The first step to successfully securing your business. Your Challenge A security risk management process, in conjunction with an overall Enterprise Risk Management (ERM) strategy, is the first step in truly getting proactive about protecting your assets. Today’s threat landscape is too unpredictable not to have a plan in place. Security risk management does not always require third-party consultants. It can be done in-house if you invest the time. Our Advice Critical Insight Once you identify your risks, you can make better spending choices instead of attempting to do too much and over-engineering your security portfolio, or underestimating and under-engineering it. Knowing the big picture helps you align with business goals more succinctly. Transparency in security practices are becoming more of a requirement for customers so having a comprehensive program can create competitive advantage. Impact and Result Develop a comprehensive plan for assessing risks without getting lost in the weeds. Minimize unnecessary spend and maximize cost effectiveness by establishing a risk mitigation roadmap and focusing on the truly important issues. Establishing successful strategies for properly communicating the program and its results with key stakeholders to continue fostering the integration of risk management into overall business practices.

1. Adopt Organizational Change Management Best Practices
Don’t let bad change happen to good projects.
You are starting a project or program that will depend on users and stakeholders to give up their old
way of doing things. In some cases change will force people to become novices again, leading to lost
productivity and added stress.
IT projects are justified because they will make money, save money, or make people happier, etc.
Without managing organizational change, IT might get the project done, but fail to achieve the intended
benefits.
Organizational change must be planned in advance and managed through all project phases.
Organizational change management must be embedded as a key aspect throughout the project, not
merely a set of tactics added to execution phases.
Agility and continuous improvement are good, but can degenerate into volatility if change isn’t
managed properly. People will perceive change to be volatile and undesirable if their expectations aren’t
managed through communications and engagement planning.
Failures in change management would typically be foreseen if only the project/change manager has
considered the full range of impact. Instead we hear, “I hadn’t thought of the multiple time zones as an
issue”, “we didn’t realize that the pricing was different in the west”, etc.
Resistance to change is commonly provided by people who are upset about not being involved in the
communication. Missed opportunities are the same: they usually could have been provided easily had
somebody known in time.
Project and change management has traditionally focused on a defensive posture because organizations
so often fail to mitigate risk. Good change managers also watch for opportunities to improve and exploit
the outcomes of the change.
Change is an ongoing process. Your approach to managing change should be continually refined to keep
up with changes in technology, corporate strategy, and people involved.