These are unprecedented times.

Technology and Security Leaders aren’t catching a break.  To keep up with expectations, CISOs and Tech Leaders: Review and self-assess Your Roadmap. Don’t wait to be asked. And no, it’s not too soon. We share more on the details, the structure and the expectations in the click-able mindmap (down below!).

As corporations rethink their strategic direction given the various economic and market forces; CISOs, CIOs and Technology leaders should also be rethinking their program’s direction. Sure, you could hire a consultant to do this to you (and we’d be happy to answer that call). You could also talk to your peers and see what they’re doing and follow suit. However, you’ll be most successful if you take ownership of the process, analysis and reframing. Trust me. Trust yourself.

Use this mindmap as a guide to uncover the key questions to consider as you re-assess your Strategic Plan. When looking at the mindmap, use it as a ‘dialogue’ – so go slowly, zoom in, click around, and spend time considering each area. If it feels like ‘too much’ – then read more of this post – down below the mindmap for focus.

Included, we also share general market direction and specific actions to consider.  Don’t be surprised if you are inclined to revise your (recently published) roadmap. That’s appropriate. Also don’t be surprised if you feel stuck.  Scrolling further down this page, below the mindmap, we share the ‘outline’

Let’s Get Started

Do You Have a Tech Risk Committee?

If not, start here. Your Tech Risk Committee is the way you create an ongoing dialogue with senior leaders.

• If you do, how’s it going?

 

Resource Constraints Are Everywhere – Work With It

Even budgeted and previously committed initiatives will not get funded and may lose planned investment. You can and should anticipate this.

• Where have you proactively identified opportunities for savings?

 

Are They Hearing Your Message?

And if not, are you sharing the right message?

• Remember this isn’t about what you’re saying, it’s about what they’re hearing.

 

Domains of Program Self-Assessment

The reality is, you’ll likely need to reprioritize resources and initiatives. This is ok. It should be aligned to the threat environment. And you should take an honest and critical look at how the overall “Acceptable Use of Technology” policy is adhered to and how well employees are onboarded.

Threat Landscape

You should be able to summarize the overall threat landscape. How has it evolved? And how is it manifesting for your company?

 

Audit and Compliance

Can you evidence compliance and are audits getting easier? If they aren’t – these are your roadblocks. No amount of investment will necessarily correct these things –  but they should be focused on.

 

Departmental Operations (Office of the CISO)

Is there a written departmental charter that defines the scope of the department and defines clearly key operations and expectations? is it current and is it serving the right purpose? Do you have a clear understanding of what messages go to whom and on what schedule? Are updates happening with the right cadence and in the right sequence? How do the teams operate within security? Are they collaborative? Is everyone ‘aligned?’ And if not, why not? Fix this.

 

Talent

Importantly, is the InfoSec team motivated to innovate? Do they have “vibe?” What occurs to further foster this? If you don’t have happy people motivating and supporting each other – no amount of resources will necessarily make it ‘work’ better. Fix this.

 

Where do you go from here? 

Use this flow as your executive update. Suggest self-prescribed revisions to your strategic plan based on your own self-assessment as a steward of the company.