The story so far: Jim Barton, the head of loan operations for financial services company \n\nIVK, has been tapped as the CIO by the company's new CEO, Carl Williams. The previous CIO \n\nhas been fired, and Barton must restore Williams's confidence in IT while he learns on the \n\njob. In his previous role, Barton had argued against a security upgrade. Now an apparent \n\ndata breach may have compromised customer information, and Barton's job as CIO is on the \n\nline. Read the first and second installment.\n\nMore on CIO.com\nBook Excerpt: The Adventures of an IT Leader, Part 1\n\nBook Excerpt: The Adventures of an IT Leader, Part 2\n\nBook Excerpt: The Adventures of an IT Leader, Part 4\n\nFriday, June 29, 9:12 a.m....\n\nBarton and his direct reports had convened at 7:15 a.m., and they'd begun talking through a \n\nlist of issues. \n\nFirst, they needed to identify the security measures they wanted to implement to reduce the \n\nrisk of future attacks. The upgrade project that had been rejected earlier would be \n\naccelerated, but Barton wanted them to figure out what else they could do.\n\nSecond, they needed to decide what should be done to make the company secure against \n\nadditional mischief from the attack that had just happened. They had no smoking gun to tell \n\nthem that there had been intruders, but neither could anyone think of a way a database index \n\nfile could be renamed without someone meaning to do it. \n\nThird, they needed to figure out what to recommend to Williams about what, if anything, they \n\nneeded to disclose outside the company. This was the issue most likely to get people fired, \n\nthe issue most likely to spell an ugly end for IVK. \n\nFriday, June 29, 3:47 p.m....\n\nOptions were shaping up. The team would work on "future event avoidance" on a less urgent \n\ntime frame, but the other two issues, recovery from the attack and what to disclose, had to \n\nbe dealt with now. There were three possible courses of action:\n\n1. Do nothing. Assume that the past mischief was the worst that the bad \n\nguys had intended\u2014if in fact there had been bad guys. \n\n2. Shut down the company except for operations that could run manually and \n\nrebuild critical systems from development files. This was the "playing it as safe as \n\npossible" option, but the shutdown would be noticeable enough from outside IVK that it would \n\nneed to be explained. \n\n3. Build a mirror site from development files and rebuild production \n\nsystems after the mirror site was up and running. It would cost money and take a couple of \n\nweeks to assemble the necessary facilities and equipment.\n\nBarton's team had a preference for playing it safe; they liked option two.\n\nThe disclosure issue was, as expected, more complicated. Some argued for coming totally \n\nclean. The most popular position called for contacting customers whose records had been \n\naccessed and warning them that their information might have been compromised. A few argued \n\nfor no disclosure at all. \n\nAfter much tired and occasionally heated discussion, the group settled on the immediate \n\nrebuild option\u2014explaining it as maintenance\u2014and disclosure to customers only. \n\nBarton called Williams to say that he was ready to discuss options. Williams informed him \n\nthat the senior management team would convene at 8 a.m. to decide what to do. \n\nSaturday, June 30, 8:56 a.m....\n\n"So, this is a recommendation," said Williams. They were assembled in the boardroom. \n\nWilliams stood, as usual. Leadership team members sat around the table. Williams turned to \n\nGraham Wells, the company's chief lawyer.\n\n"I like the idea of playing it safe," said Wells.\n\n"Other thoughts?" Williams looked around the room. The others stirred, nodding and murmuring \n\nagreement with Barton and Wells.\n\n"What if," Williams asked, "a reporter or analyst puts together the maintenance outage and \n\nthe warnings we're sending to customers, then wants to know about the attack?"\n\n"How would a reporter or analyst know about the attack?' asked Niels Hansen, Barton's \n\nsuccessor as head of loan \noperations.\n\n"I don't know," said Williams. "Our employees know about it. Think none of them has \n\nmentioned it to a friend?" Williams continued: "Let me see hands\u2014who thinks we should \n\nadopt the plan that Jim Barton has recommended?"\n\nHaltingly, exchanging uncertain glances, the executives raised their hands, in the end \n\nindicating unanimous agreement. \n\nWilliams surveyed the room, then moved to the window. For a long time he stood, looking out. \n\nSuch a flair for drama, mused Barton. All the long pauses and stalking around.\n\nWilliams turned back: "I don't agree," he said quietly. "I WAS HIRED," he said, now \n\nshouting, "to turn this company around. We will NOT shut the company down. And we will NOT \n\nsay to anyone that we think, maybe, possibly we might have\u2014perhaps, perchance, \n\nconceivably\u2014lost customer data." \n\nHe paused to inhale again, then focused his attention on Barton. "This is it," Barton \n\nthought, "I'm history."\n\nMiraculously, Graham Wells chose that moment to speak up: "I can't go along with you on \n\nthis, Carl. This is a very dangerous course you're proposing. \n\n"I agree," said Hansen. \n\n"Anybody else?" Williams asked. No one said anything. \n\n"Very well," Williams said quietly, "the two of you are fired."\n\nWilliams returned to the window. Wells and Hansen looked at each other, then stood and left \n\nthe room. No one moved or made a sound. \n\nSuddenly, Williams turned and pointed at Barton. "YOU will need to take over loan operations \n\nagain until I figure out who to turn it over to. Do NOT\u2014and I mean DO NOT\u2014let \n\nloan operations distract you from your duties in IT. And DO NOT let this ever happen again. \n\n"\n\n"Yes, Carl," Barton whispered. \n\n"This meeting is adjourned," said Williams.\n\nCAN BARTON RECOVER? Read the final installment.\n\nExcerpted from The Adventures of an IT Leader by Robert D. Austin, Richard L. Nolan and \n\nShannon O'Donnell, Harvard Business Press, April 2009. Austin is a professor at Copenhagen \n\nBusiness School and an associate professor (on leave) at Harvard Business School. Nolan is a \n\nprofessor at the Foster School of Business at the University of Washington, Seattle, and a \n\nprofessor emeritus at Harvard Business School. O'Donnell is a PhD fellow at Copenhagen \n\nBusiness School and a former director and dramaturg at People's Light and Theatre in \n\nPhiladelphia.