The belief to change
The main obstacle to a federated program is a belief: that managing cyber risk belongs to IT and security staff alone.
It has been reinforced for years. People on the business side have learned that good IT is nearly invisible, and that risk management is a job for technical experts. Being asked to take part can feel like being handed someone else's work.
Partners in protecting the organization
The case to make is that business and security staff need each other. Threats are now too numerous and too varied for a security team to manage in isolation, and the people who run a system know things about it that the security team does not.
Six ways to engage people
- Show the business impact of cyber risk. Incidents disrupt operations, damage reputation and cost money. Use real examples and data.
- Explain the limits of the traditional approach. Describe why a security team working alone can no longer keep up.
- Emphasize the benefits of partnership. Shared knowledge, resources and accountability lead to better decisions, clearer visibility and a more effective response when something goes wrong.
- Tailor the message to each group. With finance, talk about financial risk and the use of resources. With operations, talk about continuity and avoiding disruption.
- Provide education and training. Help people understand the approach, their own role in it, and the tools they will use.
- Set clear expectations and incentives. Define what each group is responsible for, and consider recognition for those who take part well.
Map, introduce, recruit
Engagement has a practical sequence. Map the stakeholders across departments and functions. Hold awareness sessions that introduce the approach. Then recruit champions in the units who will help carry it.
The findings from discovery are useful here too. They show each group the gaps in the current approach in terms of its own work.
Keep supporting people
Engagement continues after the first conversations. Regular check-ins, discussions across functions, and tools that make it easy to share information all help people keep contributing.
With leadership and stakeholders on board, the program needs a structure to run in. Governance for a Federated Program describes it.