Successful Security Assessments Conclude With Live Presentations…
If your firm provides outsourced IT services, or security-related products and services, then you know that assessments are often the first step in landing new business.
However, if you take the time to measure your actual business-drag, you may find it less than stellar.
The fact is, most security assessments don’t lead to additional business…They should, but they don’t. Why? Because most security assessment leave out this one vital step…
…Live delivery to ASSET OWNERS.
(Find out more about asset owners and executive sales calls in The House & The Cloud – 2nd Edition)
Imagine a court case, where the evidence is presented in written technical reports…
No testimonies, no witnesses called…no emotional appeal, no angry outbursts or tears…just dry, unadulterated facts on paper.
How would this approach affect the decisions made on murder, rape, and other heinous crime cases?
Conversion & The Power of LIVE
There are three major people-groups you care about when performing a risk assessment: Information Technology (IT), End-Users (or Business-Level Asset Owners), and CIO/CISOs (Or anyone in the C-Suite).
All three groups must be moved to action, but each has different needs and will respond to different messaging. The one thing they all have in common is, emotion. In the end, all sales are emotional decisions. Crafting the right message for each is essential…
However, before going into the message, it’s important that we understand delivery and the power of live…(The media).
Reports are important. They provide the details behind what you present. However, they often go unread. Think of them as supporting documentation.
Like in a legal battle, it’s the LIVE testimonies that carry the weight. And the testimony of an eye witness is the most powerful testimony that jury will hear. Take the emotionally charged live testimony away, and you’ll see a much different outcome.
Delivering your results in person, to the right people, with the right message, can take your Assessment-To-Remediation conversion from 15% to 60% or 80% overnight…let’s take a look.
What Matters Most
Businesses have a need to measure their risk. Especially right now, as companies work to streamline operations, eliminate waste, and build stronger customer bonds in a highly competitive, global market…
New technologies offer amazing opportunities, while at the same time open major holes in the firm’s security architecture.
What matters most? Intelligence…insight.
Where is the data? Who has access? What are the relevant threats to that business? What are they odds something will happen? Can they recover in time if something does happen? Or would they know in time to stop a disaster? These questions must be answered…
However, not all constituents have the same concerns or the same questions…
IT Care-Abouts
What does IT care about? I’m sure there are dozens of opinions out there. The opinion of C-Level Executives I’ve interviewed over the past year suggests that IT personnel are out of touch with business requirements and missions critical systems. So at the least, IT’s view of risk will be misaligned with the business in question.
It’s also my opinion (After having managed IT for a global bank, and working in IT for a global pharmaceuticals manufacturer) IT personnel are more concerned with their actual position, career opportunity, and life-work balance, than they are the risk-measurements of their employer.
So, while the details of security technology are of great interest, the actual impact of an attack has little long-term affect on the IT worker.
Even if they lose their job (which is unlikely), their personal brand and reputation only stand to blossom as they respond to an actual event.
Consider the following: If attacked, they now have actual cyber-forensics experience listed on their resume (even if they didn’t personally save the day). The blame will go to those who didn’t approve IT’s most recent recommendations / budget requests. The CIO will be front page news, not IT…
So what does IT care about when it comes to cybersecurity…answers vary by individual (of course)…but, on average, the seller can assume…
They care about the experience… The approach to assessing risk, the vulnerabilities, the technologies, and the potential for new next-gen security products and security controls.
Security represents the IT worker’s greatest job-upgrade opportunity.
End-User Care-Abouts
Asset Owners come in two flavors…executives and knowledge workers. Let’s look at the knowledge worker first. This is the person who creates and uses data to make money for the business. They’re asset owners because they are liable for their data.
Examples might include the investment banker working with wealthy clients, R&D looking at new cures for a disease other’s have not been able to stop, etc. Data is an asset – one The Wall Street Journal has called, the “Oil of The New Millennium”.
If this data were compromised, misused, or made unavailable for any reason, the Asset Owner would be out of business, at least for the short term. And any sort of outage would cost them personally and professionally.
CISO/CIO Care-Abouts
The third group, also an asset owner, is the C-Level (CIO/CISO). This group is much like the End-User Asset Owner…shareholder value is important here. The CISO, according to my recent CISO interviews, finally has a seat at the table. And they must earn it every day.
What’s the CISO’s job?
The CISO translates risk and compliance from technical to business. Great CISOs create awareness based on data coming from IT workers and your assessments.
The closer your report delivers relevant data in executive terms, the more likely they will be successful in their role. In summary (from my book, The House & The Cloud Pg. 195), the CISO is looking for their top 3 to 5 threats, the impact associated with each, and the odds that any one of them will be realized.
It will up to the CISO to report the trends and present a plan to keep the company at an acceptable level of risk. Note, the CISO won’t have this intel in their head – they’ll need subject matter experts.
But as I’ve already stated, IT is ill-equipped and unlikely to add any real value to this plan, given their disconnect with the business side (Straight from the CIOs mouth…).
Next time you assess…include the knowledge workers, interview the execs, and schedule up front, your delivery meetings with asset owners in mind.
© 2017, David Stelzl
High Tech Business Growth 