Let\u2019s be honest, shall we? How many people do you encounter every day whose sole actions are to make sure they are covered? First, let me make the distinction between the type of CYA I am talking about here, the standard level of communication that is made with corporate leadership so that it is aware of what is being done, why it is being done and the value that it delivers to the organization. This latter kind of communication is just \u201cselling up\u201d and it is something that every CSO is doing or should be doing. That\u2019s part of how you ensure the success of your risk management endeavors. What I am really talking about here\u2014true butt covering\u2014is something far more disturbing. We\u2019ve all seen CYA in security and corporate leadership at some point or another. Leaders go through the motions of putting measures in place that create the appearance of good security. Their actions may provide some legal or technical protection, but in fact they are just providing lip service. I would wager that every security professional has encountered one of these \u201cleaders\u201d at some point in his or her career. In my humble opinion, the most egregious type of CYA is the business leader who pulls together a cross-functional \u201csecurity team\u201d that includes security leadership, line of business leaders, human resources and so on, but has no intention of actually acting on that team\u2019s recommendations. It makes every part of the organization feel involved in the process but it accomplishes absolutely nothing. Wait, scratch that. It does accomplish something: It makes the organization feel more secure when in reality it is less secure. CYA is a state of mind that cannot be tolerated in security. There is too much at stake. Here in the pages of CSO, on our website CSOonline.com and at our numerous events, we cover these stories every day. We also hear the horror stories of organizations that weren\u2019t prepared when something bad happened. It\u2019s like the business that opens a job search for a CSO, but really just wants to pick the interviewee\u2019s brain about how to fix the company\u2019s security problems. Without hiring anyone, it creates the impression that it\u2019s trying. It might even take the knowledge it has gained and try to put the easy parts to work. Unfortunately, managing risk isn\u2019t as simple as putting up nice new drapes and adding a fresh coat of paint. My advice when you encounter a CYA executive: Train him so that he understands the issues and risks. If that fails, go around him. Security is a journey and not a destination. And it\u2019s for people who are serious about it. The worst thing you can do is get tripped by those who are not measuring up, but only covering up.