Security organizations both in the private and public sectors have made considerable progress in gaining stature. More and more senior security executives truly have a seat at the table today as a respected member of the C-suite. Many security executives regularly interface with the Board of Directors and maintain excellent relationships with board members. Security organizations still have a lot of room for improvement.
Smoke and Mirrors
Throughout the years, an incredible amount of effort by a broad range of true leaders have moved the security industry out of the old smoke and mirrors approach to security. In the past, very few security practitioners understood how to become engaged and aligned with the business and learn to speak the language of business. Most practitioners spoke about security in terms that were security-centric and not relevant to business. Few business leaders even understood what their security folks were saying. As a result, the security function was relegated to “out of sight – out of mind” or “we’ll call you when we need you.”
Currently there is a concerted effort underway to push Enterprise Security Risk Management (ESRM) as the newest concept for security practitioners to embrace. In my opinion, ESRM is being driven mainly by individuals and organizations as a revenue generation opportunity for themselves. I strongly urge security practitioners to reconsider embracing and adopting ESRM.
The Path Forward
The best way for security functions to be embraced by the C-suite is to align the security function with the business and focus on being relevant and adding value – that is how you gain the respect and support of your senior executives. Study your company’s strategic plan and the overall goals and objectives of the company. Learn as much as you can about your company’s business, its products, supply chain, channel partners, logistics and don’t forget about the company’s customer base. Learn all you can about the company’s competitors and the challenges the company faces in the marketplace. Spend time meeting with senior executives and key functional leaders to understand the challenges they face, and then focus on how security can assist each of those executives and functions. Just the fact that you show interest in the challenges they face and are focused on assisting them in finding creative mitigation solutions will go a long way in changing the perception about security’s value.
Rather than spending time and energy focusing on ESRM, invest in learning about enterprise risk management (ERM) and figure out how you can align the security function with ERM, which is a business management tool that transcends the entire enterprise. Security functions have a unique opportunity to become partners with the ERM function and perhaps even lead it. At last year’s Fall session of the Security 500, we had a session that provided a comparison of ESRM and ERM. Audience members overwhelmingly stated that they saw significantly more alignment with the business by focusing on ERM vs. adopting ESRM.
Security practitioners need to focus on learning the language of the business and becoming entrenched as a business partner. We can’t expect senior executives and functional leaders to learn another new “security-centric” language contained in ESRM... they don’t have the time or the interest and frankly won’t care. Become relevant to the business or risk being deemed redundant and unnecessary.
I look forward to hearing back from readers on their views about adapting to the business or retrenching to the old smoke and mirrors ways of the past.
