If you’ve read the preceding installments of this series I hope you are well on your way to building effective relationships with your peers and other stakeholder organizations. Building quality relationships happens in small, gradual ways. When successful it’s done by building a history of small, strategic “a-ha” moments that demonstrate alignments and common goals.
Information Security and Business Development in some organizations can be equivalent to enemy camps. For Information Security, the Business Development team brings risky ventures to the table either just before go live or after go live – giving security little time or leverage to implement risk mitigations. Business Development may view Information Security as the wall of “No”. Developing and funding projects that will grow the business, increase revenue or reduce cost are hard enough without having to bring on board a security team that doesn’t seem to be motivated by revenue or profit targets. Business development always will have better funding and visibility than security – and rightly so. However, there are creative ways to find a place at the business development table.
- Demonstrate subject matter expertise - When you’re in a business development review – do you tell them what they did wrong – or do you help them do right? Showing the development team that you have the skills to help identify a quality service provider, develop service level agreements that save money, or build a robust RFP/RFI questionnaire that separates the winners from the losers, adds value and builds credibility.
- Educate about policy – We all know policy is important, but the business doesn’t look at it every day the way information security does. Make sure they know what policies will govern the installation of a new application, website, or service provider. Ensure the vendors know what the organization expects about password length and complexity, user access reporting requirements and activity logging. No one likes last minute surprises and the group that delays the go live date isn’t likely to be praised for being cautious.
- Navigate the bureaucracy – The software development team may or may not warn them about code and change freezes, secure code review requirements, systems development oversight boards, and other non-business facing approval processes. Informing your business partners in advance helps them build accurate project plans. Helping them complete those processes – not just directing them to a website or form – is the way to be seen as a valuable, contributing member of the team.
- Understand the business goal – Watch the eyes roll on the business development team when the security officer requests a process step that negates the entire purpose of the project. Knowing the reason for the project leads to higher quality mitigation recommendations, or helps clearly explain why the risks outweigh the benefit.
- Do your homework – I’ve seen far too many info sec teams who expect to be spoon fed project information. Expecting the business team and project managers to set up a meeting to brief you about the project sets the tone that you’ll be a burden to the project. Get access to the project documents and read the business justification, project charter, design specifications – everything you’ll need so you can ask intelligent, informed questions.
- Fish from the river – Relying on business development to notify you of projects that require information security involvement is a guaranteed path to failure. If possible get access to the process tools used to review and approve projects. Knowing which projects have been approved – or at least gotten through the initial qualification gate – helps you identify projects needing oversight and directs you to the business sponsor. Additionally, this sets the timeframe and defines proposed budget. No one wants to miss a step, but no one hits every step every time.
Business development managers are incented based on their ability to get products and services to market on time and on budget. Success has many parents – but failure is an orphan. No one may recall the development manager if the project fails after launch. Helping ensure that the project hits goals and milestones will create positive alignments. If delays must take place notify quickly and broadly, and explain clearly the risk/benefit decision behind it. Most importantly of all, remember that all successful businesses must continue to change and grow. Portraying yourself as a facilitator of success will earn you the seat at the business development table. Continuing to add value and help achieve goals will ensure that you stay there.