CIOs must be willing to "pull the plug"