Cybersecurity, systems and stakeholders

Safeguarding your company

If your company’s board of directors is concerned about cyber-attacks on the company, they are most likely going to direct executive management to assess the risk, and report the results back to the boards. They do this, to enable informed decision-making (ISACA).

So then senior management comes to you, and asks you to build a report, so they can report back to the board. Good luck.

Ok no, it’s not so bad. Here’s one thing you can try, to make sure you’re gathering fulsome information, from across the company, to provide an accurate report.

∘ Stakeholders ∘ Systems

Cyber-attacks cause massive disruption to companies. Some take months to recover, and in some cases, companies close down as a result.

Stakeholders

In PROSCI’s article How to Start Managing Change When the Change is Unclear, Lisa Kempton says:

“Perform a stakeholder analysis to identify and categorize stakeholders according to the extent the change will affect them. Involve stakeholders and end users in the design of the solution, corresponding with their proximity to the change to encourage engagement.”

I am sure there are a number of companies that wish they could have prepared better for the cyber-attack they experienced. But they may have not even been aware of what was coming there way. Honestly — much like most of us. Including myself. It can be very overwhelming — trying to figure out where to start, in thinking about cybersecurity.

But beginning the process of understanding your stakeholder group can help.

I am not the biggest fan of massive excel sheets worth of stakeholder names. To me — that’s data. Very useful. But doesn’t help me talk with the people listed on the excel.

In my experience, the best thing you can do is start with HR and ask for a list of business unit leaders you think might be impacted with the change. And then from there, connect with them, and build a people change assessment. The key here is, don’t stop at building out an excel report of stakeholdrs. Build out a plan of how you will reach out to those stakeholders. I’m all for data — but my personal strength is connecting with people. Articulating what the change is, based on the data provided.

Systems

The reason discussions with the stakeholders are important, is because they will be the ones to identify which systems would be most vulnerable to exploitation, in the event of a cyber-attacks. Thinking back to the companies that have been forced to shut down as a result of a cyber-attack, there may have been numerous processes that were crucial to the running of the company — that just had no back ups in place. When you learn about these systems, now you can build a plan for how to protect them, back them up.

Your company’s board of directors will look to management to report back on the results of how safe the company is from cyber-attacks. When you reach out to find out who the stakeholders are, start to develop strong working relationships with them, you will find out what systems you have to safeguard. And then report that back to management, and the board.

Happy leadership.