LICENSED FOR INDIVIDUAL USE ONLY A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics by Jinan Budge January 9, 2020 Why Read This Report Key Takeaways Cybersecurity is getting ever more scrutiny from boards, execs, and customers. Many CISOs need to launch large change programs to transform their cybersecurity capabilities amidst unprecedented organizational, technical, and business complexity. As these change programs may be larger than anything the CISO has driven to date, it’s essential to have a clear plan and committed sponsors so you can seize the opportunity when it comes and deliver. This report helps you identify, align with, and influence critical stakeholders whose support you’ll need to embark on change programs. Feed Your Supporters And Manage Your Detractors You can have the best strategy in the world, but it will go nowhere unless you feed your supporters and manage your detractors. This an update of a previously published report; Forrester reviews and updates it periodically for continued relevance and accuracy. Politics Can Be Done Ethically, And It’s Your Greatest Opportunity Stop seeing politics as a necessary evil. Done correctly, ethically, and with dignity, politics is your opportunity to listen to different perspectives and take people on the journey with you. Decide To Be An Executive, Not A Techie You have a choice: Continue down the technical path or shift gears and become a business leader. If you choose to be a leader, you’ll find that vision, personal courage, and effective communication are more crucial than ever to drive change in the business. This PDF is only licensed for individual use when downloaded from forrester.com or reprints.forrester.com. All other distribution prohibited. FORRESTER.COM FOR SECURITY & RISK PROFESSIONALS A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics by Jinan Budge with Joseph Blankenship, Seles Sebastin, and Bill Nagel January 9, 2020 Table Of Contents 2 CISOs Are Unprepared For Implementing Large-Scale Change Cybersecurity Change Requires More Than Technical Knowledge 4 Successful Change Requires The 3 P’s: People, Process, And Politics Related Research Documents How To Talk To Your Board About Cybersecurity Instill A Security Culture By Elevating Communication Top Recommendations For Your Security Program, 2019 Transform Your Cybersecurity Capability Feed Your Supporters And Manage Your Detractors Embrace Politics For What It Is: An Opportunity To Understand And Engage People 8 Be A Leader Of Change First And Foremost, A Technician Second Share reports with colleagues. Enhance your membership with Research Share. What It Means 10 “Being Political” Does Not Mean “Backstabbing” 11 Supplemental Material Forrester Research, Inc., 60 Acorn Park Drive, Cambridge, MA 02140 USA +1 617-613-6000 | Fax: +1 617-613-5000 | forrester.com © 2020 Forrester Research, Inc. Opinions reflect judgment at the time and are subject to change. Forrester®, Technographics®, Forrester Wave, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. Unauthorized copying or distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378 FOR SECURITY & RISK PROFESSIONALS January 9, 2020 A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics CISOs Are Unprepared For Implementing Large-Scale Change Security pros are heading into an intensifying storm where both the infrastructure they secure and threats to that infrastructure are getting more complex. Businesses’ digitization efforts introduce complexity even as customers expect companies to better protect their data. In this new normal, the old way of running security — as the department of “No,” as an IT issue, or as a siloed function that represents itself with locks and keys — is long gone.1 Security is garnering increased attention and scrutiny because: ›› Cybersecurity is a recognized business issue. Business leaders now see cybersecurity as fashionable, significantly raising the issue’s profile internally. ›› Consumers demand trust. Your customers want to trust you before they engage with you. Forrester data shows that 23% of US online adults are Skeptical Protectionists who are very informed about and concerned with privacy and highly skeptical that companies — especially social networks and media firms — will keep their information secure.2 ›› Cyberattacks have a significant business impact. More than ever, attacks have the potential to cripple business, endanger customers, and crush strategy. Cybersecurity Change Requires More Than Technical Knowledge In the midst of this complex landscape, CISOs are running significant initiatives including cloud migration; Zero Trust architecture; technology upgrades; proactive threat hunting; and insider threat, digital identity, and security awareness programs. Far from being purely technology programs, these initiatives require a fair dose of people, process, oversight, and technology knowledge. As CISOs seek to transform security, they must fundamentally change the way security has been operating and ensure that it is an embedded and holistic function (see Figure 1). The opportunity to implement broad change in an organization doesn’t come along frequently and requires a new breed of skills. Yet many CISOs are caught unaware of the intricacies of organizational change and are faced with: ›› Dealing with complexity. Most organizations are being digitized in some form — a process that is disrupting entire industries. In some markets, retirement funds have had to deal with digitally native, direct-to-customer offerings that are far more streamlined, free of legalese, and which make it easier to take out a policy. The pace of digitization and disruption has organizations moving rapidly and shifting to agile ways of working. CISOs have to keep up with this complexity, engaging and understanding business dynamics in unfamiliar ways. Compounding this problem are two top challenges for CISOs: the changing nature of IT threats and the complexity of the IT environment.3 ›› Responding to tactical requests. Security leaders have historically been technicians attending to low-level tactical requests and responding to audit findings or breaches. CISOs’ immersion in a sea of tactical considerations have left them unable to take a step back and think strategically, let alone implement significant changes. In a Forrester survey, 25% of security decision makers reported that day-to-day tactical activities taking up too much time is a significant IT security challenge.4 © 2020 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378 2 FOR SECURITY & RISK PROFESSIONALS January 9, 2020 A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics “After a data breach, the organization commissioned three consulting firms to review us, some without my involvement. My small team ended up responding to 68 recommendations. These tactical activities consumed all of our resources.” (CISO) ›› Addressing security’s image problem. While security has finally emerged as a crucial topic for boards, CIOs, and business leaders, don’t mistake awareness for understanding. Decades of alienating the business mean that it still sees security teams as a roadblock. As Robert Carey, VP and GM of global public sector solutions at RSA, told us: “The perception is that security is an impediment and the bane of convenience.” This makes change efforts difficult, as CISOs grapple to correctly position security as a business enabler and their teams as change agents. ›› Avoiding politics — to their disadvantage. Security pros are generally busy protecting the organization from bad actors and see politics as ugly and unnecessary. Some lack charisma or confidence or are shy, technically focused, or impatient with nontechnologists. Security pros’ reluctance to engage in positive politics has put CISOs in a position where they cannot influence key business decisions. “Politics is a dirty word because you see the politicians on TV and the image they create. Even the political environment we have around us is very negative, and it is about pulling people down.” (Chief risk officer, financial institution) ›› Managing security detractors. Change is uncomfortable for most people. This discomfort exposes detractors who continuously try to impede progress. CISOs are surprised by this criticism and who it’s coming from. They take detractors’ actions personally instead of acknowledging that they are a natural part of change. You may have inherited a team that’s been there for a long time and wants to maintain the status quo; the business may be afraid of having to do things it doesn’t want to do; or IT may feel exposed after years of neglect. Detractors can come at you from anywhere in the organization, including your own team — taking up a lot of your energy, slowing progress, and at times undermining your efforts. “In security, the key detractors don’t tend to be senior executives. They’re generally supportive because they have direct interaction with the board and audit and risk committee.” (Sheridan Ware, chief information and technology officer, Charter Hall) © 2020 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378 3 FOR SECURITY & RISK PROFESSIONALS January 9, 2020 A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics FIGURE 1 Cybersecurity Change Requires More Than Technical Knowledge From To A technical IT problem An issue of customer trust “No, you can’t.” “Yes, and . . . ” Technically focused Holistic concern for people, process, and technology Sitting in the basement Engaged with the business Lock and key Freedom and agility Siloed Embedded Successful Change Requires The 3 P’s: People, Process, And Politics Excelling at security transformation requires leadership, business insight, and people skills, supported by drive, determination, and pragmatism. But remember that you can’t do it alone. You will need a significant amount of momentum and preparation. To create that momentum and prepare your organization to accept the change programs you are implementing, you need to address the most challenging element of any strategic delivery: people. Feed Your Supporters And Manage Your Detractors You can have the best strategy in the world, but you’ll go nowhere unless you’re able to execute it. Executing your strategy requires not only technical and staffing components, but also convincing many different stakeholders to go on the journey with you or at least support your journey. Change introduces detractors, who introduce a lot of noise, which is distracting, consumes a lot of energy, and can slow down or block your progress. Your key to success is to manage your detractors and feed your sponsors. Do this methodically by: ›› Identifying the key players. Before taking any action, ensure that you have a clear idea of who needs to be on board with the strategy and what role they may assume in the approval, delivery, and maintenance of the plan. Take time to develop a deep understanding of each player’s perspective and their role in your transformation. Plan your actions using seven key personas (see Figure 2). ›› Preparing the ground. Culture change happens one conversation at a time, so plant the seed of the need for change and its potential benefits early. Work to understand the remit of each of your stakeholders and their level of awareness of and support for security. Your CFO will be much more concerned about financial impact of your program, whereas your CEO will want to understand the © 2020 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378 4 FOR SECURITY & RISK PROFESSIONALS January 9, 2020 A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics risks and the impact of security on customer trust. These are different conversations, so have them separately. Depending on their level of awareness, you may need to have one or more socialization meetings with them. Don’t surprise stakeholders with a strategy document without going through a methodical socialization process. Socializing your strategy and gaining buy-in early will position you as an insightful, business-conscious leader with a compelling strategy. ›› Growing, learning, and turning criticism into a solution. Paradoxically, you will improve your chances of influencing and persuading your constituents more by listening to them than by talking at them. “The most powerful tool when you rise to the level of CIO is that you know that you don’t know everything and to listen. Being able to listen allows you to integrate all these thoughts and reach a decision that is effective for the organization.” (Robert Carey, VP and GM of global public sector solutions, RSA) “Be open to not always being right and having a growth mindset. I don’t have all the answers, and actually that gives me freedom to ask questions and adapt solutions to our various stakeholders.” (Sheridan Ware, chief information and technology officer, Charter Hall) © 2020 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378 5 FOR SECURITY & RISK PROFESSIONALS January 9, 2020 A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics FIGURE 2 Identifying The Key Players Player Description Example The leader Ultimate decision points CEO Influencers Have influence over senior people and can bring them on board by vocally advocating your plans. Lose engagement here and support may fall away rapidly. CRO, chief people officer, COO, audit, CIO Visionaries In any organization, certain individuals are responsible for the future vision of the enterprise. Ensure that your strategy aligns with their long-term vision, or your plans may fall at the first hurdle. CMO, head of transformation Champions The role that will publicly support this strategy and defend it in high-level meetings. CIO, heads of business Budget holder The person who holds the budget that will fund the transformation. CIO The team The individual or team that will maintain the process or technology once deployed. Dissent at this level could seriously undermine the value delivered despite a perfect implementation. Operational business and technology teams The security leader The person who can realize this strategy and maintain momentum until it is fully implemented. CISO, program director Budget approver The person who controls the entire organization’s finances and will ultimately approve the funding for this program. CFO Embrace Politics For What It Is: An Opportunity To Understand And Engage People It’s essential to understand how people at different levels are likely to react to the strategy and steer them toward the correct outcome once you present it for consideration. If this seems like politics to you, you’re right! But you must realize that, in a corporate environment, politics is not an optional activity. People play politics every time they send an email or chat at the water cooler, so get with the program. To use politics to your advantage, you need to: ›› Turn internal politics into your greatest opportunity. Many successful business leaders have evolved to see politics not only as a necessary evil in business; they also see it as an opportunity to understand and engage. © 2020 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378 6 FOR SECURITY & RISK PROFESSIONALS January 9, 2020 A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics “For me, politics is an opportunity. If you understand what people are actually saying as part of raising their comments, and you take that as an opportunity to turn their concern into a solution, it becomes a different conversation.” (Chief risk officer, financial institution) ›› Use the art of persuasion to build influence. As a leader, you need to ask the right questions to influence, and this requires exceptional articulation. And take care: Persuasion isn’t the “begging on your knees” type of influence that some managers resort to. This is professional political maneuvering at its finest that, even if exposed, is ethical and acceptable (see Figure 3). ›› Sit down and listen without judgement. Politics goes awry when you stop listening to other perspectives and offer your opinion without considering the other party’s. As the business classic The 7 Habits of Highly Effective People notes, “Seek first to understand, then to be understood.”5 This doesn’t happen by accident. You need to practice the fine art of listening to understand where your stakeholders are coming from. Once you have that understanding, spend time working through their issues with your team, distinguish fact from fiction, and come back with a solution. FIGURE 3 Utilize Your Persuasion And Influence Toolkit To Persuade And Influence Tool How to use this tool Collective momentum Socialize the security vision, strategy, and change program and build momentum so that when it’s formally presented you can list the engaged sponsors. Authority Influence from the top down for the greatest effectiveness. If the CEO believes something, most other staff will immediately fall in line. Mutual exchange If you provide a service, resource, or assistance to a potential sponsor over and above that required from your job role, you will build up goodwill, which may be repayable when you need it. Scarcity Use this carefully, as repetition will undermine its value. Valid and externally imposed time or resource limits, such as a regulatory deadline or vendor discount, can initiate actions that may otherwise have languished. Foresight Keep your sponsors briefed, even if that brief is that the future will be difficult. They would rather face a bad outcome than uncertainty. Relationship Build a positive relationship with the key players ahead of time and highlight commonalities. When the time comes, this relationship will influence the response. © 2020 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378 7 FOR SECURITY & RISK PROFESSIONALS January 9, 2020 A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics Be A Leader Of Change First And Foremost, A Technician Second The pace of the change you’re embarking on will be relentless, and your technical and security skills are not what will get you through. As transformation speaker, author, and facilitator Julia Steel told us: “CISOs need to have an honest conversation with themselves: Do you want to be a leader or a security expert? If you want to be a leader, then you need to invest in leadership skills.” Be clear about your role as a leader and what it means. There are many lessons you can learn from people in other professions who have gone on similar change journeys. When leading a transformation: ›› Sharpen your skills by engaging support. Becoming a leader means that you may need to develop skills that are unfamiliar to you. To do this, you will require support from mentors, executive coaches, and sponsors. These supporting roles mean very different things; you may engage one or more of them depending on the support that you need (see Figure 4). ›› Create a strong following within your team. CISOs need to reach everyone from the CEO to individuals in the security operations center. Managing upward is not enough; security leaders also need to manage laterally. Build your team’s capabilities so you don’t always have to be the leader. You’ll need to take a vacation at some point — so empower your team by following them. You also need your team to advocate for you as a person and CISO and be a change agent in the same way that you are. To create this positive internal culture, mentor and work with your team by giving them examples of how things can work. Provide instructional coaching about specific situations. ›› Manage your mental health to avoid burnout. All leaders experience stress, which they need to manage. You’re likely to feel the pressure of expectations. Perhaps you don’t feel trusted, constantly deal with detractors, or have to continuously work to placate people. As an executive, you have to perform at a high level in the face of all of this. In “The Making of a Corporate Athlete,” researchers addressed the role of the body, emotions, mind, and spirit in high performance.6 Invest in self-care, exercise, healthy eating, and other activities to reach your ideal performance state. “There is a productive level of stress where you’re energized and positively challenged by what you’re doing, but not overwhelmed. That’s the level you have to hold on to,” (Sheridan Ware, chief information and technology officer, Charter Hall) ›› Build your communication and public speaking skills. You need to master talking to your board about cybersecurity and building trust with its members. This isn’t just about crafting the perfect presentation; it’s about creating dialogue and trust with this important stakeholder group.7 You don’t want your first board presentation to be the first time you’ve spoken in public. Being a CISO is a high-profile role with many outward-facing duties, even if those duties are confined to your organization. You need communication skills to persuade an audience to act or adopt a point of view. Seek the appropriate presentation skills coaching and courses to learn these valuable skills — and practice. © 2020 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378 8 FOR SECURITY & RISK PROFESSIONALS January 9, 2020 A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics ›› Recruit change management resources. You need to recruit people to spearhead change management on your team and be instrumental in overcoming organizational challenges. They need expertise in organizational behavior and developing change and communications plans. In particular, security teams at $1 billion-plus companies are large enough to require these individuals — permanently. As Julia Steel told us: “I’m amazed at how many security programs don’t have some element of change. These resources are critical to the success of any program, and even more so for security.” Strive to make everyone on the team a change agent; quash toxic negative security behaviors by creating clear performance metrics, modeling positive security behavior, and promptly managing bad behavior. FIGURE 4 Distinguish The Different Types Of Leadership Support That You Need Executive coach Mentor Someone you can learn from and has more experience than you in the area in which you want mentoring. Use formal programs inside or outside of your workplace to look for mentors who are interested in engaging in a mentor/mentee relationship. Someone who can help you home in on specific areas of development such as personal resilience, public speaking, or work/life integration. Look for recommendations from your network to find someone who has demonstrated competence in your chosen area. Sponsor Someone in the organization who is responsible for promoting and guiding you through the organization. This person doesn’t come easily; look for someone who understands and believes in your capabilities. Don’t be shy; you need to be forward and ask for this level of sponsorship. © 2020 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378 9 FOR SECURITY & RISK PROFESSIONALS January 9, 2020 A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics What It Means “Being Political” Does Not Mean “Backstabbing” Change happens all the time, everywhere, whether you notice it or not. This leaves the CISO with a simple choice: Drive change or follow it. Within the next 18 to 24 months, an increasing number of CISOs will have the opportunity to shape their own future by transforming cybersecurity within their organization. While office politics has occasional flashes of brutality and deceit, it’s possible to play the game in an ethical and dignified manner. To play politics effectively, you have to: ›› Understand that everything comes downs to human interaction. CISOs with ambitions for a better future must reach out to key players and correctly position both themselves and their vision. By its nature, politics is all about people, and neither humans nor their behavior are always rational. Rational decision making is simple, but political decision making requires taking personalities, feelings, and other external factors into account. ›› Decide if you’re primarily a leader or a techie. Ask yourself how much of your current success is a result of your technical knowledge and how much is the result of your ability to collaborate and persuade. Think how that will change as your role develops further. With breaches occurring at unprecedented levels, you will inevitably be required to lead your team through a crisis. You’ll need to stand up as a leader, not hunker down behind a keyboard. ›› Build relationships with open hearts, minds, and ears. Approach your relationships up, down, across, and outside of your organization with questions that are designed to address basic human needs. This is all about humans and appealing to their needs. Changing the culture of security doesn’t happen by accident; nor does it happen by buying an awareness tool. Culture change happens one conversation and relationship at a time. If you wish to seize the opportunity to reinvent security when it eventually arises, start building those relationships now — it will serve your career well, and you can leave the dagger and poison at home. © 2020 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378 10 FOR SECURITY & RISK PROFESSIONALS January 9, 2020 A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics Engage With An Analyst Gain greater confidence in your decisions by working with Forrester thought leaders to apply our research to your specific business and technology initiatives. Analyst Inquiry Analyst Advisory Webinar To help you put research into practice, connect with an analyst to discuss your questions in a 30-minute phone session — or opt for a response via email. Translate research into action by working with an analyst on a specific engagement in the form of custom strategy sessions, workshops, or speeches. Join our online sessions on the latest research affecting your business. Each call includes analyst Q&A and slides and is available on-demand. Learn more. Learn more. Learn more. Forrester’s research apps for iOS and Android. Stay ahead of your competition no matter where you are. Supplemental Material Companies Interviewed For This Report We would like to thank the individuals from the following companies who generously gave their time during the research for this report. Charter Hall RSA A large Australian bank Endnotes 1 See the Forrester report “Transform Your Cybersecurity Capability.” 2 Source: Forrester Analytics Consumer Technographics® North American Online Benchmark Survey (Part 2), 2019. See the Forrester report “Understand Your Customers To Build Trust: Forrester’s 2019 Consumer Privacy Segmentation.” © 2020 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378 11 FOR SECURITY & RISK PROFESSIONALS January 9, 2020 A CISO’s Guide To Successfully Leading Change How To Build Support, Manage Detractors, And Navigate Politics 3 We asked 3,890 security decision makers to select the biggest information or IT security challenges facing their firm. At 34%, the changing or evolving nature of internal and external IT threats was the answer chosen most often, followed by 31% who chose the complexity of their IT environment. Source: Forrester Analytics Global Business Technographics Security Survey, 2019. 4 Source: Forrester Analytics Global Business Technographics Security Survey, 2019. 5 Source: Stephen R. Covey, The 7 Habits of Highly Effective People, Free Press, 1989. 6 Source: Jim Loehr and Tony Schwartz, “The Making of a Corporate Athlete,” Harvard Business Review, January 2001 (https://hbr.org/2001/01/the-making-of-a-corporate-athlete). 7 See the Forrester report “How To Talk To Your Board About Cybersecurity.” © 2020 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378 12 We work with business and technology leaders to develop customer-obsessed strategies that drive growth. PRODUCTS AND SERVICES ›› ›› ›› ›› ›› ›› Core research and tools Data and analytics Peer collaboration Analyst engagement Consulting Events Forrester’s research and insights are tailored to your role and critical business initiatives. ROLES WE SERVE Marketing & Strategy Professionals CMO B2B Marketing B2C Marketing Customer Experience Customer Insights eBusiness & Channel Strategy Technology Management Professionals CIO Application Development & Delivery Enterprise Architecture Infrastructure & Operations ›› Security & Risk Sourcing & Vendor Management Technology Industry Professionals Analyst Relations CLIENT SUPPORT For information on hard-copy or electronic reprints, please contact Client Support at +1 866-367-7378, +1 617-613-5730, or clientsupport@forrester.com. We offer quantity discounts and special pricing for academic and nonprofit institutions. Forrester Research (Nasdaq: FORR) is one of the most influential research and advisory firms in the world. We work with business and technology leaders to develop customer-obsessed strategies that drive growth. Through proprietary research, data, custom consulting, exclusive executive peer groups, and events, the Forrester experience is about a singular and powerful purpose: to challenge the thinking of our clients to help them lead change in their organizations. 61489 For more information, visit forrester.com.
