Q. I have recently been put in charge of defining the direction that security will take going forward within our company. Our group has already identified a department vision and mission. Can you give me some pointers on developing a strategic plan and communicating it to management in a manner that shows the value that it will bring to the company?
A. First, congratulations on developing your vision and mission before tackling the task of creating a strategy. A mistake often repeated is the misunderstanding of the differences between a mission, vision, strategy, and goals. Quite simply, the strategy is the “how” or means in which you will fulfill the “what.” Goals are the measurable activities you perform to get to the end result or the “what” – your vision and mission.
Your strategy must align with your company’s form, language and values. Take the time to get input from trusted peers who have had success in developing, gaining approval and implementing strategic plans within your organization. There is usually a common thread amongst all companies in what they want to achieve and how they achieve it. However, priorities and emphasis will differ depending upon the company’s overall business strategy, culture and mission. If your management and organization is known for its fiscal strength and emphasis, then be sure to include these as key ingredients in your strategic plan. If personal growth and responsibility are emphasized, then ensure your plan reflects this value.
Leave yourself some options. Devise and communicate your preferred plan with several different options in mind for management to consider and approve. So often there’s the temptation to believe that a plan is so great that it’s presented with only one of two options – take it or leave it. You are competing with other important functions for attention and resources. Your ability to plan for this and have options for management to consider gives you credibility. Your three-year strategic plan may end up taking five years to complete, but you have gained favor with key decision makers by putting yourself in their shoes and seeing the big picture. Be very clear to inform them of the risks associated with their decisions, but be ready to be a team player.
Finally, be concise in your documentation and delivery. Choose three to four memorable cornerstones to build everything around. For instance, my most recent strategic plan was developed around four key ideas.
1. Create security ownership at every level of the organization
2. Partner with other functions to gain traction and integration of security solutions
3. Raise security issues to appropriate levels to gain quick and decisive action
4. Create solutions that are understandable, affordable, and align with business objectives.
Developing a successful strategic plan can be challenging; however, you will be rewarded for your efforts. It’s your group’s roadmap to success.
Answer provided by Mark Lex, Security Executive Council Emeritus Faculty.
