Management. Values may not sum to 100% due to rounding. Quarter-over-quarter percent changes are at an annualized rate. Average represents the annualized growth rate

for the full period. Expansion average refers to the period starting in the third quarter of 2009. Guide to the Markets – U.S. Data are as of June 30, 2019.

Page 89: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

U.S. Economic Heatmap

89

Source: BEA, BLS, Department of Labor, Census Bureau, St&ard & Poor’s, Institute for Supply Management, FactSet, J.P. Morgan Asset Management. S&P 500 EPS (earnings per share) & SPS (sales per share) are

expected earnings & sales per share growth over the next 12 months. Guide to the Markets – U.S. Data are as of June 30, 2019.

Page 90: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Unemployment & Wages

90

Source: BLS, FactSet, J.P. Morgan Asset Management. Guide to the Markets – U.S. Data are as of June 30, 2019.

Page 91: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Inflation

91

Source: BLS, FactSet, J.P. Morgan Asset Management. CPI used is CPI-U & values shown are % change vs. one year ago. Core CPI is defined as CPI excluding food & energy prices. The Personal Consumption

Expenditure (PCE) deflator employs an evolving chain-weighted basket of consumer expenditures instead of the fixed weight basket used in CPI calculations. Guide to the Markets – U.S. Data are as of June 30, 2019.

Page 92: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Global Trade

92

Source: FactSet, J.P. Morgan Asset Management; (Top left) CPB Netherl&s Bureau for Economic Policy Analysis; (Bottom left) IMF, USITC, World Bank; (Right) IMF.

Guide to the Markets – U.S. Data are as of June 30, 2019.

Page 93: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Manufacturing Momentum

93

Source: Markit, J.P. Morgan Asset Management. Heatmap colors are based on PMI relative to the 50 level, which indicates acceleration or deceleration of the sector, for the time period shown. Heat map is based on

quarterly averages, with the exception of the two most recent figures, which are single month readings. Data for Canada, Indonesia & Mexico are back-tested & filled in from December 2007 to November 2010 for

Canada & May 2011 for Indonesia & Mexico due to lack of existing PMI figures for these countries. DM & EM represent developed markets & emerging markets, respectively. Guide to the Markets – U.S. Data are as of

June 30, 2019.

Page 94: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

The Fed & Interest Rates

94

Source: Bloomberg, FactSet, Federal Reserve, J.P. Morgan Asset Management. Market expectations are the federal funds rates priced into the fed futures market as of the date of the June 2019 FOMC meeting & are

through December 2021. *Long-run projections are the rates of growth, unemployment & inflation to which a policymaker expects the economy to converge over the next five to six years in absence of further shocks &

under appropriate monetary policy. Guide to the Markets – U.S. Data are as of June 30, 2019.

Page 95: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Yield Curve

95

Source: FactSet, Federal Reserve, J.P. Morgan Asset Management. Guide to the Markets – U.S. Data are as of June 30, 2019.

Page 96: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

U.S. Yield Curve Inversion & Recessions

96

Source: FactSet, Federal Reserve, J.P. Morgan Asset Management. *From January 1962 to May 1976, short-term bond is U.S. 1-year note, & from June 1976 onwards the short-term bond is the 2-year note due to lack

of data availability. Time to recession is calculated as the time between the final sustained inversion of the yield curve prior to recession & the onset of recession.

Guide to the Markets – U.S. Data are as of March 31, 2019.

Page 97: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Capital Markets Update

97

Page 98: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

U.S. Stocks at New All-time Highs

› Since the Q4 2018 correction, the S&P 500 has recouped all losses & set new highs

› The recent increase in stock prices is primarily due to valuation increases, not earnings

› Valuations are near the 25 year average

› Earnings projections were revised down drastically over the past year, but are set to rebound in the coming quarters

98

Page 99: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Bond Returns Strong, Driven by Falling Interest Rates

› Since peaking in October 2018 around 3.2%, the 10-year treasury yield has dropped to approximately 2%

› The key reason for the drop in rates is the sharp pivot in Fed policy, in part due to slowing economic activity

› The Fed has hinted at decreasing the Fed Fund rate to help provide support for the economy

› Municipal bond returns have been driven by falling interest rates & a strong demand for tax-free income

99

Page 100: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Performance through June 30

100

Asset Class Index NameQ2

2019

YTD

(6/30)

One

Year

Three

Years

Five

Years

Ten

Years

Cumulative

Cycle

Returns*

US Stocks S&P 500 TR USD 4.30 18.54 10.42 14.19 10.71 14.70 434.20

US Stocks Russell 2000 TR USD 2.10 16.98 -3.31 12.30 7.06 13.45 414.17

Intl Stocks MSCI World NR USD 4.00 16.98 6.33 11.77 6.60 10.72 286.69

Intl Stocks MSCI EM NR USD 0.61 10.58 1.21 10.66 2.49 5.81 176.99

Taxable Bonds BBgBarc US Agg Bond TR USD 3.08 6.11 7.87 2.31 2.95 3.90 50.73

Tax-Free Bonds BBgBarc Municipal TR USD 2.14 5.09 6.71 2.55 3.64 4.72 62.85

Commodities Bloomberg Commodity TR USD -1.19 5.06 -6.75 -2.18 -9.15 -3.74 -20.88

Commodities LBMA Gold Price PM USD 8.77 10.16 12.68 2.18 1.39 4.19 50.53

*Cumulative cycle return date range: 3/9/09 – 6/30/2019.

Source: Morningstar Direct

Page 101: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Stock Market Since 1900

101

Source: FactSet, NBER, Robert Shiller, J.P. Morgan Asset Management. Data shown in log scale to best illustrate long-term index patterns. Past performance is not indicative of future returns. Chart is for illustrative

purposes only. Guide to the Markets – U.S. Data are as of June 30, 2019.

Page 102: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

S&P 500 Valuation Measures

102

Source: Compustat, FactSet, federal Reserve, Standard & Poor’s, J.P. Morgan Asset Management. Dividend yield is calculated as consensus estimates of dividends for the next 12 months, divided by most recent price,

as provided by Compustat. Forward price to earnings ratio is a bottom-up calculation based on the most recent S&P 500 Index price, divided by consensus estimates for earnings in the next 12 months (NTM), & is

provided by FactSet Market Aggregates. Returns are cumulative & based on S&P 500 Index price movement only, & do not include the reinvestment of dividends. Past performance is not indicative of future returns. Data

are as of June 30, 2019.

Page 103: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Corporate Profits

103

Source: Compustat, FactSet, Standard & Poor’s, J.P. Morgan Asset Management. EPS levels are based on operating earnings per share. Earnings estimates are St&ard & Poor’s consensus analyst expectations. Past

performance is not indicative of future returns. *Net earnings revisions are calculated as the number of upward revisions minus the number of downward revisions as a percentage of total revisions. Total revisions include

upward, downward & unchanged revisions. Guide to the Markets – U.S. Data are as of June 30, 2019.

Page 104: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Annual Returns & Intra-Year Declines

104

Source: FactSet, St&ard & Poor’s, J.P. Morgan Asset Management. Returns are based on price index only & do not include dividends. Intra-year drops refers to the largest market drops from a peak to a trough during

the year. For illustrative purposes only. Returns shown are calendar year returns from 1980 to 2018, over which time period the average annual return was 8.4%. Guide to the Markets – U.S. Data are as of June 30,

2019.

Page 105: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Gov. Control, Economy & Stock Market

105

Source: FactSet, Office of the President, J.P. Morgan Asset Management; (Top) St&ard & Poor’s; (Bottom) Bureau of Economic Analysis. Top chart shows S&P 500 price returns.

Guide to the Markets – U.S. Data are as of June 30, 2019.

Page 106: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Fixed Income Risk & Return

106

Source: Bloomberg, FactSet, ICE, J.P. Morgan Asset Management. Sectors shown above are represented by Bloomberg indices except for EMD – U.S. Aggregate; MBS: U.S. Aggregate Securitized - MBS; U.S. corps:

U.S. Corporates; Munis: Muni Bond 10-year; U.S. HY: Corporate High Yield; TIPS: Treasury Inflation-Protected Securities (TIPS); Floating Rate: U.S. Floating Rate; Convertibles: U.S. Convertibles Composite; EMD ($):

J.P. Morgan EMBIG Diversified Index; EMD (LCL): J.P. Morgan GBI EM Global Diversified Index; EM Corp: J.P. Morgan CEMBI Broad Diversified Index; Euro Corp.: Euro Aggregate Corporate Index; Euro HY: Pan-

European High Yield index. Convertibles yield is based on the U.S. portion of the Bloomberg Barclays Global Convertibles. Country yields are represented by the global aggregate for each country except where noted.

Yield & return information based on bellwethers for Treasury securities. Correlations are based on 15-years of monthly returns for all sectors. International fixed income sector correlations are in hedged U.S. dollar

returns except EMD local index. Yields for all indices are in hedged returns using three-month LIBOR rates between the U.S. & international LIBOR. Yields for each asset class are a 12-month average. Guide to the

Markets – U.S. Data are as of June 30, 2019.

Page 107: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Summary› In the short run, the U.S. economy appears set

for continued gains

› The Federal Reserve & European Central Bank have signaled their intent to ease financial conditions

› Global stock valuations appear appropriate, given the current level of interest rates

› Fixed income credit spreads offer additional yield, but little room for downside protection

107

Page 108: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Investment Considerations for Excess Reserves

108

Page 109: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Considerations for Investing Cash Reserves

› Liquid Cash

• Expected to earn more interest than a corporate bank account but still accessible in 1 - 3 days

• Some interest rate risk but duration typically less than 6 months

› Reserve Cash

• Cash generally not expected to be needed in next 12 months

• Will have modestly more interest rate risk with a duration around 1 year

109

Page 110: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Considerations for Investing Cash Reserves

› Intermediate Cash

• Cash generally not expected to be needed for 3 years

• Volatility & return potential higher than Liquid & Reserve Cash bucket

› Long-Term Cash

• Cash generally not expected to be needed for 5 – 7 years

• Higher than average volatility & potential for negative returns due to higher level of risk

• Given the time horizon, equities can be included in this category

110

Page 111: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Investment Policy Statement› What Is It?

• Agreement between Portfolio Managers & Investors

• List objectives, time frames, risk profiles, asset allocations & investments to be used

• Provide a systematic process for reviewing & rebalancing

› Why Have One?

• Provides structured ongoing guidance for investment decisions

• Document due diligence of investment decisions & maintain accountability

• Peace of mind for leadership

111

Page 112: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Cash Reserve Examples› Concessions Operator

• $1.5 million portfolio

• 70% bonds/cash, 30% stocks via mutual funds & ETFs

• Provide direct recommendations for implementation

• Semi-annual meetings to review performance & cash needs

› Physicians Group

• $16 million portfolio

• 100% cash & short-term debt via Separate Account Manager

• Invest cash with duration to meet specific needs

• Quarterly meetings to review performance & cash needs

112

Page 113: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

113

Continuing Professional Education (CPE) Credit

Page 114: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

114

Continuing Professional Education (CPE) Credit

Page 115: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

› Webinars, seminars & articles

› Many are CPE-eligible

› PDMs – Populate bullets with most relevant webinars, articles,

videos, etc.

BKD Thoughtware®

115

Page 116: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

Nick Withrow, CFA, CFP®

[email protected]

Alex J. Hunter, CFP®

[email protected]

116

Page 117: More Connected, More at Risk - BKD · 2019-08-12 · Increased risk of data loss Increased risk of data breach Inefficiencies Cybersecurity risks •Since acquired outside of IT procurement

bkd.com | @bkdllp

The information contained in these slides is presented by professionals

for your information only and is not to be considered as legal advice.

Applying specific information to your situation requires careful

consideration of facts & circumstances. Consult your BKD advisor or

legal counsel before acting on any matters covered.

Thank You!