It Would Be Better If…

Written by Brian Ray, CEO, MagnaPup, LLC

Introduction

“It would be better if…” is a powerful statement rooted in curiosity, and it can become an invaluable tool for both business leaders and individual contributors. Why? Because it often marks the beginning of positive change. Used well, it invites better questions, better processes, and better outcomes.

At business events and while mentoring newer leaders, people often ask how I became an effective leader. At Verizon and TracFone Wireless, my annual employee satisfaction scores, also known as eNPS, were among the strongest in my division, my team loyalty was exceptional, and my reputation across the organization was strong.

My answer is always the same: I encourage and support curiosity within my team and among the colleagues I work with across the business. Whether someone is in the C-suite or in an entry-level position, curiosity can uncover opportunities to improve processes and drive meaningful organizational change.

At a minimum, when curiosity is explored rather than dismissed, it leads to a better understanding of business processes, greater empathy for coworkers, and a stronger sense of shared purpose. To leaders everywhere, welcome the curious employee. Curiosity is a sign of engagement. When you build a culture that values it, change becomes less confrontational and more continuous, constructive, and broadly supported.

Why Curiosity Matters

The key is to pursue change without sounding performative or self-serving. I anchor any effort to improve an organization in a single question: How can we make better use of human, physical, and virtual resources, including AI, to achieve our goals more effectively?

Ideally, we do that without adding complexity or unnecessary stress to people’s work. While some friction is inevitable, good leaders take the time to mentor, offer perspective, and help others move through change with clarity and confidence.

The Trap of Ego-Driven Change

There is, however, a common trap. Some leaders assume that being a “change agent” means leaving their fingerprints on everything or showcasing how smart they are. That approach may produce visible change, but it often alienates employees and weakens culture in the process.

When the push for change is rooted in self-promotion, arrogance, or pride, the focus shifts away from the true goal: improving organizational performance and competitive standing in a way that also benefits employees and investors.

Five Questions to Start With

So, what’s my process? I encourage leaders to start with five basic questions for their employees and interdepartmental partners. These questions are designed to initiate collaboration, uncover performance obstacles, reveal opportunities, and turn curiosity into practical, people-centered improvement.

1. What frustrations do you have that you would like me to make go away?

   This is a foundational question for any servant leader and one I recommend prioritizing. Leaders remove obstacles or, at the very least, help their teams navigate difficult challenges.

2. What tools could you use to make your job easier?

   This could include software, training, technology, resources, or support that helps people do their work more effectively.

3. How would you make the process easier or faster while still delivering the necessary information and results to the organization?
4. What could you stop doing today that nobody would notice?
5. How can my department or I make your job easier?

When you begin building a curious culture, it is essential to follow these questions to their natural conclusion. Listen carefully, investigate thoroughly, and communicate clearly. Then make sure stakeholders understand the opportunity for change, the proposed solution, and the positive impact it can have across the organization.

You’ll know you’re on the right path in building your curious culture when your team starts asking you thoughtful questions. Embrace the feedback and investigate their upstream curiosity with enthusiasm.

Resistance

Eventually, even the best intentions will meet resistance. Some people prefer familiarity to change. Others are quick to point out problems but reluctant to propose solutions. At times, curiosity may expose people’s weaknesses, which is often when resistance becomes most emotional and disproportionate to the request.

When someone’s limitations or lack of collaboration are revealed through honest questions, especially at senior levels, it is important to be strategic and patient in how you move forward. Change management is not a race, and resistance is often rooted more in limited perspective than in limited ability.

Most leaders encounter resistance at every level of an organization. The key is to move past the emotion, strengthen a culture of curiosity, and stay pragmatic. You will hear comments such as, “You’ll never get them to change,” “That’s never been done before,” or “That’s how it’s always been.” I have heard them all.

Rather than treating those reactions as dead ends, treat them as signals that thoughtful leadership is needed most. Often, they mark the exact place where improvement can begin.

Conclusion

Whether you are a leader or an individual contributor, curiosity, humility, and pragmatism signal that you care about the success of both the business and the people within it. The simple phrase “it would be better if…” is more than a complaint or observation. Used well, it is the starting point for better questions, better decisions, and better outcomes.

If leaders create the conditions for curiosity to thrive, they will do more than improve processes. They will build teams that are more thoughtful, more resilient, and more capable of turning change into a lasting competitive advantage.

In the end, the organizations that improve most consistently are often led by people willing to ask — and seriously consider — one simple question: “It would be better if…”

Are you curious?

Healthcare applicants per opening hit 25 in January 2026, the highest in 13 months. And yet, finding qualified candidates is still the number one challenge facing talent acquisition teams across the industry. Not budget. Not technology. Qualified candidates.

More applications. Fewer real options. Both at the same time.

That's not a contradiction. It's a structural problem. Volume and quality are two different things. A full inbox tells you your job post is visible. It doesn't tell you the candidates are right for the role.

The Recruiter Math Doesn't Work

The average healthcare recruiter is managing 70 open roles at any given time. With that load, there is simply no capacity to give each applicant real attention. Recruiters can only get to a live conversation with about 10% of applicants. The other 90% hear nothing. No rejection, no update, no response.

It's not a motivation problem. It's a math problem.

And while inbound volume piles up, outbound sourcing stops entirely. The strong passive candidates, the ones who aren't actively job hunting but might be open to the right opportunity, never get reached. They don't find you, and your team doesn't have time to find them.

The teams doing this work aren't growing to meet the demand either. 76% of healthcare recruitment teams stayed the same size or shrank over the past year. Only 24% added headcount. The load keeps growing. The teams don't.

What It Actually Costs

Healthcare roles take an average of 41 to 49 days to fill, well above cross-industry benchmarks. Every open seat is a provider doing more with less, appointments running long, and front desk staff covering gaps they weren't hired to cover. Nearly 25% of frontline workers already say they don't have enough time for direct patient care. Vacancies make that worse.

Support staff turns over at 17 to 18% annually. If you have 20 MAs, front desk, and billing staff, you're likely replacing three or four of them this year alone. And healthcare offer acceptance rates sit at just 77%, the lowest of any tracked industry. That means even when you find the right person, run them through your process, and extend an offer, there's a real chance they don't take it. All that work, and you're back to square one.

On the provider side, losing one physician can cost $160,000 or more in lost revenue and replacement costs alone, before you factor in onboarding, training, or patient dissatisfaction. Support staff losses don't hit that same number individually, but they stack up fast and affect care quality long before they show up on a balance sheet.

The Role Nobody Talks About

Medical assistants don't get the same attention as the nursing shortage or the physician gap. They probably should.

47% of healthcare leaders say MAs are the hardest role to hire right now, ahead of nurses, ahead of billing staff. Nearly half of practices had to bring in alternative staff last year just to cover MA vacancies.

MAs sit at the center of the clinical day. They prep patients, assist providers, handle rooming, manage workflows. When that seat is empty, everything slows down.

The problem isn't a shortage of applications. Because MAs don't require the same licensure as nurses, the applicant pool looks large. But most of those applications don't hold up under review, and the recruiter doesn't have time to find out which ones do. So the seat stays open. Providers adjust. Appointments run long. The team absorbs the gap.

What Hiring Teams Can Do

You can't fix the whole system. But you can stop letting the broken funnel work against you.

Start with your job postings. Vague posts attract vague applicants. Be specific about certifications, EMR experience, and scheduling expectations. You'll get fewer applications, and that's the point.

Add a short pre-screen before anyone on your team spends time reviewing resumes. Even a three-question form cuts unqualified candidates significantly. Define your hard "no" criteria before the first application lands and build that filter in from the start.

Track where your best hires actually come from. Not every job board converts equally. If your last five strong hires came from one source, put more there. Stop spreading budget thin across channels that don't deliver.

And stop routing first-round screening through your hiring managers. Their time has real dollar value. The work of filtering 200 applications down to 10 worth a conversation shouldn't land on clinical or operational leaders.

None of this requires a new ATS or a budget increase. It just requires being intentional about how the funnel is built.

Written By: Stefan Van Der Heyden, President: HealthOp

What is Arizona’s minimum wage? As an initial reminder, Arizona's minimum wage increased to $15.15 per hour ($12.15 if taking the tip credit) on January 1, 2026. Tucson’s minimum wage is set slightly higher than the state minimum wage this year at $15.45 per hour ($12.45 for tipped employees). Flagstaff eliminated the tip credit in 2026, so all employees must be paid the significantly higher city minimum wage of $18.35 per hour.

How often must I pay my employees?

Arizona law requires that employers designate two or more paydays each month, with no more than 16 days between them (A.R.S. § 23-351). This supports a bi-monthly schedule while remaining compliant. Employers are free to pay more frequently—such as weekly or bi-weekly—if it suits their industry or operations. Exceptions exist for certain out-of-state employers with centralized payroll systems, but the standard rule applies to most Arizona businesses.

How soon must I pay a final paycheck when employment ends?

The timeline depends on who ends the employment relationship:

• If the employee quits (voluntarily resigns): The employer must pay all final wages no later than the next regular payday for the pay period in which the termination occurred (A.R.S. § 23-353).
• If the employee is discharged (fired, laid off, or involuntarily terminated): Final wages must be paid within seven working days after termination or by the end of the next regular pay period, whichever is sooner.

Final pay must include all earned wages (including overtime, bonuses, etc., where applicable).

What if the former employee owes the employer money or fails to return company property (e.g., uniform)?

Arizona allows employers to withhold amounts owed by the employee from the final paycheck if there is a legitimate debt, counterclaim, or set-off (such as unreturned property or advances). However, this must be handled carefully:

• You cannot withhold more than the employee’s indebtedness from the final paycheck (i.e., the full check).
• Instead, deduct only the amount of the legitimate debt and pay the employee the remaining balance.
• Make sure any deduction does not result in the employee being pay less than the current minimum wage.

This practice must comply with general deduction rules to avoid disputes.

Are there other lawful deductions from wages?

Yes—deductions are permitted in these cases:

• When required or allowed by state or federal law (e.g., taxes, court-ordered garnishments).
• When the employee provides prior written authorization.

Unauthorized deductions are prohibited, including for cash shortages, breakage, or damage to company property without the employee's written consent. Importantly, no deductions may reduce an employee's pay below the current minimum wage. Employers must also ensure compliance with any restrictions on deductions for uniforms, tools, or other items required for work.

May I require my employees to use direct deposit?

No, you cannot require direct deposit without employee consent. Employers may pay via direct deposit only with the employee's prior written consent. If wages are paid this way, provide the employee with a written or electronic statement of earnings and withholdings.

If an employee refuses consent, no adverse action (e.g., discipline or termination) can be taken based on that refusal. However, if direct deposit is declined, the employer is not obligated to issue a paper check. Instead, Arizona law allows payment via a payroll card account (A.R.S. § 23-351), provided:

• The plan entitles the employee to at least one free withdrawal per pay period (and not more frequently than once per week).
• The employer provides a list of all associated fees.
• The employee receives a written or electronic earnings statement.

While these payment requirements seem basic, non-compliance is more frequent than one would expect. Employers must confirm compliance to avoid potential liability when receiving a notice from the ICA. Consult with a competent legal professional with any questions. Stay compliant!

Jodi R. Bohr is a shareholder with Milligan Lawless, P.C., and a contributor to Arizona Employment Law Letter. She practices employment and labor law, with an emphasis on counseling employers on HR matters, litigation, and workplace investigations. She may be reached at jodi@milliganlawless.com or 602-792-3549.

Understanding the Economic Landscape

Interest rates remain complex. As one example, while recent Fed cuts were expected to provide relief, mortgage rates paradoxically rose because investors had already priced in the anticipated changes. The lesson? Economic forces don’t always move predictably. However, the long-term outlook suggests easing pressure, with lower borrowing costs on the horizon creating opportunities for strategic investments.

Phoenix’s commercial real estate tells a mixed story. Retail remains strong, absorbing nearly 2 million square feet last year, and office space shows modest improvement. However, industrial vacancies remain elevated at nearly 13.5 million square feet, despite strong absorption, reflecting job losses in manufacturing and logistics.

On the positive side, Arizona’s labor market continues to expand. Statewide unemployment in late 2025 hovered around 4%, similar to Phoenix. Wage growth statewide was 4.0% as of mid-2025, with Phoenix leading the state at 4.9% year-over-year. Phoenix average weekly earnings of $1,285 exceed the national median by $90.

4 Strategic Steps for 2026

In light of these trends, some business owners might feel stuck or unsure what move to make next. Rather than sitting out the uncertainty, focus on these actionable areas:

1. Stress-Test Your Cash Flow: Review your cash flow projections under different scenarios. What if interest rates drop faster than expected? What if they remain elevated? Savvy businesses build contingency plans that account for variability in borrowing costs, customer payment cycles and supplier pricing. Your banker can help model these scenarios and identify vulnerabilities before they become problems.
   
   
2. Optimize Your Working Capital. Many businesses have capital trapped in inefficient processes. You can identify these potholes by conducting a thorough review of your accounts receivable, inventory management and payment terms. Even small improvements, such as accelerating collections by a few days or renegotiating supplier terms, can free up significant cash for strategic investments. To keep the momentum going, a strong business bank can deliver cash management solutions that uncover and solve hidden efficiencies.
   
   
3. Build Your Advisory Cabinet: The most successful businesses don’t navigate uncertainty alone. One smart way to solidify the best course of action for your organization: Assemble a trusted team of advisors, including your CPA, attorney, insurance broker and commercial banker. Then, meet regularly with this “cabinet” to help you synthesize conflicting data, anticipate risks and identify opportunities. An experienced commercial banker can provide visibility across industries and economic cycles that can inform better decision-making.
   
   
4. Position for Opportunity: While caution is warranted, this environment also creates new prospects. Businesses with strong balance sheets and flexible capital access can capitalize on opportunities when competitors are limited. Work with your banker now to establish credit facilities before you need them, ensuring you’re ready to act when the right opportunity emerges — whether that’s equipment purchases, strategic acquisitions or expansion into new markets.

The Value of the Right Banking Partner

Economic uncertainty is a constant, not an exception. The difference between businesses that thrive and those that struggle often comes down to preparation and partnerships. An experienced, business-focused bank like Western Alliance brings far more than just financing. As the largest bank headquartered in Arizona, we bring market intelligence and strategic perspective across economic cycles — in addition to solutions tailored to your specific needs. That’s especially true as we build long-standing, trusted relationships with clients, many of whom choose to work with us for years or decades.

As you may have heard, Alliance Bank of Arizona recently took on the Western Alliance Bank brand. Rest assured, our branding is the only thing that has changed. We’ve been part of well-resourced, top-performing Western Alliance for many years. Under our shared brand, you can expect the same client-first approach, the same great bankers and the same outstanding, personalized service, with a more streamlined customer experience.

###

Jeff Schelter is managing director of Commercial Banking for Western Alliance Bank, leading Commercial Banking teams throughout Arizona. He serves as the past president and vice president of education of the Arizona Business Leadership Association. He also serves on the Board of the Greater Phoenix Chamber and on the Loan Committee of CDC Small Business Finance. Contact him at jschelter@westernalliancebank.com.

Data then is becoming an invaluable commodity. If you want to build an AI app for a particular domain, you need the right data for this domain to train your models. This can be done using public data, purchased private data, or using your own compiled data from your own systems. Companies with great data over a domain are becoming valued more for their data. For example, a used car auction company with decades of records on the condition and sales of used cars could sell their data to an AI application maker who wants to build an application to help auto dealers properly price their used cars.

When you take this scale to the size of public companies you can see this trend at large in the world of Private Equity and Mergers and Acquisitions. Let’s say you are one of the biggest traders of coffee in the world. You want to find out where to source the best coffee and set the best price for your coffee. Maybe a company like FedEx has years and years of data about coffee that has been delivered. What was the declared value, what was the weight, and where was the country or origin of those coffee beans? This data could be sold for millions of dollars to the right large-scale player. Some companies are even being bought outright for their data.

This can also be true for small businesses. What data does your company keep? Who would it be valuable to? Maybe you are a medical billing company. The data on how people pay their medical bills could be valuable to lots of other companies in the medical system. Or maybe you could build your own AI model which would help medical offices predict the speed at which that can expect to be paid. Or perhaps you are an auto repair shop with decades of data on working on a particular brand of car. Wouldn’t this data be potentially useful to the car makers or maybe auto warranty companies?

As organizations begin to recognize the critical role data plays, they are investing more in data collection, storage, and analysis. The ability to harness and interpret large volumes of data not only provides a competitive edge but also unlocks new opportunities for innovation and growth. Companies that prioritize data-driven strategies are better positioned to anticipate market trends, optimize operations, and deliver personalized experiences to their customers.

The value of data goes far beyond just immediate business operations; it can be leveraged for strategic partnerships, predictive analytics, and even new revenue streams. For instance, historical repair records could help manufacturers improve product design or anticipate common issues, while insurance providers might use this information to better assess risk and set premiums. Furthermore, data can enable small businesses to compete more effectively by identifying trends, optimizing inventory, and delivering personalized services to customers. When managed and analyzed properly, your company’s unique datasets could become a key differentiator in the marketplace, offering opportunities for innovation and growth that were previously unimaginable.

I invite you to look at your business from a data perspective. What data do you have? Who would it be most valuable to? What insight could you get from your own data? What services could you build on top of it?

Even the most secure role can change unexpectedly due to a reorganization, merger, or shift in strategic direction. The best leaders aren’t just focused on where they are, they are quietly preparing for what’s next.

Here are a few practical ways you can stay opportunity-ready:

1. Stay Visible Beyond Your Role

Don’t rely solely on your internal reputation. Industry visibility matters. Join professional organizations, speak at conferences, contribute to panels, publish thought leadership, or mentor in professional associations. These activities reinforce your value to the broader market and keep your name top of mind when new opportunities arise.

2. Nurture Relationships Like Strategic Assets

Strong networks aren’t built overnight; they are cultivated over time. Think of your professional relationships like a garden: they need consistent care, not just attention when you are hungry for fruit. Schedule regular check-ins with former colleagues, industry peers, and mentors. Send a note of congratulations on a promotion. Share an article that might interest them. These small, genuine touches build equity. Join a non-profit board or get involved in a professional organization.  These longer-term commitments can help you build some deep relationships with others in the Arizona market.

3. Keep Your Career Story Sharp

Executives often spend years focused on business growth but neglect their personal brand. Take time to reflect: What are your greatest leadership achievements? What problems are you best at solving? Is your LinkedIn profile up to date? Can you clearly describe your value in one minute or less? If not, you are not ready and that is fixable.

4. Watch the Market Without Chasing It

Staying curious about what is happening in your industry, your competitors, and the leadership moves in other companies is a sign of strategic awareness. You do not have to pursue roles, but having a sense of the market keeps you informed and more confident when opportunity knocks.

Relationships matter more than résumés when building chances for new potential. And one of the most overlooked relationships is with executive search professionals. Even if you are not looking, a brief conversation can help clarify your value in the market and keep you on the radar for future roles that align with your strengths and aspirations.

The best time to prepare for your next role is long before you need it. By staying visible, keeping your network strong, sharpening your narrative, and building relationships with C-level executive search practices, you position yourself to move with purpose when change comes.

Headfarmer is a Scottsdale-based executive search and recruiting firm that provides a consultative approach to your c-suite search.  Additionally, the firm provides Finance and Accounting, Technology, and Human Resource search services to companies in Arizona.  To connect or for more information, reach out to Rachel Lutowsky at rachel.lutowsky@headfarmer.com or call 480.744.7376.

Having spent over 30 years of my career in Private Banking and working with wealthy individuals and their families, I have seen many women in these households be extremely out of the loop of their family’s finances as a family. This resonates with me as a result of my adolescent experiences. It has led to my belief that women should take an active role in finances that impact their lives and should take control of their own situations. This empowers women to make better choices, have independence, and be meaningful role models for the younger generation - which impacts the broader community. Financial literacy, especially for women, has become my passion as a result of my experiences. 

To feed my passion, a few years ago I began to seek out a local nonprofit that worked with underprivileged women. I found Live and Learn, a 501c3 nonprofit in Phoenix, AZ and liked their program because it required accountability. Their clients have to take several financial education classes throughout the year and keep budgets. We agreed that I could offer a series of financial webinars including “Creating a Healthy Relationship with Money”, “Budgeting 101”, and a “Car Buying Workshop”. For the last 2 years, I’ve had the monthly privilege of working with and educating hundreds of women on these subjects. I have found it so rewarding!

Financial stress, as a result of not understanding, is one of the leading causes of anxiety. Helping women gain confidence and peace of mind in their financial knowledge is my goal. I hope to normalize wealth-building for women through basic financial skills that can be applied to real-life choices and situations. I also want to make financial education accessible, relatable, and non-intimidating by creating an open environment for discussion and questions.

Some key takeaways I typically share with these clients:

• No matter how much money people have, they can still have financial stress (it’s all about knowing your income/expenses and staying within those boundaries).
• Work to reduce debt as much as possible, even if it means living frugally.
• Plan for the future – save, invest as much as you can.
• Try to cut overspending on things like subscriptions, coffee, online shopping, etc.
• 33% of Americans spend more on coffee than they do on savings!

Background:

Kathy Wills brings over three decades of sales, marketing, management, and financial advisory experience to the banking industry. Kathy is a producing manager with her own portfolio of Private Banking clients serving in business development and also as an advisor to high net worth clients structuring complex credits and asset management strategies, and is a member of the bank’s Wealth Management Board. Kathy has been with MidFirst Bank for over 17 years and was previously with Compass Bank and Bank One (now JP Morgan) for the 15 years prior in Commercial Real Estate and Private Banking. She holds a Bachelor of Arts degree from the University of Arizona and an MBA from the University of Phoenix. She is actively involved - serving on various non-profit boards and volunteering in her community. She has been a member of AZ Business Leadership for over 20 years and is a past President.

Written By:Kathy Wills, AZ Managing Director – Private Banking, MidFirst Bank

Key Stats, Challenges, and Solutions for the Year Ahead

In 2025, Arizona’s healthcare system is facing some big problems. There aren’t enough doctors, nurses, or other health workers to help everyone who needs care. This makes it harder for people to see a doctor, especially in small towns and rural areas.

In some places, there aren’t any doctors at all. For example, there are areas where over 5,000 people share just one doctor—or none at all. Nurses, dentists, and mental health professionals are also in short supply.

Non-compliance with Arizona’s Sick Leave Law.

Arizona’s Fair Wages and Healthy Families Act (the “Act”), which went into effect in 2017, requires employers to provide paid sick leave to employees. Under this law, all Arizona employers must offer paid sick leave to their Arizona employees. Despite the law being in place for several years, many handbooks still fail to clearly outline a policy that complies with the Act.

• Common Mistake: Employers either neglect to mention paid sick leave entirely or include language that doesn’t align with the Act. This oversight can lead to confusion among employees and potential legal penalties for non-compliance.
• Solution: Arizona employers need to ensure that their handbooks include a dedicated section for paid sick leave that aligns with the Act. Employers should review their policy to make sure it specifies how leave is accrued, under what circumstances and when sick leave may be used; and how employees should inform employers of their need for leave. Also, confirm that the oft omitted (yet required) anti-retaliation provision is included in the policy.

Vague Anti-Harassment and Anti-Discrimination Policies.

Workplace harassment and discrimination are serious issues, and employers must have clear policies in place to address and prevent them. However, many handbooks fail to provide sufficient detail on what constitutes harassment or discrimination and how complaints will be handled.

• Common Mistake: Employers often use vague language, such as stating that harassment or discrimination will not be tolerated without explaining what specific behaviors or actions fall under those categories. Many policies focus only on sexual harassment and ignore that harassment and discrimination come in many other forms (e.g., race and disability). Additionally, handbooks may lack clear reporting procedures or fail to assure employees that their complaints will be taken seriously and properly handled.
• Solution: Handbooks should include a comprehensive anti-harassment and anti-discrimination policy that defines key terms and provides examples of unacceptable behavior. The policy should also detail how employees can report incidents, specify who within the organization will handle complaints, and outline the investigation process. Employers should reinforce that retaliation for reporting is prohibited and ensure that all employees understand their rights and responsibilities. Employers should also clarify how to request a disability accommodation and explain the interactive process.

Ignoring Arizona's Marijuana Laws.

Arizona legalized medical marijuana in 2010 and recreational marijuana in 2020. These statutes create unique challenges for employers, particularly when it comes to drug testing and workplace safety policies.

• Common Mistake: Employers often fail to acknowledge the protections created by the Arizona Medical Marijuana Act, take an overly rigid stance that can be deemed discriminatory, or outright fail to maintain a drug testing policy when implementing testing in the workplace. For example, some handbooks include zero-tolerance drug policies that do not acknowledge that employees who are medical marijuana cardholders are entitled to certain protections regarding marijuana use outside of work hours.
• Solution: Employers should create clear and balanced drug and alcohol policies and outline the circumstances in which testing will be required. While businesses can still prohibit impairment and the use of marijuana at work, the policy should acknowledge that medical marijuana cardholders will not be discriminated against for use outside of work. Employers should also consider providing guidelines about what constitutes impairment on the job and requirements for documenting impairment prior to sending someone for testing.

Takeaway.

Space limitations resulted in other common mistakes such as overly restrictive social media policies, and ignoring other key federal, state and local requirements from not being included.

While creating and maintaining a compliant employee handbook in Arizona is no easy feat, even small employers should implement a comprehensive handbook to avoid legal headaches and help foster a positive work environment. A well-crafted handbook can serve as a valuable tool for fostering a positive work environment, promoting clear communication, and protecting the interests of both the organization and its employees.

Jodi R. Bohr is a shareholder with Tiffany & Bosco, P.A., and a contributor to Arizona Employment Law Letter. She practices employment and labor law, with an emphasis on counseling employers on HR matters, litigation, and workplace investigations. She may be reached at jrb@tblaw.com or 602-255-6082.

By Mark Kirstein, GMI Advisory Services

The convergence of successful adversary attacks on United States Critical Infrastructure with the current transition of power in the White House will prove to mark a significant milestone in U.S. policy and regulations, affecting cybersecurity in the U.S. and our federal government’s response to the escalating threat.

The timing of the Solar Winds, Microsoft, Colonial Pipeline and JBS compromises highlights the significant vulnerabilities that exist in our cyber infrastructure and the implications of protecting this critical infrastructure and our productive assets in this country. These hacks have simply elevated public visibility into a phenomenon that cybersecurity professionals have witnessed and warned about for years, with the U.S. already ranked No. 1 as the most attacked nation.

The motivation remains high for criminals and nation states to continue this trend, driven by $1.5 trillion in profits annually and diverse national security interests. More so, high profile media reporting on the visible proof of the fragility underlying some of our fundamental technology infrastructure has instilled fear in American organizations and the public, providing an unprecedented catalyst for visible government action in the cyber domain!

The administration’s action is most recently evidenced by President Biden’s “Improving the Nation’s Cybersecurity” Executive Order (EO) 14028 on May 12th, followed shortly by EO 14034 on June 9th, “Protecting Americans’ Sensitive Data from Foreign Adversaries”. Early takeaways from both of these suggest a prescriptive approach rather than providing a framework for adoption (similar to NIST). They are accompanied by very aggressive timelines for moving to specifics through designated tasks. Their noteworthy focus is on those doing business with federal agencies and entities; the National Security Agency (NSA) stakeholder agencies are directly involved in proposed standards development, and these EOs could be expanded into law to cover other entities in the future. Given that EO 14028 itself consisted of 88,000 words and was released a week after the Colonial Pipeline compromise, it’s reasonable to conclude that these were previously planned actions with the wording already on the shelf awaiting action. The visible compromises simply provided the call to action.

While extensive, these executive orders only provide a glimpse of the tip of the spear in the administration’s comprehensive response to the very real escalating cyber threat. The more comprehensive overall strategy and execution plan is set forth in the “2020 Cyber Space Commission’s Solarium Report”, which has noble intentions. This report urges for the U.S. government and private sector to adopt a “new, strategic approach to Cybersecurity,” namely layered cyber deterrence. Additionally, the report urges Congress to “pass a law establishing that final goods assemblers of software, hardware and firmware are liable for damages from incidents that exploit known and unpatched vulnerabilities”. Predictably, components of EO 14028 that focused directly on software developers, along with the respective Solarium recommendations, have already received strong resistance from the software industry.

Presently approved funding strongly supports these recommendations, with the $740 billion 2021 National Defense Authorization Act alone adopting two dozen of the Solarium Commissions recommendations. Additional funding focused on Cybersecurity includes the 3/11/21 American Rescue ACT (passed for COVID Relief), included $650 funding for CISA cybersecurity risk mitigation, an additional $200 million for the Executive Branch Technology Team and $1.4 billion for other technology focused programs in 2021. Note that the Solarium Commission’s mandate has been extended for another year, with the focus now turning toward advocacy and more squarely focused on the private sector.

In parallel, the administration has appointed its new cyber team and reaffirmed others that will remain in place in both the executive branch and U.S. DHS’ Cybersecurity Infrastructure and Security Agency (CISA) to support execution.

The common denominator between appointments is that they all have NSA roots having worked extensively together, and were either appointed to the Solarium Commission and/or strongly support its recommendations. Of these appointments, none is more formidable than Chris Inglis’s appointment as the first White House National Director of Cyber Security. Previously serving for 28 years in the NSA, his last NSA position was eight years as the agency’s deputy director. Inglis’s primary duties include: 1) coordination of the defense of civilian agencies, and 2) reviewing agencies cyber budgets—providing the teeth! This effort is supported by a newly created staff of 75, with emphasis on driving a cohesive and comprehensive strategy across all federal agencies focused on information exchange and response.

The other notable priorities that we see emerging include the significant expansion of CISA resources and authority, increased consumer data breach transparency coupled with more stringent reporting requirements, and a big focus on standards that are likely to be adopted as fundamental risk management requirements for accessing the cyber insurance market in the future.

Let’s focus for the moment on sharing threat information as one major priority.

While the present EOs mainly focus on the federal government leading by example, improving federal information system as a foundation, the emphasis stated in the EO is clearly on expanding private-public partnerships through a coalition of the willing. The initial thrust having all federal information systems meet or exceed the standards and requirements for cybersecurity set forth in the sweeping executive orders as a foundation at the policy level.

Removing barriers to sharing threat information serves as an essential and high priority in this regard, driven by the purchasing power of the Federal Acquisition Regulation (FAR) and the Federal Defense Acquisition Regulation. The execution strategy in this regard will be central to its success, and the initial reports will begin to define the specifics for public comment within the 60 days from the EO’s filing.

It’s clear that whatever is put in place for the federal government is intended to be a model for expansion to the public and private sectors. This is probably most clear with suggested standards for commercial software development, since software companies are unlikely to develop one solution for federal information systems and another for everyone else. Uniformity leads to higher productivity and more competitive pricing if one size fits all. Likewise, contractual language developed for federal information sharing with the private sector will more broadly, likely over time, become the norm for information sharing. 

Given the fundamentally flawed cyber infrastructure security, the existing defense in-depth capability and the present realities of artificial Intelligence and machine learning, a radical uplift is not just warranted—it is essential. And this uplift will be completely reliant on information exchange and transparency to complement available defenses. Washington is correct in stating that collaboration with the private sector is key, because without trust there is no information sharing. The inherent danger of this critical experiment therefore lies in the emergence of a top-down approach, or that information exchange, as in the past, will become somewhat unidirectional under the guise of national security.

As Henry Kissinger once said, “I believe in the tragic element of history. I believe there is the tragedy of a man who works very hard and never gets what he wants. And then I believe there is the even more bitter tragedy of a man who finally gets what he wants and finds out that he doesn’t want it.” Learning from the lessons of history can avert tragedy in this case if we look at the ISAOs and ISACs that have substantive demonstrated success stories. What has been confirmed time and again to drive success is strong and passionate grass roots effort that can drive proven outcome by engaging those who own the information and aligning the objective with their own self-interests. Alternatively, a prescriptive top-down model has generally resulted in those it affects meeting the letter but not the spirit of the law, and/or minimally participating to assure plausible deniability in adhering to requirements. 

We are presently at a pivotal point in history—complacency is our enemy, driven by thinking that orders affecting federal information technology and operational technology are independent and will not affect public and private sector entities. Consider this a call to action to engage in shaping the emerging direction since it is critical to our future.

Act early to weigh-in and comment on all the federal recommendations that will emerge in the coming months and recognize that adopting successful models, and preferably non-prescriptive frameworks today, will directly affect our future and that of the generations that will follow. Given the state of our nation’s cybersecurity, bold changes and significant investments are called for to defend the vital institutions that underpin the American way of life. That said, with at least 85 percent of the cyber infrastructure owned and controlled by the private sector, having the private sector work collaboratively with the public sector, weigh-in and lead the way today is essential to a favorable outcome. We must not wait until it’s too late to change the direction; once the winds of change reach hurricane-force, it will be very difficult to direct this momentum in a direction that will produce positive outcomes.

Frank J. Grimmelmann serves as president & CEO for the Arizona Cyber Threat Response Alliance (ACTRA), a non-profit entity that was developed collaboratively with the Arizona InfraGard Program, the FBI, USDHS and law enforcement, and independently launched in 2013 to enable its private/public sector member organizations across all critical sectors to enable themselves to respond to the escalating national cybersecurity threat. Grimmelmann co-chairs Governor Ducey’s AZ Cybersecurity Team (‘ACT’) and is a founding member of President Obama’s National ISAO Standards Group Leadership Team at the University of Texas San Antonio (UTSA). As ACTRA’s leader, Grimmelmann was the first private sector representative in the Arizona Counter Terrorism Information Center (ACTIC) appointed to its Executive Board. He has held C-level positions in Finance, healthcare and government, now focusing on cybersecurity in response to 9/11. He holds an MBA in Finance/International Business from UC Berkeley, and a BA in Operations with a Business Law minor from the University of South Florida.

https://issuu.com/azbl/docs/azbl_newsletter_summer_2020

Watch Marianne speak at our September dinner event.

Make a large impact on STEM education in middle and high schools as a SciTech Jedi

Volunteers are needed to serve as “SciTech Jedi Mentors” for the student Chief Science Officers (CSO’s) who are the elected student science leaders at their schools at the CSO Summer Institute. Don’t let the title scare you – anyone can help mentor these young CSO’s. Volunteers will work in shifts to informally coach small teams of 10-15 CSO’s. CSO’s are 6th through 12th grade students who are elected by their peers to serve as the voice for the schools in their community. These CSO’s identify and organize STEM opportunities such as speakers, field trips, activities and events for their peers. To help them achieve their goals, “SciTech Jedi Mentors” will be helping these young people with their leadership skills, strategic planning, and communication skills. This is a rare opportunity to make a huge impact on high school students across the valley, just by sharing your education and work experience and just a few hours of your time.

Location: Grand Canyon University

Dates available: July 18 – July 21

Various shifts available

For more information contact Jeremy Babendure at jbabendure@aztechcouncil.org.