The compliance obligation. Inside Cyber Attack, Module II — Aftermath — this lesson names a specific move the CEO makes when the situation calls for it. The register is institutional: a working understanding of Regulator reporting, sized to be reached for in a real conversation, not recited from a slide.
- 01State Regulator reporting in the disciplined sense used throughout Cyber Attack, without softening or slogan.
- 02Recognize the situation in which Regulator reporting is the right move — and the adjacent situation in which it is the wrong one.
- 03Execute Regulator reporting in a live case drawn from your own work or a documented case study, and defend the reasoning in one paragraph.
- 04Connect Regulator reporting to the practiced judgment that governs the institution under fire so it strengthens the practice rather than replacing it.
The situation, stated plainly
The compliance obligation. Read the sentence twice. It is not a slogan; it is the compressed form of the lesson. The rest of this module returns to it, so the sentence is worth learning by heart. When the CEO sequences regulator reporting, this is what the move actually is — no more, no less.
Where it lives in the CEO's calendar
Module II exists because . Regulator reporting is one of the the CEO's craft moves that lives inside that situation. Notice which earlier lessons this one leans on and which later lessons will lean on it — the sequencing is deliberate, and the module reads differently once you place this piece.
How the CEO actually handles it
In practice, the CEO does not consult Regulator reporting the way a novice consults a checklist. The move is trained in until it becomes an available response — something to carries without ceremony when the moment arrives. The mark of understanding is not that you can recite Regulator reporting; it is that you catch yourself using it, unprompted, and can explain afterward why you did.
The board-book misreading, corrected
The most common misreading is to treat Regulator reporting as a maneuver you deploy on the other party. It is not. The CEO's institution remains itself through the crisis and better after it — and the professional application of Regulator reporting sits inside that criterion, not outside it. When the move is used cynically, the results are short-lived and the reputation cost is high. When it is used cleanly, it compounds.
- Regulator reporting is a working move, not a slogan.
- It belongs to Module II — Aftermath — because that is the situation it addresses.
- Mastery is unprompted use in the right situation.
- The adjacent lessons in this module are its natural context.
- Used cleanly, Regulator reporting compounds; used cynically, it does not.
- Horowitz, B. — The Hard Thing About Hard Things. — The unvarnished account of the CEO's recurring crises.
- Buffett, W. — Berkshire Hathaway Chairman's Letters. — The canonical annual writings on institutional stewardship.
- Bower, J. — The CEO Within. — The disciplined study of succession and executive judgment.
- 1404 — Cyber Attack, Module II: Aftermath. The Anabasis Academy. — The parent module. Re-read the module framing after finishing the lesson.