What new teams need
People joining a federated program need the knowledge and skills to take part. Four kinds of support provide them:
- Role-specific training. Training matched to what each role does, and relevant to people's daily work.
- Guides and resources. Step-by-step instructions and answers to common questions, easy to find and kept up to date.
- A knowledge base. A shared place for good practice, lessons learned and examples from across the organization, which teams add to as well as draw on.
- Ongoing support. Someone to answer questions and resolve problems promptly, such as a dedicated support contact or a help desk.
Two kinds of newcomer
New participants tend to fall into two groups. Some are new to cyber risk management and are not confident starting alone. Others are comfortable with the idea and ready to begin.
The second group can get started on their own if the process is self-service and the guidance is built in. The first group needs a person.
The first-plan consultation
One practice has worked well for the first group: a one-hour consultation. Someone from the security office sits with the new participant and walks them through creating their first security plan.
They leave with a real plan and enough understanding to continue on their own.
Let the process do the teaching
The more guidance the process itself carries, the less formal training is needed. When help appears at the point where a decision is made, people learn by doing the work.
Where this approach was first used, the need for extensive training fell away as the tools gained built-in guidance. The security office stayed available for support, but the process became the main source of help.
Consistency keeps the load manageable
Support is harder to provide when teams use different tools and methods. Training has to be repeated for each variation, and adoption becomes uneven. A common process keeps the support load manageable as the program grows.
With pilot teams working and supported, the program can expand. Scaling in Waves describes how.