Information Security Blog

Information Security and Our Excellence Donut

It has been said “When it comes to achieving excellence, figuring out what needs to be done isn’t nearly as difficult as continuing to do what needs to be done over the long term.” A recent internal project illustrated this adage all too well.

As we continuously seek to improve the level of excellence of our professional services delivery a friend suggested we review ”Six Disciplines for Excellence” (a system intended to insure that an organization diligently executes on a well formed strategy). In reviewing the methodology, and considering its potential role to our services delivery function, it occurred to me that the methodology was also highly applicable to managing an Information Security Management System.

The system has Six Disciplines that are applied in a linear and continual cycle:

Decide What’s Important – Understand what your long term vision is and what your short term priorities are
Set Goals That Lead – Identify the initiatives and projects necessary to achieve your priorities and vision
Align Systems – Ensure the processes, policies, technologies, metrics, and people are aligned with your priorities and vision
Work the Plan – Execute on your priorities and vision
Innovate Purposefully – Learn and grow during the process
Step back – Based on internal change, external changes, and lessons learned revisit your performance. Now start over …

In thinking about how well we performed in each of these areas, I graded us as follows:

Decide What’s Important – B+
(We have a bunch of smart people that understand what we do — if we didn’t get myopic on occasion this would be an A)
Set Goals That Lead – B
(We usually identify required initiatives — but sometimes don’t flesh them out enough to ensure they will be realized)
Align Systems – D
(This requires time and we are usually busy enough that this often takes a back seat)
Work the Plan – C
(We have a bunch of people that work hard — unfortunately we sometimes need to “work-around” misaligned processes, technologies, etc.
Innovate Purposefully – B
(Smart people innovate — unfortunately the lack of alignment means we’re innovating fixes to underlying problems instead of addressing underlying problems)
Step back – A
(Last year we implemented a program to “close loop” our service delivery process to make sure feedback is captured and flaws are identified.)

Interestingly, I believe these grades closely match with those we see during infomration security assessments. Most entities would get very good grades for Steps 1,2, and 6 (strategy), largely because they usually have smart people. They would get good grades for Steps 4 & 5 because they usually have people that work hard and will find a way to get the job done – despite obstacles.

I think the breakdown we most typically see is in bridging the gap between strategy and execution and making sure that the critical processes, technologies, and personnel are in place to realize the strategy.

Hopefully our efforts to address our “excellence donut” (the hole in the middle of our systematic approach) will yield insights that we can share with our clients…