MSP Evaluation: Strategy Execution

Can a robust and effective cyber security capability create new value for your business; new value proposition for customers or other competitive advantages resulting from operational velcoity? Most of us are doubtful that this is possible because cyber has traditionally been viewed as a cost center and not a profit lever. We’ve historically viewed cyber and IT in a support role/function (vs a core function) that’s somewhat necessary for doing business. 

However, in the digital economy, cyber and IT are no longer support functions but are core to the business. Some organizations have not made this shift in mindset yet and understandably so. Because it’s not easy to change mindsets unless there’s a compelling event that forces us in the direction of the mindset change that we should have found ourselves (i.e. absent the event). 

Yet there’s a significant benefit if we can make this change from cost-center to profit level without experiencing a compelling event (e.g. data breach, material incident, new regulation, etc.) To implement this change in mindset we’ve outlined some foundational principles and philosophies that are worth considering 

Mindset: Out of a single mindset flows a thousand different behaviors. If you view IT and cyber as something to keep the lights on then its difficult to see the opportunities it has to make material contributions to the bottom line. Recognizing that this shift needs to happen is the first step and it begins with the CEO. The CIO and CISO can help but ultimately the CEO has to sustain this perspective for the long-term benefits to be realized

Relationships: currently one-way relationships now for the most part meaning, IT and cyber speak business terms or engage in the business. In some instances, cyber is in reactive mode waiting for IT and business decisions and then implementing cyber practices after the fact. Some cyber chiefs are brought into the conversation at the end of a major business decision (e.g. M&A, business strategy planning). Proactive relationships where both business and cyber are engaged proactively in learning about each other, their respective roles, opportunities and challenges, This should be a two-way street and not just cyber learning about the business but also the business learning about cyber; not to become a cyber expert but to understand the implications of various cyber functions and to be conversationally literate and fluent in the language. Confident to engage but not so much to teach unless interested. 

Develop learning strategies

Apply growth mindset and principles to the challenge

Implement new value shifts and leadership transitions 

Model the mindset for other members of the leadership team and even the board

Invest in yourself and future growth and development - digital is here to stay and so is cyber. It’s not going away. 

There are different elements of strategic value creation for businesses and these include: 

New revenue-creation opportunities

Cost efficiences

Operational Speed

Consumer/Customer trust 

 Mexico trip analogy - 

Unfortunately, my perception of Mexico city had been influenced by reports of violent drug cartels and stories of kidnappings so I was mentally resigned to not visiting the city. And I didn’t see a need to either until I was presented with an opportunity to help a client and was told I needed to visit Mexico city and/or Merida. At first I said no but my client reassured me that they would ensure my safety. I ended up visiting and it was a great experience. As a result, we have new client/customers that we otherwise wouldn’t have without the security offered by my first client. Likewise cyber security does the same thing. 

Competitive 

Mindsets and principles 

Cultivate business relationships proactively. Requires value shifts and trust building 

Create value for relevant stake holders. A give mindset and not a stop or take (things away) mindset 

Out of a single mindset, flows a thousand different behaviors 

Values influence mindsets