auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Former Thermo Fisher Scientific and NBCUniversal executive leads Auth0’s global privacy programs

**BELLEVUE, Wash. – April 13, 2021 –** [Auth0](https://auth0.com/), the identity platform for application teams, today announced that [Lucy McGrath](https://www.linkedin.com/in/lucy-mcgrath-she-her-5332542/) has been appointed as the company’s first Vice President of Privacy. McGrath is an international data privacy lawyer and will be responsible for enabling Auth0 and its customers to continue to solve dynamic privacy challenges and protect the users and other humans impacted by their work.

McGrath has 20 years of diverse data privacy experience working with Fortune 500 brands, including Thermo Fisher Scientific, Promontory Financial Group (an IBM Company), NBCUniversal, Salesforce, and TJX Europe. As Auth0’s VP of Privacy, she will lead global data privacy programs, further embed privacy-by-design principles into Auth0’s products and processes, and continue to shape a culture of privacy for the company and its customers. McGrath holds degrees in science and law with an LLM in information law and data protection and is based in London. 

“Identity management and privacy are without a doubt intertwined because identity is about people,” said Eugenio Pace, CEO, and co-founder of Auth0. “Lucy’s deep privacy expertise and ethos of putting the human at the core of everything she does is a huge asset to Auth0 and our customers who are navigating the complex global data privacy landscape.”

According to [Cisco’s 2021 Data Privacy Benchmark Study](https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-privacy-benchmark-study-2021.pdf?CCID=cc000160&DTID=odicdc000016&OID=rptsc024690), sentiment toward privacy laws is overwhelmingly positive, and investing in privacy makes companies more innovative and attractive among consumers. McGrath will help reinforce the link between privacy and identity management and empower Auth0 customers to innovate in compliance with existing and emerging global regulations such as GDPR, CCPA, and U.S. state privacy laws, Brazil’s LGPD, and [Japan's APPI](https://auth0.com/blog/the-new-japanese-privacy-law-what-businesses-need-to-know/).

“It was clear from Auth0’s values that the company cares about human beings—which is what drew me to this role. The opportunity to connect with and support an increasing number of customers across diverse sectors and regions is very exciting,” said McGrath. “Privacy is dynamic, and a big part of my role is enablement for our employees and customers to manage risk and respond to the pace of change. I’m lucky to be working with innovative, important technology while preserving the dignity and respect of the employees, customers, and partners who are a part of Auth0.”

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com)

Auth0 Appoints Lucy McGrath as Vice President of Privacy

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

Learn how ISO 27018 controls help cloud service providers reduce security risks for personal data.

ISO 27018 is the first international standard created specifically for [data privacy](https://auth0.com/blog/data-privacy-101/) in cloud computing. Its main objective, according to the [International Organization for Standardization (ISO)](https://www.iso.org/standard/76559.html), is to establish “commonly accepted control objectives, controls, and guidelines for implementing measures to protect Personally Identifiable Information (PII).”

ISO 27018 is part of the ISO 27000 family of standards, which define best practices for information security management. ISO 27018 adds new guidelines, enhancements, and security controls to the ISO/IEC 27001 and ISO/IEC 27002 standards, which help cloud service providers better manage the data security risks unique to PII in cloud computing.

Although ISO 27018 is not a law, there are a number of benefits to following its guidelines and earning certification (more on this below). And since [the standard isn’t free](https://www.iso.org/standard/76559.html) to the public, we’ve combed through it to help you make intelligent decisions on compliance and certification.

Below are the most important things you need to know about ISO 27018 and why it’s a good idea to follow.

## Version “2019” vs. “2014” - What’s New?

ISO 27018 was first created in 2014 (ISO/IEC 27018:2014) and was last revised in 2019 (ISO/IEC 27018:2019). The differences between the two versions are minor and do not change the best practices for protecting PII in cloud computing and public cloud applications in any major way.

As ISO states in Section 2 of the 2019 version, “This second edition cancels and replaces the first edition (ISO/IEC 27018:2014).” It goes on to explain that the revisions are primarily to correct an editorial mistake in Annex A.

However, **one noteworthy revision to point out**, from a certification standpoint, is that ISO 27018 is no longer referred to as a “standard” within the document itself. Instead, the latest revision replaces all mentions of “standard” with the word “document.”

In plain English, that means **ISO 27018 is now considered a set of guidelines and controls that enhance ISO 27001** (the standard for building an information security management system or ISMS), rather than a standard for organizations to certify against.

Cloud service providers should instead certify against ISO 27001 using 27018 guidelines in the event that they process PII.

## Why ISO 27018 Compliance Is Beneficial

[A study by PWC](https://www.pwc.com/us/en/services/consulting/library/consumer-intelligence-series/cybersecurity-protect-me.html) found that “85% of consumers will not do business with a company if they have concerns about its security practices.” Simply put, ISO 27018 compliance is a competitive advantage for both cloud service providers and their customers:

* **For cloud service customers**: If you can show consumers that their data is protected by comprehensive PII protection standards (by working with cloud service providers that follow ISO 27018), they’ll be more likely to do business with you.
* **For cloud service providers**: If you’re ISO 27018-compliant, it makes it easier to close deals with prospective customers because you can say, “We follow the most comprehensive data controls.”

Here are four additional ways ISO 27018 compliance benefits businesses.

### 1. Improved Global Operations

Since ISO 27018 is an extension of ISO 27001, it’s part of an internationally recognized standard. That means it’s easier for cloud service providers to provide assurances on their security practices if they’re doing business globally, as the standard is recognized in most countries.

_**Note**: Following ISO 27018 will streamline cloud privacy in many instances, given its global acceptance. However, it’s always important to consult a data privacy attorney skilled in the laws of the specific country you’re trying to do business in to ensure that you’re compliant._

### 2. Improved Security And Legal Protection

Earning the ISO 27001/27018 certification is an important part of establishing a baseline of security for any business that processes data in the cloud. Simply put, following these standards helps you reduce security risk since they are recognized as some of the comprehensive in cloud computing applications.

Implementing ISO 27018 controls and earning a certification also helps protect your business against charges of negligence or recklessness in the event that a breach was to occur.

Negligence charges can often incur more severe penalties ([as Equifax found out in 2019](https://www.theverge.com/2019/7/22/20703497/equifax-ftc-fine-settlement-2017-data-breach-compensation-fund)). But if a business is using a well-defined, risk-based approach to protect users’ personal data, it not only decreases the likelihood of a breach, but that also evidences a company’s focus on security.

The same goes for customers of cloud service providers. Working with ISO 27001/27018-certified cloud providers shows regulators you’re taking important steps to protect your users’ personal data.

### 3. Streamlined Sales Processes

Corporate security is a major friction point for a lot of IT sales deals. ISO 27018 helps reduce that friction because it simplifies the amount of information required for corporate security to sign off.

Instead of a long drawn out inquisition or questionnaire from prospective customers, an ISO 27001/27018 certified cloud service provider can simply have their customers review their Statement of Applicability (a list of in-scope security controls and implementation) to provide them the assurances they need to close the deal.

### 4. Better Security For A Postpandemic World

Cloud computing usage is rising at a significant rate ([spending is up 37% in 2020](https://www.pwc.com/us/en/industries/tmt/library/covid19-cloud-infrastructure.html), according to PwC) due to an [increase in remote work](https://news.gallup.com/poll/321800/covid-remote-work-update.aspx) as a result of COVID-19. This increase has also led to an increase in cyberattacks across the globe, according to [Interpol](https://www.interpol.int/en/News-and-Events/News/2020/INTERPOL-report-shows-alarming-rate-of-cyberattacks-during-COVID-19) and the [U.S. Chamber of Commerce](https://www.uschamber.com/series/above-the-fold/the-evolution-of-cybersecurity-threats-during-covid-19-and-what-you-can-do).

However, while many workers have already returned to the office, as of the end of 2020, [a survey by PwC](https://www.pwc.com/us/en/library/covid-19/us-remote-work-survey.html) shows that remote work will likely stay commonplace even after the pandemic is over. As a result, cloud usage will likely remain high to accommodate remote workers, and ISO 27018 compliance will continue to remain beneficial after COVID-19 is long gone.

## ISO 27018 Controls and Compliance

If you’re serious about following the controls laid out in ISO 27018 or earning an ISO 27001 certification, we highly recommend you read both standards to familiarize yourself with all that is required of you. 

To get a better feel for what you need to prepare for, here is an overview of the controls laid out in ISO 27018 and the process for certification through ISO 27001.

### ISO 27018 Controls Overview

The requirements below are a guideline for cloud service providers on how to update their procedures, technology, infrastructure, etc., in order to follow the controls laid out in ISO 27018.

Some of these recommendations will likely feel familiar, as they show up in regulations like the [GDPR](https://auth0.com/blog/your-quick-gdpr-compliance-checklist/) (just one example of how the ISO 27018 guidelines can help you meet regulatory requirements in different countries):

1. **Always process customer data according to a customer’s wishes**. Basically, you’ll need to show that you’re only using PII the way(s) its owners have explicitly said you can. Meaning, if a user says you’re not allowed to use their information for marketing and advertising, you should have processes for ensuring that never happens.
2. **Help cloud customers provide their users access to their data when they request it**. Or, in plain English, if your customers’ customers want to access their data, you need to have the processes and technology set up to help them do that.
3. **Enable cloud customers to comply with their notification obligations in the event of a data breach**. If breached, cloud service providers should help provide their customers’ visibility into their own data.
4. **Share information with the minimum required parties**. Basically, keep data private unless you’re required to turn it over. This helps keep personal information safe.
5. **Tell your customers about any subprocessors in your contract with them**. This includes notifying your customers about any location(s) where that data is being processed.
6. **Ensure you have a policy for disposing of (or returning) data that is no longer in use**. For example, if a customer ends their service agreement with you, you must have a plan for what to do with their data.
7. **Have your operations regularly reviewed and audited by a third party**. Certification is required annually by a third party. But if you make significant changes to your processing procedures, you’ll also need a third party to review them.
8. **Ensure that every employee with access to your customers’ data is under NDA**. This adds accountability and legal protection in the event that one of your employees is responsible for sharing data when they’re not supposed to.
9. **Ensure that your staff has adequate training**. All of your employees who have access to your customers’ data should be trained to handle it in accordance with ISO 27018 guidelines.

### ISO 27001 Certification Process Overview

As mentioned above, ISO 27018 certification is part of the certification process for ISO 27001 for cloud service providers. Certification for ISO 27001 is required every three years and is determined by an ISO-accredited third party. It typically happens in two stages:

1. **Stage 1: An informal review of your information security management system (ISMS)**. The purpose of Stage 1 is to familiarize auditors with your organization. During this stage, auditors will check up on key documentation and procedures (to ensure they exist).
2. **Stage 2: A formal compliance audit**. In Stage 2, auditors will perform detailed tests of your ISMS against the requirements in ISO 27001 and 27018, looking for evidence that it meets the requirements laid out in the standard. If your ISMS passes this stage, you’ll achieve certification for the year.

After certification, you’ll be required to participate in annual surveillance audits to ensure ongoing compliance. If your ISMS is on the newer side, they could occur several times a year to ensure that everything is in order.

## Are ISO 27018 Controls Worth Implementing?

While the controls laid out in ISO 27018 are not legally required, it’s a really good idea to follow them if you’re a cloud service provider who processes PII&mdash; especially if you’re doing business internationally.

It’s true that the costs of certification through ISO 27001 can be prohibitive for some (certification costs vary from business, depending on the size of your business, the scope of your cloud utilization, etc.). But a data breach isn’t cheap either ([$3.86M](https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/), on average).

And although certification won’t prevent a breach altogether, the controls ISO 27018 recommends certainly can improve your chances of avoiding one (you’ll also have better coverage in the event a breach does occur), even if you don’t pursue a certification.

Especially when you consider the impact a breach can have on your brand ([65%](https://www.centrify.com/media/4772757/ponemon_data_breach_impact_study_uk.pdf) to [80%](https://www.forbes.com/sites/forbestechcouncil/2017/12/08/mind-the-trust-gap-how-companies-can-retain-customers-after-a-security-breach/#40b4b2806c95) of consumers lose trust in a company that’s been breached)!

<include src="asides/AboutAuth0" />

What Is ISO 27018:2019? Everything Executives Need to Know

ghazi-masood

I'm a seasoned business leader with nearly a 25 year track record in Sales running and managing teams of all sizes working in leadership positions for world class organizations.  Nowadays, you can find me at Auth0 leading all aspects of Revenue growth  for the Americas business.

Auth0 Vice President and General Manager, Americas.

Ghazi Masood

Executives might be over the term, but it still has a lot to teach

Digital transformation has been one of the defining business concepts of the past few decades, yet it’s also one of the most commonly misunderstood.

For some executives, the term evokes salespeople promising that their shiny new product is the key to digital transformation and then leaving them with technology that causes more problems than it solves. Meanwhile, others think they can afford to stop thinking about digital transformation because their business has already accomplished it.

Both reactions are understandable, but both are wrong.

In reality, digital transformation is too important a concept to be written off as a meaningless buzzword. [IDC estimates](https://www.idc.com/getdoc.jsp?containerId=prUS45612419) that worldwide spending on these technologies and services will reach $2.3 trillion in 2023. Yet, according to [McKinsey research](https://www.mckinsey.com/business-functions/organization/our-insights/unlocking-success-in-digital-transformations), fewer than a third of digital transformations actually succeed in improving company performance. Executives can reduce this waste by having a high-level understanding of digital transformation so they can rally their teams behind a shared vision and clearly defined goals.

 Digital transformation doesn’t refer to any specific digital initiative or product, but to a philosophical approach to implementing and assessing technology.

So let’s untangle the true meaning of digital transformation from all of the misunderstandings.

<include src="ebook-ads/IamWhitepaper" />

## What Is Digital Transformation?

In a nutshell, digital transformation means organizations refining their processes through continuous technological improvement, rooted in business goals and interwoven throughout an organization. [Ashutosh Bisht](https://www.idc.com/getdoc.jsp?containerId=PRF004945), senior research manager at IDC, [describes it as](https://www.idc.com/getdoc.jsp?containerId=prUS45612419) “managing the existing business and building for the future at the same time, something like changing the engine of the plane while in flight.”

### Designed to Adapt

Digital transformation isn’t just about adopting digital initiatives for today’s needs. It’s about instituting processes designed to adapt and evolve future technological advancement.

<include src="TweetQuote" quoteText="Technology that meets the definition of digital transformation is modular, is designed to be rearranged, and doesn’t fall apart with the slightest tinkering."/>

In the ’90s, digital transformation was all about setting up your company’s first website, transitioning to email for communication, and replacing rows of file cabinets with digital records. In the early 2000s, it meant switching to the cloud, harnessing useful analytics, and expanding the suite of services offered through your website and app. The next phase of digital transformation involves automating operations, using robotics, and constructing frictionless digital ecosystems for customers and employees.

All of these waves of innovation build on one another, and the companies best equipped to ride each successive wave are the companies that employ adaptable, extensible tools. Building complex applications in-house can leave your business stuck with legacy code bearing the distinctive fingerprints of its original designer, who may have left the company and taken their expertise with them. By contrast, the technology that meets the definition of digital transformation is modular, is designed to be rearranged, and doesn’t fall apart with the slightest tinkering.

![Collapse](https://images.ctfassets.net/23aumh6u8s0i/62orxkFTkFC3t9kPpJGoQQ/bdacba8b87953290dadb0da16632db27/pyramid-collapse)

Consider a [2020 report](https://www.e-shelter.de/sites/default/files/2020-05-12_-_hesitancy_gap_press_release.pdf) by UK-based technology company NTT called Mind the Hesitancy Gap. The report surveyed IT professionals in the UK and found that IT teams wasted 26% of their time “laying the groundwork for digital transformation processes,” with the result that those processes were often delayed, over- budget, or scrapped altogether. Thirty-five percent listed “the complexity of connecting the range of cloud services and other technologies together as a major barrier,” while 42% named “concerns over whether a new digital capability could introduce a security risk or leave the company non-compliant with regulation.”

### Designed for Business Goals

Fans of The Office (the American version) will recall Dunder Mifflin’s ill-fated attempt at digital transformation: an application for ordering bulk paper products that doubled as an exciting social network. This is a prime example of why digital initiatives often fail: companies chase “cutting-edge” tech, but fail to connect it to their business’ value proposition.

<table>
<tbody>
<tr>
<td>True digital transformation is rooted in business goals that are specific, and above all, measurable.</td>
<td><img src="https://images.ctfassets.net/23aumh6u8s0i/8S3tbcx2Il9uqaWRsFS2B/ca3b03aa4f5692c4a36e4ebb498ceb89/the-office" alt="the-office" width="360" height="218"/></td>
</tr>
</tbody>
</table>


You need to know exactly what problem a digital innovation is trying to solve so you can measure its success. For instance, don’t adopt a messaging platform to “speed communication” because faster communication isn’t an end unto itself.

Instead, ask who needs to be able to communicate faster. What information do they need to exchange, and are there other ways the information could be accessible? How do you measure success? If you’re adopting the platform in the factory, it might be a reduction in maintenance time for equipment. If it’s on the sales floor, it might be the sales team making more sales because they’re empowered to cut customers a better deal without having to walk away and talk to a supervisor.

## Digital Transformation Myths and Misconceptions

The meaning of digital transformation has eroded over the years. That has led to wasteful spending and an uphill battle for innovators trying to get organization-wide support for their ideas.

### Digital Transformation Isn’t Digitization

[Digitization](https://www.forbes.com/sites/jasonbloomberg/2018/04/29/digitization-digitalization-and-digital-transformation-confuse-them-at-your-peril/#46410592f2c7) means moving from pen-and-paper processes to digital ones. When a company transfers years of paper records onto a database, that’s digitization. While that’s certainly important, simply moving from analog to digital isn’t truly transformative.

### Digital Transformation Isn’t a Pretext for Laying off Your Workforce

Employees often get nervous about new technologies because they imagine the technology will put them out of a job. That may be true in some cases, such as robotic assembly lines and driverless trucks. But by and large, digital transformation should be an invitation for your workforce to evolve along with your technology. If you want a holistic adoption of digital initiatives, you need buy-in from all levels. Use this as an opportunity to train your workforce in new skills, not render them obsolete.

### Digital Transformation Isn’t Top-Down

Or at least, it can’t be only top-down. Far too many digital initiatives are undertaken by a well-meaning C-suite but fail to get the crucial input of the IT team or the workers on the ground.

True digital transformation is holistic and dedicated to removing silos. In that way, it mirrors the increasing integration of technology into every facet of our lives.

## Designing a Digital Transformation Strategy That Works

So we’ve talked about what digital transformation is and isn’t. Now let’s look at how that definition should inform your business’s strategy as you decide what initiatives to adopt.

### Ask Your Insiders

Looking for inefficient processes that could be improved by technology? Don’t go to strangers; ask your teams! [_Harvard Business Review_](https://hbr.org/2019/03/digital-transformation-is-not-about-technology) points out that companies “frequently bring in an army of outside consultants who tend to apply one-size-fits-all solutions in the name of ‘best practices.’” Instead, they suggest talking to staff during the brainstorming phase of transformation as a way to capitalize on your institutional knowledge as well as get buy-in from the people you need to use your technology.

### Implement, Test, Refine, Repeat

Digital transformation requires something of a startup mentality that rewards experimentation and creativity and sees failure as a learning opportunity. Determine your definition of an initiative’s success, and if it fails to deliver, try something else. Without that willingness to test and tweak, digital initiatives can quickly morph into “pet projects.”

Embracing that startup mentality can be more of a challenge in large, bureaucratic organizations. That’s why [Gartner predicts](https://www.gartner.com/smarterwithgartner/gartner-top-strategic-predictions-for-2020-and-beyond/) that through 2021, these initiatives will take large enterprises twice as long and cost twice as much as planned. The good news is that an agile SaaS approach helps organizations speed time-to-market for digital initiatives. Partnering with third-party SaaS solutions can speed up time-to-market for large enterprises by cutting through bureaucracy with easy-to-implement solutions. The majority of companies already use a SaaS tool to manage authentication, payments and messaging. 

### Serve Your Customers by Serving Your Workforce

[Many definitions](https://www.forbes.com/sites/jasonbloomberg/2018/04/29/digitization-digitalization-and-digital-transformation-confuse-them-at-your-peril/#46410592f2c7) of digital transformation are focused on becoming “customer-centric,” and there’s a lot to that idea. Amazon, for instance, has remained at the forefront of transformation through its single-minded focus on the customer, and retailers are learning to follow suit in order to survive.

However, if you focus all of your efforts on B2C transactions and neglect to empower your workforce with the latest tools, you’re not equipped for true transformation. Instead, many successful transformations start by giving staff easier access to information and streamlining day-to-day operations. 

This graph from [McKinsey](https://www.mckinsey.com/business-functions/organization/our-insights/unlocking-success-in-digital-transformations) shows the success rate of digital transformation based on various metrics. As you can see, collaboration and workforce protocols are distinguishing factors among companies where transformation has fulfilled its promise. The dark blue bars show the power of digital transformation.

![Graph-from-McKinsey](https://images.ctfassets.net/23aumh6u8s0i/3hGz7H6BvfP3780BfCpkm0/6929d3627a4eaeab2b2aa60580385212/graph-from-mckinsey)

## There Is No Finish Line for Digital Transformation

Of all the myths about digital transformation that need to be debunked, perhaps the biggest one is that it’s a process with an endpoint. After all, it’s not as though your fairy godmother can wave her wand, and then poof! Your business is transformed once and for all.

Rather, you commit to adopting new technologies as they develop, provided they meet your business’s needs. Your best allies will be your own team and trusted third parties who can ensure that you dedicate your resources where they will be most useful and best positioned for the future.

<include src="asides/AboutAuth0" />

What Digital Transformation Is (and What It Isn't)

jessica-sealby

Jessica drives public relations and global communications efforts for Auth0 across Asia Pacific. Outside Auth0, she frequents Melbourne’s live music venues and chases after her two energetic dogs.

PR Manager - APAC

Jessica Sealby

Seasoned partner executive joins the technology unicorn to grow partner business across APAC; Auth0 also announces new partner in Korea

**SINGAPORE, 30 April 2020:** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, has committed to growing its partner sales across Asia Pacific through the appointment of channel veteran [Jason Teo](https://www.linkedin.com/in/jasonteocj/?originalSubdomain=sg) as the company’s first partner chief in the region.

In this new role as APAC Head of Partnerships and Alliances, Teo’s mandate is two-fold: to build and grow the partner ecosystem in the region; and to execute a partner strategy that will diversify sales and accelerate growth.

Teo has extensive experience helping technology companies expand across Asia and plans to draw upon his vast network and established relationships with partners and system integrators to help support Auth0’s ambitious growth plans in Asia Pacific.

Regional Director for Auth0 in Asia Pacific, Richard Marr, welcomed Teo as an integral part of the company’s growth strategy. “Our differentiated identity platform is seeing adoption in all market sectors and geographies; we’ve experienced consistently high growth across Asia Pacific and invested strongly in the region with three offices and a team spanning South East Asia, Japan, Australia and New Zealand, and India,” said Marr. 

“Building partnerships in APAC is the next important step for Auth0 as we continue to expand locally, and we’re very pleased to have Jason at the helm,” added Marr.

As part of Auth0’s expansion in the region, it has partnered with digital transformation specialist, [OSC Korea](http://www.osckorea.com/). “We are experts in helping our customers to accelerate the digital transformation experience by providing Open Source, microservices architecture, DevOps CI/CD consulting and deployment,” said Jay Kim, CEO at OSC Korea. “To best support our customers, we are working with Auth0 as the identity and authentication solution that can be easily integrated and improve business performance.”

Teo has held leadership positions in various companies including Amazon Web Services, where he was the first Head of Channels and Alliances for ASEAN, launching and establishing its partner ecosystem across the region. His career also includes building the Cloud Business Unit for IBM in Singapore and being the first person on the ground for BlackBerry in Singapore, managing their telco partners across Asia Pacific.

According to Teo, finding the right partners is vital to help Auth0’s customers adopt a cloud-native solution for identity management. He joined the U.S.-based unicorn as he believes Auth0 is creating meaningful technology that can be applied across industries and to organizations of all sizes, from small businesses to large enterprises.

“I am thrilled to be part of such a high-growth company and lead the effort around its [Partner Program](https://auth0.com/partners) expansion in APAC. It takes a whole ecosystem to get our customers up and running, which is why it’s so important we have the interests of all our stakeholders at heart to provide the best possible service,” said Teo.

“We are working with our major global partner network while actively cultivating new local partner relationships across the region, ensuring our offerings are localized and relevant to the needs of each market,” Teo added. 

Auth0 has joined the Amazon Web Services (AWS) [Partner Network](https://auth0.com/blog/auth0-joins-the-aws-partner-network-global-startup-program/) (APN) Global Startup Program and recently announced global partnerships with [Cognizant](https://auth0.com/blog/auth0-expands-global-partner-network-with-cognizant/) and [Globant](https://auth0.com/blog/auth0-partner-program-accelerates-global-growth/) as it expands its [Partner Program](https://auth0.com/partners) in APAC and around the world.

<include src="asides/AboutAuth0" />

### Media Contacts
Jessica Sealby 
[jessica.sealby@auth0.com](mailto:jessica.sealby@auth0.com)

Sophie Mayes 
[auth0@keepleft.com.au](mailto:auth0@keepleft.com.au)

Auth0 Hires Former AWS Channel Head, Jason Teo, to Lead Efforts in Asia Pacific

Executives are being held to account by regulators and seeking to shape the law

In January 2020, the FTC released a [statement](https://www.ftc.gov/news-events/blogs/business-blog/2020/01/new-improved-ftc-data-security-orders-better-guidance) defining its new position on data security orders, to give companies a clearer understanding of the FTC’s expectations for security practices. The new orders specifically emphasize the role of executives in taking responsibility for overseeing policy, in the hopes that C-Suite and board-level buy-in will improve compliance.

Under the new orders, companies must present their board with an annual report on their security program, and senior officers must directly provide the FTC with certifications of compliance. According to the FTC’s statement, “This will force senior managers to gather detailed information about the company’s information security program, so they can personally corroborate compliance with an order’s key provisions each year.”

The FTC asserts that requiring high-ranking executives to provide certifications under oath has been effective in other sectors, such as securities law since it creates direct accountability for individual executives. They cite two studies that correlate executive involvement in data security with a decrease in breaches, including one that found a 35% decrease in the probability of breaches when a company’s Chief Information Security Officer is in the top management team and has access to the board.

<include src="TweetQuote" quoteText="Find out why the @FTC’s new data security orders will require the C-suite and board to strengthen data security strategies."/>

## Executives Are Influenced by Policy and Are Influencing It

PWC’s [Top Policy Trends 2020](https://www.pwc.com/us/toppolicytrends) report surveyed over 400 CEOs, CFOs, and COOs, and concluded that data is “the unifying thread” across all the major policy areas the C-Suite is concerned within 2020. Specifically, the report highlighted data privacy as a central concern for the C-Suite, with 44% of CEOs listing it as one of the top three policies impacting their business the most.

For the past two years, organizations have been forced to adapt their data policies to a rapidly evolving regulatory landscape, most notably the EU’s [General Data Protection Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr) and the [California Consumer Protection Act (CCPA)](https://auth0.com/resources/whitepapers/simple-guide-CCPA-compliance). Most executives recognize the need for greater regulation on how businesses collect, store, share, and protect sensitive personal data. However, many are also worried that a global patchwork of contradictory regulations could hamstring their ability to operate their businesses across various jurisdictions and hope to work toward more universal standards for data privacy and security. Indeed, of the C-Suite executives PWC surveyed, close to 70% say their organization is “very actively” seeking to shape data privacy policy.

While it’s healthy for executives to help create laws that are informed by the reality of doing business, business leaders must exercise care in attempting to influence legislation, or risk a backlash. A prime example is CCPA, which in its current form is significantly weaker than the original ballot referendum, which would have granted Californians more rights.

While fines under CCPA can still be significant, one of the initiative’s drafters, [Mary Stone Ross](https://www.fastcompany.com/90444501/i-helped-draft-californias-new-privacy-law-heres-why-it-doesnt-go-far-enough), publicly criticized corporate lobbyists for their role in drafting the final legislation. Ross voiced the hope that new laws at the state and federal level would “learn from California and guard against the relentless efforts of corporations to weaken people’s rights.” In the long-term, this negative perception of corporate influence erodes public trust and makes it more difficult for businesses to wield their influence responsibly. Already, [CCPA 2.0](https://www.barrons.com/articles/california-consumer-privacy-act-alastair-mactaggarts-51576779571), which gives consumers more rights and increased enforcement powers, is set to be a ballot initiative in 2020. 
Policy aside, the public at large is increasingly sensitive to businesses whose actions don’t live up to their professed values. When Facebook’s stock tumbled 7% in January, despite strong quarterly revenue, [_The Guardian_](https://www.theguardian.com/technology/2020/jan/29/facebook-fourth-quarter-earnings-stock) suggested that “continuing scandals and regulatory roadblocks may finally be catching up with the social media giant.”

## Strategies for the C-Suite to Lead on Data Privacy
In the second edition of [_Navigating the Digital Age_](http://securityroundtable.org/ndte/ndte2.pdf), published by Palo Alto Networks and the NYSE, experts and executives from across various tech sectors joined together in a clarion call for greater innovation, collaboration, and leadership on issues of privacy and security. Their advice ranges from big picture ideas (the word “moonshot” appears 28 times) to small but crucial suggestions for improvement.

In his chapter, security advisory Marc Goodman advises leaders to pay attention to the UX of cybersecurity, since the design of many legacy security programs is “abysmal and painful.” The design of a pop-up security warning window might seem insignificant, but if it’s all that’s standing between your employee and a catastrophic security mistake, it’s a big deal. Says Goodman: “It’s not enough that our security protocols work in theory; they have to work where the rubber meets the road at the end of a keyboard... And that requires a good understanding of human behavior—something infrequently accounted for in organizational cybersecurity strategies.”

<include src="TweetQuote" quoteText="@FTC ordered the C-Suite and board to get more involved with data security. Why IAM is a strong place to start."/>

One subject that many experts mention as a lynchpin in transforming cybersecurity is authentication. Ann Johnson, Microsoft’s Corporate Vice President of Cybersecurity Solutions, writes that one of the most encouraging current developments in cybersecurity is “the imminent demise of passwords.” This outdated and breach-prone form of authentication is “giving way to biometrics and other steps in multi-factor authentication, making it harder for bad actors to penetrate our firewalls and grab our personally identifiable information, intellectual property, and digital assets of every format.” Of course, experts have been predicting the demise of passwords for ages, but until that day actually comes, it’s crucial to do a better job of securing usernames and passwords.

There’s a growing consensus that sophisticated Identity and Authentication Management (IAM) platforms offer executives a fast and comprehensive way to get control of data and step up security. That consensus is largely responsible for [Auth0’s explosive](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/) growth in recent years. As [Auth0 customer Rolf Bekkstrand](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/) attested, “As a CTO, I really don't want to be responsible for a data leak that showed passwords and user logins and those kinds of things. I'm 100% sure that Auth0, a company that is built around this, will have better ability to take care of the security than I'm able to do — your entire business depends on it.”

## To Get Involved With Data Privacy, Start by Getting Educated
For the C-Suite, taking the lead on issues of data privacy and cybersecurity begins with listening. Executives must listen to their users’ concerns, and they must also seek out opportunities for expert education so that they can make informed decisions for their companies.

At Auth0, we pride ourselves on providing not just a cutting-edge IAM platform, but also advice for leaders (whether they’re our customers or not) who are interested in stepping up their approach to security. If you’d like to explore strategies to get your C-Suite up to speed, [reach out to an Auth0 resource](mailto:sales@auth0.com).

The FTC Orders the C-Suite to Get Involved in Data Security

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Pace honored at Washington’s most acclaimed C-Suite executive leadership awards

**BELLEVUE, Wash. – January 30, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced its CEO and Co-founder, Eugenio Pace, was honored at Seattle Business magazine’s [Executive Excellence Awards](http://seattlebusinessmag.com/executive-profiles/winners-2020-executive-excellence-awards), one of the Pacific Northwest’s most prestigious business leadership events, for his exceptional leadership practices and successes in the business community. 

[Pace](http://seattlebusinessmag.com/executive-profiles/2020-executive-excellence-awards-eugenio-pace-co-founder-chief-executive-officer), one of 16 award recipients – along with some of the state’s most respected business leaders from corporations and nonprofits including Zillow Group Inc., Rosetta Stone Inc., Textio, and Washington Women’s Foundation – was honored for his principled leadership practices, and commitment to his team and business community. 

“I am truly humbled to receive this prestigious award and be recognized alongside such a distinguished lineup of professionals, who I look up to for their exemplary leadership,” said Pace. “This award is truly the accomplishment of my entire team – a team that pushes me to be a better leader day in and day out, and never stops pushing boundaries to innovate and deliver only the best to our valued team, customers, and communities.” 

The eighth annual awards ceremony held on January 23, 2020, received nearly 100 applicants this year, a record-breaking year for entries. After a lengthy review process, only 16 individuals were selected by a judging panel based on which leaders have shown outstanding leadership in guiding their companies to success.

“Regardless of industry, successful executives share several traits,” said Seattle Business magazine Editor in Chief Rob Smith. “According to ghSMART's 10-year study of 17,000 C-suite executives, called the CEO Genome Project – featured in Harvard Business Review – top-level leaders excel at four behaviors: the ability to make quick decisions with conviction; achieving buy-in from employees and stakeholders; the ability to adjust to a rapidly changing environment; and producing results.”

The 2020 Executive Excellence Awards are featured in the magazine’s February print issue and online: [http://seattlebusinessmag.com/executive-profiles/winners-2020-executive-excellence-awards](http://seattlebusinessmag.com/executive-profiles/winners-2020-executive-excellence-awards).

## About the Executive Excellence Awards 

The Executive Excellence Awards is considered to be one of the Pacific Northwest’s most prestigious business leadership events of the year. Over the years, this awards program has hosted C-suite executives from companies and organizations such as Starbucks, Amazon, Alaska Airlines, Expedia, Seattle Seahawks, Seattle Symphony, Ste. Michelle Wine Estates, the Bill & Melinda Gates Foundation, and many more.

<include src="asides/AboutAuth0" />

### Media Contacts:
Kaycie East 
Auth0 Communications 
[press@auth0.com](mailto:press@auth0.com)
 
Alexandria Plew 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Eugenio Pace of Auth0 Honored for Executive Excellence by Seattle Business Magazine

Chief Financial Officer and Chief Product Officer join company to support hypergrowth

**BELLEVUE, Wash., Sept. 17, 2019 —** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced Barry Plaga as chief financial officer (CFO) and Shiven Ramji as chief product officer (CPO), two key appointments to the senior leadership team.

[Plaga](https://www.linkedin.com/in/barry-plaga-97204b14/) joins Auth0 as a seasoned CFO with more than two decades of experience overseeing financial and operational functions. Previously, Plaga served as the CFO and COO of Guidance Software, where he oversaw the financial planning, accounting, and treasury functions of the company worldwide, as well as managing investor relations, IT, legal, and operations.

As CPO, [Ramji](https://www.linkedin.com/in/shivenramji) will guide Auth0's product vision, innovation, design, and strategy, and brings more than 15 years of experience in B2B and B2C product management, and business development. Before joining Auth0, Ramji served as the SVP of Product at DigitalOcean, where he led the strategy of DigitalOcean's products, pricing, and partnerships.

"Barry and Shiven bring incredibly deep experience and a proven history of taking fast-growing technology companies to the next level," said Auth0 CEO and co-founder Eugenio Pace. "We are very excited to welcome them to the team, and will leverage their collective expertise to propel Auth0 through its next phase of growth."

<include src="asides/AboutAuth0" />

### Media Contacts

Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Meghan Gardner 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Expands C-Suite with New Executive Appointments

Industry thought leader Christian McCarrick brings more than 20 years of experience

BELLEVUE, Wash. -- July 30, 2018 -- [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that [Christian McCarrick](https://www.linkedin.com/in/christianmccarrick/) has joined the company as Vice President of Engineering. As a technology veteran and renowned thought leader on software engineering and technology leadership, McCarrick will be responsible for driving innovation and growth within the engineering team; and working alongside CTO and Co-founder Matias Woloski to continue expanding the company’s Universal Identity Platform.

McCarrick has a 20+ year history in the software engineering industry, having previously served as SVP of Platform Engineering at Global Tel*Link. He also held senior leadership positions at Telmate, AltX, and Mobitor Corporation. McCarrick is a regular speaker at engineering leadership conferences and has recorded nearly 50 podcasts at [SimpleLeadership](http://simpleleadership.io/category/podcast/) on topics like scaling engineering teams, nurturing inclusive environments, building remote teams, and much more.

“Christian’s pedigree in software engineering and technology is extremely impressive, as is the knowledge he has accrued over his long and successful career,” said Eugenio Pace, CEO and Co-founder. “We know that Christian will be an incredible addition to our company from an engineering standpoint, but equally important, he embraces our company values and is a fantastic fit with our culture as well.”

“The more I interacted with Auth0, the more I recognized what a unique company it is. Not only is it growing at an exponential rate, but the way Auth0 differentiates itself from other identity platforms on the market is a large part of why I chose to come here,” said McCarrick. “I also resonate strongly with its emphasis on culture and values. I am thrilled to be part of this organization and look forward to contributing to future growth.”

<include src="asides/AboutAuth0" />

### **Media Contact:**

Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall 
Matter for Auth0 
[khall@matternow.com](mailto:khall@matternow.com) 
971-246-7898


---

"executive"