A focused reading list to support ISA’s internal candidate discussions. Resource-to-candidate matches are research suggestions for ISA to evaluate, not findings of interest, eligibility or endorsement. Official links checked October 13, 2026.
2026 · fifth edition
2026 NACD–ISA Director’s Handbook on Cyber-Risk Oversight
Use the oversight principles and toolkit to ask what practical board guidance the candidate can help ISA develop.
Useful candidate discussions: Summer Craze Fowler, Christopher Porter and Richard Seiersen: metrics and board reporting. Chris Betz: AI governance. Pat Opet and Stephen Scharf: supplier risk.
Start with Tool K (printed pp. 66–68), Tool L (69–71), Tool J (63–65), Tool E (48–50) and Tool H (57–59). PDF viewer page numbers differ from printed pages.
Official NACD PDF · free public download
Open official resource2026 handbook toolkit
Tool K: Board-Level Cybersecurity Metrics
Test whether a candidate can connect technical evidence to financial exposure, operational decisions and measurable improvement.
Useful candidate discussions: Summer Craze Fowler, Christopher Porter and Richard Seiersen.
Pair this with Larry’s November webinar backgrounder. Ask for a concrete example of a useful board metric and the decision it changes.
Official NACD web resource
Open official resource2026 · portal labels briefing September 2, 2026
ISA’s Proposed AI Policy: research and congressional briefing
Review ISA’s five-sector work, then ask what new operational evidence or policy proposal the candidate can contribute.
Useful candidate discussions: Chris Betz: AI/cloud governance. Leo Simonovich: energy and industrial systems. Christopher Porter: threat and policy analysis. Microsoft referral: shared technology dependencies.
The sector documents below provide a more focused starting point. A research match is not evidence that a candidate attended, endorsed or contributed to ISA’s study.
ISA research portal and public recording
Open official resourcePublication date not shown · reviewed October 13, 2026
ISA statement supporting the Cyber PIVOTT Act
Assess whether a candidate can contribute to workforce development, training partnerships and public-sector capacity.
Useful candidate discussions: Mark Papay, Max Everett and Helen Patton: potential workforce and education discussions.
This is ISA’s advocacy position. Confirm legislative status separately before using it in outreach.
ISA policy statement
Open official resourcePublication date not shown · reviewed October 13, 2026
Why harmonizing cyber regulation won’t work — and what will
Ask how a candidate would demonstrate effectiveness, eliminate duplicative requirements or evaluate regulatory cost and benefit.
Useful candidate discussions: Kemba Walden, Max Everett and Christopher Porter: potential policy contributions; Richard Seiersen: measurement and economics.
Use as a discussion prompt about ISA’s policy approach, rather than proof of a candidate’s agreement.
ISA policy essay
Open official resourcePan-European second edition: 2024 · other editions have separate dates
International Cyber-Risk Handbooks
Assess the value of international experience and the ability to adapt director guidance across jurisdictions.
Useful candidate discussions: Leo Simonovich and candidates with multinational operating or regulatory experience.
Select the relevant country edition. Some downloads use SharePoint or an access form; this link opens the official directory.
ISA publication and download directory
Open official resource2023 publication · ISA overview reviewed October 13, 2026
Fixing American Cybersecurity: Creating a Strategic Public-Private Partnership
Understand ISA’s social-contract approach and sector policy work before asking a candidate to contribute a chapter, briefing or policy initiative.
Useful candidate discussions: Policy-oriented candidates across defense, energy, finance, healthcare, retail, telecommunications and IT.
The linked page describes the book and provides purchase information; the complete book is not hosted here.
Book overview and purchase link · not a free PDF
Open official resourceMarch 8, 2011 · historical policy foundation
Improving our Nation’s Cybersecurity through the Public-Private Partnership
Trace the roots of ISA’s work on incentives, risk management, information sharing and supply-chain cooperation.
Useful candidate discussions: Candidates offering public-private partnership, policy or supply-chain expertise.
Historical context only. The 2024 upload path is not the document date and does not make the recommendations current law.
ISA-hosted white paper PDF
Open official resource
Five sector briefings and analyses — 10 original research files
Published on ISA’s AI policy portal. September/October are the website upload paths, not an assertion of the original research dates. Original files open as PowerPoint or Word downloads; author affiliations are the portal’s attribution.
Defense industrial base
2026 ISA research · JR Williamson / Leidos
Defense and government-facing candidates: evaluate national-security dependencies and small-supplier needs.
Energy
2026 ISA research · Michael Woods / GE Vernova
Leo Simonovich: test contributions on industrial operations, continuity and AI security economics.
Financial services
2026 ISA research · Jon Brickey / Mastercard (retired, as labeled on ISA’s portal)
Pat Opet, Karl Schimmeck and Stephen Scharf: potential discussions on governance, fraud, resilience and shared dependencies.
Healthcare
2026 ISA research · Craig Martin / UnitedHealth Group (portal attribution)
Healthcare candidates and the scheduled Craig Martin discussion: identify operational and patient-safety expertise gaps.
Information technology
2026 ISA research · Kris Lovejoy / Kyndryl (portal attribution)
Chris Betz and the Microsoft referral: evaluate cloud, AI governance and cross-sector technology dependencies.
For Larry’s supplied AI announcement, convergence and gaps essays and November webinar backgrounder, open Larry’s Supplied Materials above.