Division BGSF, IT, Professional Division, Whitepaper July 30, 2020 Overview The shortage of experienced cyber security professionals is a key risk factor that impacts organizations of all sizes and all industries. It is estimated that by 2021, there will be a global need for between 3.5 and 4 million cyber security professionals (ISC^2). Currently, it is reported that in the United States, there are more than 500,000 open cyber security roles (cyberseek.org). The talent gap centers on the specialized technical skills that comprise the core functions of most corporate information security programs. The positions include, but are not limited to, security architecture, security engineering, product security, security operations, vulnerability management, and threat hunting. The ability of a Chief Information Security Officer (CISO) to attract and retain these technical security specialists is a core factor in determining the success of their cyber security program and their viability as an effective leader. The CISO is Ultimately Responsible The responsibility for the hiring and retention of cyber security talent lies with the Chief Information Security Officer (CISO). The CISO needs to develop an organizational culture where recruiting is important at all levels of their team. A CISO has the ability to both design program-wide standards as well as baselines for the assessment and evaluation of new talent that can be universally applied to all cyber security roles. These standards may be tangible or intangible. Tangible baselines may include technical ability, experiences, or education. Intangible standards may include communication skills, the ability to get along with others, or personality traits. In addition, the CISO and their leadership team can create certain interview protocols and processes that will ensure that anyone interviewing for a position within their organization is handled in a way that provides for a positive candidate experience. This can include things like candidate communication, response time, and sharing of feedback. The creation and implementation of standards sends an organizational signal that recruiting is important and that results will be measured. Ultimately, participation in the hiring process should be incorporated in performance reviews and be given strong consideration when determining promotions and incentive compensation. Job Descriptions and Resumes A large majority of cyber security positions go unfilled because of poor alignment between the posted job description and the way that the cyber security professional represents themselves on their resume. CISO’s and hiring managers need to remember that they are attempting to hire the best cyber security professionals for their positions and their teams, not the best resume writers. At the same time, a majority of cyber security job descriptions are extremely plain and come across as “laundry lists” of requirements and do not provide any true impetus for cyber security professionals to have any interest in applying for them. The CISO should encourage their team to think of job descriptions as their “Marketing Document.” Ideally the job description should enable the hiring manager to provide both context and insight on the benefits of the opportunity and the information security program. The hiring manager should attempt to understand the point of view of the applicant and the types of things that would be appealing to them as part of the role. These can include exposure to new technologies, the importance of security to the core business, the capabilities of the existing team, work-life balance, and career path. By incorporating these elements of the role into the actual job description, it will pique the interest of cyber security professionals who may find these things lacking in their current position. Once they demonstrate interest, you now have the opportunity to evaluate if they would be good matches. Work Closely with Your HR and Talent Acquisition Team The most successful cyber security recruitment processes rely on strong teamwork. The three elements of a winning team include an engaged hiring manager, a qualified pool of cyber security candidates, and a competent recruitment function. Considering that cyber security is such a unique skill set, it is essential that the CISO and the cyber security hiring managers take some time to help educate their internal team on the specific skills for which they are searching. In addition, it is also helpful to share specific companies that have people with these skills and cyber security professional organizations to which these people belong. Providing the internal recruitment team with this knowledge should enable them to better assess and screen talent, which ultimately will maximize the CISO’s and hiring team’s time and reduce frustration. If internal recruitment does not succeed, they are the ones that will best understand the company’s policies for the engagement of external recruitment firms. CISO’s should work with the internal recruitment team to refer them in the direction of Cyber Security recruitment specialists who are known for their success in the recruitment of cyber security talent. Generalist technology search firms more than likely do not have the industry reach, cyber security relationships, or the cyber security subject matter knowledge to be effective. Run An Interview Process As If You Were The Applicant If the job description is the marketing document, the interview process becomes your sales tool. This is your opportunity to demonstrate to your cyber security applicant what it is like to work as part of your cyber security function. It is important that the candidate walks away from the interview process with an accurate understanding of the office environment, the team culture, and the capabilities of the team that they will be joining. The CISO’s involvement in the interview process provides an indication of the importance of talent. It also provides a strong indication of the organization’s commitment to the cyber security function and visibility that all team members will have to senior leadership. In addition, the CISO and the hiring managers should clearly define the roles of the interviewers and what skills each person will be assessed during the process. It is best to put the candidate through some generic real-world scenarios that will determine how they solve problems and think on their feet. The chosen scenario should be a problem that the candidate is comfortable in solving. By placing a cyber security professional in this type of environment, in front of a small panel of team members, they will receive an accurate impression on how problems are solved and how the team interacts. This will give the panel the opportunity to see the candidate “in action” and should provide a sense of how they communicate and accept feedback. When the interview is concluded, it is essential that the candidate receive feedback quickly. Best practices would be within two days. Once the feedback is communicated, the candidate should either receive an offer or rejection within a short period of time. The longer decisions are delayed the less chance that the candidate will remain interested in the position, so this is imperative. Retention is the Best Form of Recruitment CISO’s can never take for granted that their team members will continue to work for them. Hiring is just one part of the equation; retaining your talent is the most important. High organizational turnover can make future recruiting difficult as cyber security professionals are skeptical by nature, and a revolving door of security talent can indicate that the work environment is not conducive to success. It is important for CISO’s to remember that their team members have choices, and their best team members have more choices. Once they are hired and are performing, they need to be continually “recruited” in order for them to be retained. Continuous recruitment begins with transparent communication about elements of work that are important to your team members. This can include providing career development, learning opportunities, and future financial growth. In addition, an increased sensitivity to work-life balance, flexibility, and quality of life are often more significant than increased compensation. If your team feels good about how they are treated, the work that they are doing, and what their future holds as part of the cyber security program, they will become the best recruiting tools that a CISO can possibly have. When they speak with their industry peers at cyber security conferences or on private message boards, they will be advocates. When new positions become available there should be a good supply of applicants, based on the brand that has been created. Conclusion The recruitment of cyber security professionals will remain a challenge as long as there is a significant delta between the supply of qualified talent and the demand for these resources. CISO’s and cyber security leaders need to invest the time, energy, and resources to create and implement good processes for the hiring and retention of cyber security talent. Successfully doing so will better position them to protect their organizations and excel in their careers

Division American Partners, Professional Division, Science and Technology June 12, 2020 Client Challenge: Move a Fortune 500 top 10 Multinational Retail Corporation to Enterprise Planning Cloud American Partners was tasked with guiding our client, who operates a chain of discount department stores and grocery stores, to migrate their environment to the Oracle Enterprise Cloud Platform. ACTIONS AND SOLUTIONS DELIVERED: American Partners identified two highly qualified consultants who quickly became integrated members of the client’s workforce solution. As of February 2020, the consultants are leading the client team, integrating their current Oracle EPM footprint, and providing day to day support. This migration forced the consultants to look at the application in a new view: Conversion to Hybrid mode Dimensional Optimization Process and Calculation Improvements for new functionality Applied Resources: automation, metadata, optimization, and training RESULTS: Automation – We have redesigned their automation standards for cloud based and on-premise automation to utilize a common framework, drive standard syntax and reporting. We have utilized this framework to develop new automation for: New SAP load to Cloud Application Centralized extract of EDMCS dimensionality Import or new Metadata to Cloud Application Import and refresh of metadata to many on-premises applications. Metadata – Prior to American Partners, the client started an EDMCS implementation. Unfortunately, the project was not tested, which resulted in the vision not being realized. The American Partners team revamped the implementation to ensure “best practices” and drove governance change within the organization. Starting with the package dimension we have modified the original implementation to do the following: Established a tiered workflow so that non-technical users can maintain changes to the rollup Applied proper security to not allow deletes or renames of member names Hierarchical integrity for shared rollups Dynamic property assignments for downstream applications Standardized extract process Optimization – American Partners is looking at methods to improve the current applications to address: Performance Maintenance Usability Training – American Partners consultants provide daily or weekly training on support techniques and best practices regarding new technology within the client’s platform.

Division June 9, 2020 Client Challenge: Donovan & Watkins (DonWat) was approached by a Houston commercial litigation firm to provide e-discovery document review services for one of their oil & gas clients. This project was to provide a team of attorneys to review and tag thousands of documents for a breach of a master construction agreement. The firm did not have the space or resources to support a project of this scale. Our client needed DonWat to identify qualified resources and provide work space with equipment within a very short time frame. Identified Resources: DonWat began the proven process of identifying experienced document review attorneys by utilizing their extensive database and relationships in the industry. The huge database retained is an enormous asset for projects such as this. DonWat was able to identify twelve attorneys as well as one lead attorney to manage the team and be the single point of contact to the firm’s partner in charge. Action and Solutions Delivered: Within one week, the needed consultant attorneys were placed at a secure work space with all of the technology and equipment needed to support the team. Since there is little room for error in document reviews, a team lead was added to perform quality control work, in order to cover all of the bases. This group of attorneys delivered on the scope of work within the time constraints as well as on budget. Supplies provided: 12 DonWat emails, 12 Surface Pros, 24 monitors, 12 docking stations, and 12 keyboards. All Surface Pros had Microsoft Office Suite installed. Results: The office space provided was conducive to comfortable and efficient work by providing state-of-the-art technology, office supplies, amenities, and security measures. The team established an organized document review process that made it easy for the client to oversee. The team lead administered the quality control needed, assigned workloads, and gave prompt feedback to the managing attorney of the project. After several weeks, the Houston firm requested more attorneys to help tackle the influx of documents being turned over by the opposition. Through the year, the team lead managed the ebb and flow of documents and the size of the team. The DonWat team had committed to the project until completion. The client won the case!

Division BG Creative, Professional Division May 8, 2020 Client Challenge: A global Fortune 500 firm prompted BG Creative to help put together their CEO’s number one initiative; establishing a global digital acceleration team. The firm’s objective includes to not only have a stronger presence in their eCommerce vertical, but engage and enrich their consumer’s journey from a 360 degree perspective. The expectation is for the firm to be elevated to a Fortune 100 within three years with this lofty initiative. Identified Resource: The initial request included finding a Senior Front-End Developer. We were tasked with this challenge after two firms and internal talent acquisition was unable to provide the right talent. Two weeks and one submittal later, an offer was extended – opening the door for a trusted partnership. The firm has continued to engage our expertise and our guidance in identifying the proper talent. Actions & Solutions Delivered: Key hires have included: Global Director of Digital Growth, Senior Director of Content, Senior Director of Digital Optimization, Senior Manager of Conversion Excellence, a team of Digital Product Managers and a content team, with requests for user experience and graphic design needs along the way. Results: BG Creative has played a vital role in the development of this team. Our consultants have given the firm full capabilities to tackle their initiative. The progress of their digital acceleration team has extended over to their sales team to be equipped with the proper resources to grow their business and drive traffic through their digital presence. It has allowed our client to succeed in conquering their aggressive initiative and raising the bar in their digital aspirations.

Division InStaff, Light Industrial Division March 30, 2020 Client Challenge: Specifically, this company needed Instaff to: Ensure their daily need of their daily workforce, up to 150 temporary workers, would be met Quickly and efficiently manage the transition of any existing temporary employees Improve overall management of their temporary workforce Actions & Solutions Delivered: Instaff called for a meeting at once between the operations departments of both companies to devise an implantation plan of the new staffing services along with a strategy on transitioning employees. Directly after these meetings, a directive was rolled out to have InStaff up and running for this client in less than two weeks. Results: InStaff was able to establish an effective temporary staffing solution for this client and had this plan operating within ten business days. With this solution in place, InStaff: Met the clients daily fluctuating staffing needs Reduced attendance and turnover issues without onsite program Provided continued, daily staffing services support from our local office Our client knows that with InStaff, not only are their needs in the Lake County area met daily, but as they grow, they can count on InStaff to be right by their side.

Division Extrinsic, Professional Division March 10, 2020 Client Challenge: Extrinsic’s client, a nonprofit organization in North Carolina, were informed that their Workday HRIS Manager was leaving for another opportunity. They reached out to Extrinsic to find a qualified consultant to cover the current vacancy until they identified a full-time resource. They needed a consultant who could quickly fill in for the former HRIS Manager, bridge the gap and allow the client to stay on track with their current projects. Identified Resource Extrinsic identified a specialized Workday HRIS Manager with over 14 years of HRIS experience and eight years of hands-on Workday experience. He has led over four Workday Implementations and is an expert in the Core HR modules, business processes, Security and Report Writing. With over five years of experience as an HRIS Manager, he has experience leading and managing full lifecycle implementations, system enhancements and rolling out new functionalities. Actions and Solutions Delivered Extrinsic’s HRIS consultant was brought on to support both the functional and technical aspects of Workday. He was able to manage a number of initiatives independently, freeing up time for the client’s internal team to continue to support a global project rather than expanding their focus to include providing coverage for the vacant HRIS Manager position. The client praised the consultant, noting that he was successful in fulfilling their needs, very responsive and a knowledgeable Workday resource.

Division BGSF, Extrinsic, Professional Division February 7, 2020 Client Challenge The Director of IT Applications for a respected Healthcare provider in North Carolina was in urgent need of upgrading their Kronos timekeeping system seeking additional functionality and needed to work under a tight budget relative to commercial counterparts. Identified Resource Extrinsic identified a specialized consultant with 15 years of KRONOS experience. This resource was actually a former Kronos employee and a certified 8.0 upgrade consultant by Kronos. He had extensive Workforce Connect/WIM programming experience on interfaces. Just as important as his technical skills, he was adept at working with customers to understand needs and business goals. Actions & Solutions Delivered The Extrinsic consultant had a project plan laid out, initiated scoping and documented his process along the way. He implemented additional functionality and lowered usage costs as the system was ported through telephones instead of time clocks. This resulted in cost savings to not have to buy time clocks by integrating this new version of Kronos into the phone system. This saved on equipment and more importantly training costs of staff. The project was completed 25% below budgeted costs.

Division Donovan & Watkins, Professional Division February 7, 2020 Business Scenario: Our client was a large publicly traded Oil Field Services company. They were in need of a review of their SOX policies and procedures. Phase 1) Our team consisted of three SOX auditors to test the client’s current SOX procedures. Upon determining the disconnect from policy and actual procedures. Phase 2) Based upon the above information we added a Compliance Specialist. This consultant worked directly with each person of the accounting department to ascertain their individual scope of work to determine the disconnect with the policies. Phase 3) Our Consultant documented all work and methodologies of each individual, thus determining each area of non- compliance. Clients Return on Investment: By Implementing a self-check SOX inquiring and finding and implementing corrections within the system our client was able to shield themselves from high-risk audit findings from external audits. In conclusion, our team of consultants was able to implement and update this company’s SOX policy and procedures to be utilized for years to come.

Division February 7, 2020 Client Challenge One of the largest privately-held insurance companies in North America found themselves under increasing regulatory pressure as they expanded business lines into several key states previously dominated by their competition. Senior members of the CIS group and Project Management Office identified a core weakness specifically in IT Risk Management and Process and Compliance Management mostly due to the differences in compliance regulations for privately held vs. publicly traded companies. What they lacked was a process improvement manager and an IT Risk and Compliance Manager who had experience in publicly traded regulatory compliance. American Partners was engaged at this point. Alternatives Considered Our client had no plan B. In their mind was no other alternative. The only way to avoid unnecessary audits and market pressure from their publicly traded competition was to hold themselves to the exact same standards. Identified Resource American Partners quickly tapped its vast network of IT Professionals and in a matter of weeks was able to make several introductions to the PMO and CIS executives to further assess the daunting challenge of bringing a privately help insurance company into line with the same IT Risk and Compliance regulations of a publicly-traded company in order to avoid undue audits as market share increased across the country. American Partners provided the expertise of one IT Risk and Compliance Manager and one IT Process Improvement Manager who had both taken 2 of the largest companies in America from privately held to publicly traded and back again, directly addressing the process with “boots on the ground” experience. Consultant Action & Solutions Our consultants were immediately put to work tackling IT Risk and Security initiatives and a Process Improvement overhaul that included the formation of a Vendor Risk team. Our Security consultant increased penetration testing and facilitated internal and third-party attestations, audits, and certification efforts for the IT organization. They also rolled out a corporate-wide security training initiative while coordinating audit testing, documentation, self-assessment testing, and remediation activities All of this allowed the client to gain market share at a more rapid pace avoiding costly audits and delays in state licensing.

Division Professional Division, Zycron February 7, 2020 Client Challenge: A software for services client had a need to staff up to 16 positions within a four to six-week window. These positions were required to have strong people skills as well as strong experience with Salesforce and would be in support of bringing new customers on to our client’s software product. Approach: Working with the client’s managers we identified in detail the skills that all candidates must have to be successful and proposed a focused effort from Zycron’s recruiting team to not only identify the potential candidate but provide the first round of in-person qualifying interviews. Zycron was willing to commit to this if the client would give us the work exclusively and they agreed. Action: Zycron’s recruiting team immediately starting identifying candidates and bringing them in for their in-person interviews. If qualified Zycron then sent calendar invites to our clients hiring managers to set up the final interviews at the client’s site. The windows of time available for these final interviews were set up in advance in order for these candidates to get through the process as quickly as possible. Result: All of the positions were filled within the timeframe that the client requested, and the client has been very happy with the quality of the resources that came out of this process.

Division Donovan & Watkins, Professional Division February 7, 2020 Business Scenario: Our client used QuickBooks for their accounting and reporting software systems and used Excel-based worksheets to forecast both operational and financial metrics. They realized they were duplicating efforts and had allowed themselves room for errors. Project Scope: Our team of Consultants worked directly with the client to develop a timeline for a two-phase solution. Phase 1) Identified the client’s requirements, both current and future, in forecasting and reporting requirements. Phase 2) Evaluated the ability of QuickBooks to facilitate the requirements and evaluate the current chart of accounts in QuickBooks. Phase 3) Developed an Excel tool that provided both historical and forecasted key metrics using input screens for certain business drivers and download tools to import from QuickBooks. Phase 4) Review the tool on an ongoing basis with the client. Clients Return on Investment: Prior to the project, our client did not have the ability to run different planning scenarios or generate combined actual and forecasted resulting in using the same tool. With the new tool and processes, they were able to stay with the QuickBooks, did not have the expense or challenges of going to a new system and were able to generate financial forecasts for investors and creditors on an ad hoc basis.

Division Donovan & Watkins, Professional Division February 7, 2020 Business scenario: Our client which was a large international oil & gas client. Our team of consultants assisted to establish an Accounts Payable Shared Services Group, upon the completion of a large acquisition. Project Scope: Our team of Consultants worked directly with the client o develop a timeline for transitioning all AP work to an AP Shared Services Group, consisting of (63) sixty of our consultants. These consultants were there to train current and new company employees. Phase 1) Developed a manual billing process for accounts payable that required our team to manually reconcile incoming invoices. Phase 2) Consultants worked over (300) three-hundred invoices per payable specialist per day to expedite outstanding AP payments. Phase 3) Our team streamlined the companies entire AP process within only 18 months ensuring the backlog of invoices decreased to a point of manageable timely payment. Clients Return on Investment: Our consultants were able to streamline the AP process and train current employees to acquire the day to day AP functions of the new Shared Services Division. Though the project was slated to last up to (36) thirty-six months, our project team was able to complete the entire process within (18) eighteen months. Thus saving the client hundreds of thousands of dollars in consulting fees, late payment fees, overtime wages, and disconnections