The complexity of technology projects is requiring businesses in the Security industry to adopt focused initiatives around program and project management. Companies, therefore, need to establish a core set of practices and standards for all types of projects to ensure the sustainability of the expected pace while delivering quality performance. 

What data do you need to make the correct business case? It is important to capture both technical and operational data. This will allow you to measure not only the technology’s effectiveness but also the user experience.

The types of data can vary based on the specific project or initiative being tested. Here are some data types to consider:

Creating a PoC environment is your next step in developing and testing a PoC. You want the environment to mimic the production environment as closely as possible. This enables you to test in a controlled and secure environment.

Effective communication is a critical component of good governance, especially when it comes to incident management. Some key considerations for creating effective communication as part of governance are:

Define clear roles and responsibilities

All stakeholders, including members of the incident response team, senior management, and relevant departments, should have clear and well-defined roles and responsibilities. This will ensure that everyone knows what they need to do and when they need to do it.

Establish communication protocols

Establishing clear and effective communication protocols can help to ensure that information is shared quickly and efficiently during an incident. This may include:

The process is defined as a series of operations to achieve the desired goal in a consistent fashion. A good process requires structured and holistic thinking, as well as an objective, resources, actions, and timing.  

We commonly find organizations have processes that are not well defined, and they are often not helpful to the people who need them. It is critical to developing a formalized process management plan, so the right people get the right information when it is needed.  

While every organization is different, we often recommend that processes be approached in two ways: Process Planning and Process Delivery.

Having the right people and processes in place is a good start, but without proper governance, things can go awry.  

We commonly find issues involving poor or non-existent collaboration, a vague understanding of who does what, and the lack of a unified message. 

The focus of governance should be transforming siloed groups into a collaborative organization, clearly documenting roles and responsibilities, and using communications best practices.  

Also important are defining security’s seat in the C-Suite and implementing role-appropriate task management.  

Steps to build good governance include cross-functional collaboration across various departments and stakeholders; steering committees to discuss multi-disciplined goals and objectives, and vertically aligned organizational structure to provide uniform communication and escalation means. 

Organized Program 

• Creating an organized and strategic program to share information across disciplines helps align organizational priorities, reduce redundant efforts, and collaborate on projects jointly. It builds the necessary trust to execute operations and projects efficiently.

Steering Committees

• Steering committees add a layer of executive buy-in and drive long-term objectives. They provide the security management organization an opportunity to build strategic programs with proactive executive adoption and sponsorship.
• Steering committees can also help the security leadership to be in tune with the organization’s objectives.

Vertical Alignment 

• Vertically aligned organizations are important in developing a uniform set of policies, communication, and escalation procedures.
• Once combined with cross-functional collaboration and steering committee structure, a properly vertically aligned security organization can really achieve effective and efficient means to share information, transfer knowledge and resolve issues.

Key Takeaways