Where the numbers come from.

15 to 25 percent savings target for in-scope IT spend (Preside design target)

Our design target is to identify savings of 15 to 25 percent of in-scope technology spend (vendor, licensing, and managed-service spend) during the Initiative. Capturing them depends on renewal dates and can take up to twelve months. This is a target the work is built around. It is not a market benchmark, a guarantee, or a typical result. The figure for your company is sized from your contracts, utilization, and renewal calendar. The Cost Optimization and Vendor Rationalization Initiatives use this target.

No published benchmark states this range. The nearest published figure we found is BCG's statement that improving IT cost management "can reduce technology spending anywhere from 15% to 40%, depending on the situation" (BCG, Feb 2024, based on client experience; BCG sells cost consulting).

SaaS portfolio size (benchmark)

Zylo's 2026 SaaS Management Index reports 305 applications on average and 240 median across its sample. Productiv's 2025 statistics post states that the average SaaS portfolio decreased to 342 apps, down from 374 the previous year. The two figures differ because the sources use different samples and definitions. These figures describe portfolio size. They are not savings figures.

Sources: Zylo 2026 SaaS Management Index; Productiv, "The top 9 SaaS statistics that IT leaders need to know in 2025" (archived May 15, 2026).

About 30 percent of digital transformations meet target value (BCG, 2020)

Cited on the Change Readiness Initiative page. Boston Consulting Group's 2020 research reported that about 30 percent of digital transformations met or exceeded their target value and resulted in sustainable change. BCG sells transformation consulting.

Source: BCG: Flipping the Odds of Digital Transformation Success.

88 percent of AI POCs never reach production; 95 percent of GenAI pilots produce no measurable ROI (benchmark)

Two separate measurements. IDC and Lenovo report that 88 percent of AI proofs of concept never reach production. MIT NANDA's 2025 research found 95 percent of generative AI pilots in their sample produced no measurable ROI. Both are cited on the AI Technical Readiness Initiative page.

Sources: IDC + Lenovo AI research, MIT NANDA.

83 percent of organizations plan agentic AI; 29 percent feel ready (benchmark)

Cited on the AI Security and Compliance Initiative page. Cisco's 2026 State of AI Security report is the source. Preside's view is that the gap is in controls such as identity, scoped permissions, action logging, and a kill switch. The Cisco figures measure readiness, not which controls are missing.

Source: Cisco State of AI Security 2026.

Annualized Loss Expectancy (Hubbard & Seiersen)

ALE = Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). SLE is grounded in asset value and exposure factor. ARO is grounded in industry incident data and the organization's own history. The worked examples on /ale/ use point estimates for clarity. Where data permits, Preside expresses each input as a range. Doug Hubbard and Richard Seiersen's How to Measure Anything in Cybersecurity Risk describes calibrated estimates and range-based risk quantification, which Preside draws on in the Security Posture, Board Governance, and AI Security Initiatives.

Source: How to Measure Anything in Cybersecurity Risk (Wiley, 2nd edition).

NIST Cybersecurity Framework 2.0 (February 2024)

NIST CSF 2.0 is a voluntary framework widely used by US organizations. Organized around six functions: Govern, Identify, Protect, Detect, Respond, Recover. The 2.0 release added Govern as a top-level function, which puts governance and oversight at the center of the framework. Used as the structural backbone for the Security Posture Initiative.

Source: NIST Cybersecurity Framework.

NIST SP 800-131A Revision 2 (March 2019)

"Transitioning the Use of Cryptographic Algorithms and Key Lengths." Used as a reference for cryptographic algorithm and key-length transitions across Preside's briefings, compliance analyses, and any cryptographic control discussion.

Source: NIST SP 800-131A Revision 2.

NIST SP 800-53 Revision 5 (September 2020, updates through 2025)

"Security and Privacy Controls for Information Systems and Organizations." Used for FedRAMP-adjacent assessments and for the SC-13 (Cryptographic Protection) finding language in Preside's compliance briefings.

Source: NIST SP 800-53 Rev 5.

NIST SP 800-171 Revision 3 (May 2024)

"Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations." CMMC Level 2 requirements are based on NIST SP 800-171. The revision that CMMC assesses against can differ from the latest published revision, so a requirement number cited in a Preside brief names its revision.

Source: NIST SP 800-171 Rev 3.

SEC Item 106 of Regulation S-K and Item 1.05 of Form 8-K (Final rule 33-11216, 2023; disclosure phased in from December 2023)

Item 106 requires the annual 10-K to describe the board's oversight of cybersecurity risk and the management process for assessing and managing material risks. Item 1.05 requires disclosure of material cybersecurity incidents within four business days of the materiality determination. The clock starts at the materiality determination, not at incident detection. Cited on /for-board/, the Board Technology Governance Initiative, and every CISO page.

Source: SEC Final Rule 33-11216.

Delaware Caremark doctrine (Sorenson 2021, Bingle 2022)

Directors of Delaware corporations have a fiduciary duty of good-faith oversight of mission-critical risks. The Delaware Court of Chancery dismissed the SolarWinds derivative suit in Construction Industry Laborers Pension Fund v. Bingle (Sept. 6, 2022) and the Marriott derivative suit in Firemen's Retirement System of St. Louis v. Sorenson (Oct. 5, 2021). The linked analysis discusses how claims tied to misleading statements about cybersecurity may be treated differently. This is a summary, not legal advice. Cited on /for-board/ and the Board Technology Governance Initiative FAQ.

Source: Harvard Law CorpGov Forum analysis.

HIPAA Security Rule (45 CFR Part 164, with NPRM December 2024)

Cited on the Compliance Readiness Initiative and the healthcare briefings. The existing rule treats encryption as an addressable specification under 45 CFR § 164.312(a)(2)(iv) and § 164.312(e)(2)(ii). The HHS December 2024 NPRM proposed to move encryption from addressable to required for ePHI at rest and in transit, and to add a compliance-audit standard at least every 12 months. It is a proposed rule. Check the HHS link below for its current status.

Sources: 45 CFR § 164.312; HHS HIPAA Security Rule NPRM.

PCI DSS 4.0 (mandatory March 31, 2025)

Cited on the Compliance Readiness Initiative. As of March 31, 2025, the 51 future-dated requirements that were optional best practices in 4.0 are mandatory. Requirement 4.2.1 mandates strong cryptography for cardholder data transmission. Requirement 8.3 covers authentication. Requirement 12.3.3 requires a documented cipher inventory and remediation plan.

Source: PCI DSS v4.0 Document Library.

NYDFS 23 NYCRR Part 500 (Second Amendment, phased through November 2025)

Cited on /for-board/ for the CISO attestation language. The board or senior governing body must have sufficient cybersecurity understanding to exercise oversight, require management to maintain the program, and review the annual CISO program report.

Source: NYDFS cybersecurity guidance.

CMMC (Cybersecurity Maturity Model Certification)

Cited on the Compliance Readiness Initiative for defense-contractor briefings. CMMC Level 2 and Level 3 requirements map directly to NIST SP 800-171 and NIST SP 800-172. CMMC certification is a contract requirement for many DoD contractors.

Source: DoD CIO CMMC program.

FFIEC IT Examination Handbook (Architecture, Infrastructure, and Operations booklet)

Cited on /for-board/ for OCC, Fed, and FDIC-supervised institutions. The board approves IT strategy aligned to risk appetite, receives regular Architecture, Infrastructure, and Operations governance reports, and is educated to review performance.

Source: FFIEC IT Handbook.