Security Executive Council Faculty Advisor

Reestablishing Security as a Critical Partner within the Organization

Q. I have been on the job for several years and I sense senior management is not as on board with security as when I started. For example, there was a management reorganization and I report to someone who is at a lower level than who I was reporting to before. There have been committees formed that I thought I should sit on and I was not invited. Should I be worried?

A. The short answer is yes, you have reason to be concerned. By recognizing there may be a problem you have taken the first step. Now is the time to take a step back to consider reinventing or restructuring your security program in a manner that (re)appeals to senior management and reestablishes it as a crucial partner within the organization.

Several questions come to mind. The first is whether there have been any personnel changes at the senior management level -- are any previously supportive people now gone?  If this is the case, unfortunately, all of the ground you covered and trust you earned while gaining support for your program may have walked out the door.  Hopefully, you already have a metrics program in place so you can show new senior management an objective view of your program goals and accomplishments, Remember, brief and to the point presentations are crucial for this audience.

In regards to the new boss situation: What steps have you taken to educate him or her about your program, the value it brings and the results you have achieved? Are you able to effectively and quickly communicate the services the organization finds valuable including the view from your boss' peers? Can you clearly articulate who the primary customers are of each security service? Can you demonstrate how each area of the company (audit, sales, comptroller, marketing, R&D, etc.,) utilizes security? Can you demonstrate the cost, head count and results of each program/service? Most importantly AFTER doing this -- did you discuss with your new boss what he or she feels should be changed or modified? In short, it appears you did not have a transition strategy and support-building program. If the new boss situation is recent, you need to scramble to address this; if too much time has passed, it may be too late.

Another aspect to consider is how well you have been aligning your programs with corporate-level goals. For most corporations this is constantly shifting; have you tapped into the "state of organizational readiness" your organization has for your security programs? Do they look at them as reducing risk in well defined areas (e.g., workplace violence or investigations)? Or at the other end of the spectrum, do they view security as a true business partner? Knowing how senior management views security will help you define your programs to meet their current expectations. It is as this point you are prime for any change in direction you feel will further benefit the organization. But you can't just expect your programs to be accepted (or continually accepted) because it may have worked in the past. You must keep up with the business side and its ongoing transformations.
 
Relatedly, you must also take a hard look at where you are as a security leader. Have you settled into a "maintenance" stance? While it is clear many security departments are currently understaffed and are working with a meager budget, consider the next stage you want to achieve. For example, keeping the program maintenance at a quality level but also looking toward emerging issues. Plan for this. If your department is thought of as simply a cost center, when the inevitable business shifts loom, you will surely be in the line of fire.

As stated at the start, yes, these are warning signs; take the time to think through your situation and the organizational structure.  Then, plan strategies that will eventually get you back to the position where the current senior management understands security’s role and the importance of including you in decisions that reduce risks of concern to the organization and ultimately to be a revenue enhancing partner.

Answer provided by Bob Hayes, Security Executive Council Managing Director and Kathleen Kotwica, EVP and Chief Knowledge Strategist, Security Executive Council.

Improving the Security Culture Within Your Organization

Q. As a Manager of Security I am finding it difficult to influence others in my organization to participate or support the security programs.  Are there effective processes that can be taken to change this?

A. Traditionally, the security program is viewed by other departments as an external entity.  Most business and operations managers and their people find it convenience to let security be security.  When a “reactionary” situation occurs, they expect security to do their thing and fix the problem, provide help and support.  No doubt, security needs to react and be there with expertise when an incident or situation arises.  However, that traditional mentality will put your security program at the back door, thought of as merely reactive and will remain isolated from the business core.

In order to have a progressive and proactive program, one that can maximize its capabilities, you need to get as much employee participation as feasible.  Here are a few suggestions that you should consider.  Ask yourself, “Does my program include these elements?” and maybe you will find ways to improve the security culture of the organization. 

• Do your security managers understand the business needs and not just the security aspects of your organization?  A very good security team speaks the language that attracts support from others in the organization.  It takes extra effort but a security staff should be trained to understand how the business operates, how the people in the various departments do their jobs.   You don’t want to learn as an investigation or incident management situation develops.  Having good business savvy will enable your security team to become more effective at winning the support of other employee groups.  Also, do not be averse to working with other managers to find ways to get yourself and other security staff trained to know the core functions of the business.  This needs to be the first step towards integrating your security department with the other cross-functional groups of the company.  It demonstrates a willingness and need to make security part of the corporate or organizational fabric. 

• Have an effective communications process with the other managers in your organization.   Identify the core stakeholders, the managers who depend on your security programs.  Generally, this will include most managers in your organization as security touches – or should touch – everyone.  But initially, identify those with whom you have direct support relationships.  As an example, if your loss prevention is mostly aimed at shipping and receiving functions, get those managers involved in your scheduled communications processes.  You can set up monthly or quarterly online meetings if that is convenient.  If you are in the same facility, have face-to-face meetings.  Make sure you are setting up “essential” agendas that are given to the meeting participants ahead of schedule.  This is important because no one has time to waste.  Your agenda should include items that will benefit the participants and the organization.   It should also include any hot issues, such as liability trends, regulatory or internal compliance or current problems that need solutions.  As a leader you want to draw as much authorship from these stakeholders as possible.  The communication sessions will afford you an opportunity to foster more involvement with your security program development.  This effort will allow these managers to find common ground with the security department and allow you to become their internal business partner. 

These are just two ways to build a security program that is driven by the organization.  Too many security programs fail or become merry-go-rounds because of isolation.  Getting off that merry-go-round is very difficult once it gets going.  If you take the lead and find ways to blend the security and business functions, you will find a stronger participation level develops.  You will also find it easier to influence changes in security and create better ROI opportunities and other positive results. 

Answer provided by Peter Cheviot, Security Executive Council Emeritus Faculty.

Training and Awareness Initiatives During Budget Reductions

Q: With massive budget reductions and travel restrictions, can you give me some pointers on how I might continue to implement training and awareness initiatives?

Whenever organizations restrict spending, alternative means of delivering work must be considered carefully. Fewer budget dollars generally means having to eliminate or reduce projects and services.  Training and awareness initiatives are often cut back, especially those with high costs. To continue to offer these programs, I would recommend conducting a simple exercise to view each program against the following criteria. First, rate how the intended program supports the company’s overall current goals. Next, rate the program against the company’s principles (such as maintaining a safe and secure workplace); and finally, does the program offer a value for meeting any legal or regulatory compliance.

Once this is completed, the options for delivering the “vital” security employee training or awareness methodologies can be considered. These should include a logical range of options from in person instructor led training to the use of online meeting applications to facilitate training long distance. E-mail campaigns and the company Intranet may also serve as excellent sources for disseminating awareness information to employees. Whatever the delivery form, by aligning efforts to highest needs of the organization, security programs can continue to implement training and awareness in all but the most dire business conditions.

Answer provided by Joseph C. Nelson, Security Executive Council Emeritus Faculty.

Who Should Security Executives Report to?

Over the past several years, I’ve had the opportunity to observe various companies approach the considerations in hiring a Chief Security Officer. If you were a fly on the wall when top management is considering upgrading their security program, it’s possible the conversation might go something like this. At the end, we would appreciate your
feedback -- who should the CSO report to?

The company and the names in this debate are purely fictitious but based on real experiences.  Assume the company is a large-cap publicly traded Fortune 250, in a business where sensitive customer data is processed; they are extensively outsourcing non-core business processes and their Board of Directors is concerned about the unaddressed risks in the security program.
_______________________________________________________________
 
The COO walks into the CEO’s office for their weekly lunch meeting and the first thing out of his mouth is “so, I’ve considered it and I’m convinced that we need to significantly upgrade our security program.  How would you propose we proceed to fill its leadership?”

COO: “I anticipated your buy-in and I think we should let Marilyn (SVP Human Resources) and Bill (Chief Information Officer) provide us with their rationale for having this responsibility in their portfolio. They both have some real skin in this game.”

CEO: “Why not you?”

COO: “I’ve already got too much on my plate with our international initiatives.  Marilyn and Bill are both on the Executive Committee and I think either of these elevate security closer to you and the Board.” 

CEO:  “The Board and the Audit Committee have made their concerns very clear on our current shortcomings with regard to a variety of security issues.  What we have to resolve between these two is whether this job is going to have real access and be more fundamental to our global risk management strategy or is it more of a day-to-day tactical job?”

COO: “I agree.  Based on our audit reports over the last several quarters coupled with our global initiatives, there’s just too much going on in the security-related area of risk that we don’t know and that makes me nervous.  Let’s get somebody in that job that can really scope out our security risks and get the business unit managers on board with solutions.”

CEO:  “Set up a meeting for you and me with these two and lets see who has the best vision for this function?”

The COO calls Marilyn, the SVP of HR, and Bill, the CIO, and lays out the challenge:  “We are moving ahead with a more senior hire for Corporate Security.  We think this involves moving the current function out of Facilities and into either of your portfolios to give it greater visibility and reach.  Prepare your position descriptions and we will meet with the CEO late next week.”

At the appointed hour, Marilyn and Bill enter the boardroom.  The CEO welcomes them and says “I’ve taken the liberty of asking our Chief Counsel to join us as I think there may be a number of issues of concern to him in this position. Marilyn, why don’t you start?”

HR: “I see security as a support function to the business, perhaps even decentralized across our business functions. Anyone who approaches this job as the be all and end all of security misses the point that every manager in this company has an obligation to protect our shareholders and our assets.  While it’s clear that this position requires a leader who understands risk, I think a critical success factor will be in their ability as a relationship manager, somebody who can build trust so that our business unit managers will come to him or her with their issues before they boil over. At the end of the day, that approach is at the core of HR’s service focus”

CIO:  “I think Marilyn is right about this position focusing in the business units. Our whole IT strategy is built around the notion of us providing security policy that holds every employee accountable for protecting our infrastructure and our private data. At the corporate level, we provide the tools and the intellectual leadership to a cadre of trained information security specialists in every business function.  The same philosophy is applied in our business continuity program that resides in my office.  Facilities already provides an in depth physical security program around our data centers and other critical spaces that IT has mandated and much of our emphasis there has been in technology rather than guards.  It seems to me it would be relatively simple to add a few complimentary programs to what we already have and limit our costs.”

HR: I’d be interested in hearing what our Chief Counsel has to say about the services and competencies this position has to bring to the table.”

Chief Counsel: “Look at the expanded job description for a Chief Security Officer that has emerged since 911: internal and external investigations, threat analysis, intelligence, physical security, personnel security, information protection, emergency preparedness and response management. I’d add to that a global network of contacts, a far more comprehensive background vetting program and significantly greater risk assessment around our expanding domestic and global business partners.”

CEO: “That sounds significantly broader than what each of you are talking about.  How would you approach these capabilities?”

HR: “Our HR Employee Relations team is highly competent in fact finding around allegations of misconduct and we’ve contracted for a confidential hotline to comply with new regulations.  Moreover, we have very few reported instances of internal misconduct. I would assume we would continue to use outside contractors for fraud investigations. We seem to be in line with our peers on just vetting a select few in management and risk prone positions.”

COO: “Marilyn, you are the employee’s advocate.  And Bill, your people are highly limited in non-technical or operational security issues.  It doesn’t seem to me that either of your teams is trained to comprehensively probe suspected instances of employee fraud or trade secret theft.  These have potentially serious consequences for the company.”

CIO: “With all respect, having HR responsible for background and internal investigations presents a potential conflict of interest in my view. We are increasingly empowering a broader and deeper base of employees and contractors with sensitive logical and physical access.  I think expanding both our background vetting and security-related due diligence makes a lot of sense.  I’d look for a highly qualified security generalist to manage much of the work Counsel has outlined.  A properly staffed security team, backed by a clear set of policy expectations and a mandate to work collaboratively with their HR and business colleagues and business managers is the course I’d take in this initiative.”

HR: “Bill has mentioned ‘policy’ twice.  The culture we have here does not respond well to policies and an appearance of a control-centered enforcement philosophy. IT is wholly focused on technical risk and many of the issues Counsel refers to are human threats which require a totally different mind set on internal controls.  He speaks of a concern for having certain security programs in HR while at the same time his CISO lives within the IT department!  I do agree with Bill on hiring a highly qualified security generalist but I’d focus the search on someone with several years of corporate experience rather than the law enforcement backgrounds that seem to be prevalent in the field.  Finally, I think it’s important to note HR’s record on the application of best practices. I’d bring that sort of leadership to the development of best practices in security risk management.”

CEO: “You both seem to feel that this is a take it or leave it choice, that somehow your leadership and unique environments will result in a better security program.  Fair enough. Both HR and IT bring assets and liabilities to the table. But I’m concerned that neither of you have spoken about the range of threats confronting the company as we adapt to our markets and competition. What sort of security leadership competencies and experience will add value in those critical areas?”

COO: “I share our CEO’s concerns.  I think it underscores the need for this individual’s ability to connect the dots, to see across the interdependencies and seek out the weaknesses in our internal controls.  Many of those controls are either owned or heavily influenced by your organizations.”

CIO: “As we have gone around the table, I have to admit that I’m coming to the conclusion that this function should be independent.  What about you Marilyn?”

HR: “I’d share that with the assurance that this job be filled by a proven professional who can develop respect for the function and influence our managers on stewardship and commitment to doing the right thing.”

CIO: “I’d echo that with the suggestion that we form some sort of multi-disciplinary security committee chaired by security.  It seems to me that this would provide some assurance that we are all working on the same agenda with regard to risk management.”

CEO: “How would Counsel summarize this debate?”

Chief Counsel: “I agree. I would also add that we need to bring Facilities into the solution inasmuch as the physical security elements are key to an integrated corporate security program.  I think we all accept the need for a Chief Security Officer position.  The question on the table now is to whom should this CSO position report?”

COO:  “Right, and what functions should report to the CSO?”

_______________________________________________________________

What do you think? We encourage readers of Faculty Advisor to send their feedback.

Food for thought:

What important points on their behalf did either HR or IT fail to make?
Are there any important competencies for this position that were not mentioned?
Would you recommend that the information security program remain under the CIO or should it be converged within the new security department?
If you were the CEO, what was the most compelling point to influence your decision?

To whom do you think the security executive position should report and why?
• Admin
• Executive
• Facilities / Real Estate
• Finance
• HR
• Info / IT / Technology
• Legal
• Shared Services
• Other

Scenario compiled and written by George Campbell, Security Executive Council Emeritus Faculty

Aligning Your Awareness Program With Business Goals

Q.  I have a security awareness program in place but am unsure it's all it can be. In your experience, how did you determine which risks to build the program around? Which awareness initiatives provided the greatest value overall to the company? How did you test effectiveness? How did you get senior management's buy-in for those initiatives?

A. One of the best ways to answer these questions is to discuss them with senior management in each business segment of your company.  Determining risks will require an examination of your company's business plan, identifying the most significant assets and deciding which issue or loss would do the most damage to your brand name.  Gaining the participation of business segment managers will not only help you focus your limited resources in the most productive direction, but will assist in developing business focused partnerships to help ensure the long term success of your security program.  Keep in mind the security awareness program is for the employees/associates and should address their perceived needs.

Let's use travel security as an example as a risk your company has determined as one that requires an awareness program because the company’s greatest  asset is  employees/associates and the greatest threat to employees/associates occurs while traveling on company business.  The focus would be to develop an awareness program around travel security to help employees/associates to be aware of potential risks and to recommended proactive methodology.  Addressing the basics is the best approach for a travel awareness program.  This would obviously include awareness of surroundings, avoiding certain areas or events, and so on.  However, even with the most well thought out awareness programs undesirable events can still occur.  Your awareness program should include recommendations for post event actions to expedite recovery and minimize business disruption.

The issues to address in an awareness program are often beyond the control of your company.  In our example, a medical emergency in a third-world country could result in business disruption for the company and significant stress for the employee's family. This may require coordination with or a request for assistance from other private entities or government organizations.  Examining your awareness program to ensure proper recommendations for appropriate actions for an unforeseen event beyond your control will assist in management and employee acceptance - an initiative that provides the greatest overall value for the company and the employee.

Your travel security program will obviously be more detailed when focusing on senior management travel awareness.  This may include, but not be limited to, pre-travel briefings, on site assistance, vetting outsourced assistance provided and other special resources needed.

Choosing the most effective method of communicating your awareness program will help ensure acceptance and positive results.  This may be through an inter-company security website with links to external security resources (for example, OSAC and/or a contract security intelligence vendor).  Posters, bulletin board notices and inter-company memorandums are also productive communications tools.  An effective method of communicating your program and its benefits to the traveling employee is to hold employee awareness sessions. 

An efficient approach to gain senior management approval is to receive a copy of the individual travel itinerary for every employee traveling outside the country on company business at the time the ticket is issued.  Sending a well thought out security awareness program document and offering individual briefings to each of these travelers will certainly enhance your program, its acceptance and its effectiveness.

The best way to test effectiveness of your program is to communicate with those who have received and used the awareness program.  Sometimes called an "after action review," interviewing employees who have traveled on company business may be helpful.  Employees who have actually received the awareness program and utilized the information provided can be your best test of effectiveness and will assist in improving your product.

The above considerations are generic in nature and are not intended to be the panacea.  Each company has its own culture and specific manner for processing and managing programs.  These considerations are intended to be food for thought as you develop and grow your security awareness program.

Answer provided by Randy Uzzell, Security Executive Council Emeritus Faculty.

New to Organization

Q. I was just hired as the security director and I want to hit the ground running to learn the internal workings of the business.  How do I do that quickly? 

A. Learning the business is going to require you to put in a lot of hours doing things that you may not have considered.  Things like:
- Reading annual reports and 10k’s for the last 5 years
- Getting yourself invited sit in on key staff meetings between executives and senior operational leaders and their direct staffs so you can hear first hand the business issues they are facing
- Arrange visits – through the auspices of the Chairman, CEO, or other senior leader – for visits to all senior leaders, or at least a significant cross sampling of key business facilities.

This should get you started.

Answer supplied by J. David Quilter, Security Executive Council Emeritus Faculty

Editor's note: David is writing a book on this topic and related security leadership issues. Look for it on the Council's website in 2008.