Blog #1: The Strategic Planning Process Under Constraints

After reading the articles for the first and second week of this Strategy Development class, my thinking is still drawn back to my experience with developing strategy with our CISO that I mentioned in the week 1 discussion board. I was largely following the guidance of my senior leadership to prepare for a series of strategy development meetings with the CISO and was new to this topic. After learning about what reputable and established organizations recommend, I recognize that a few blunders were made. I would have changed my advice to senior leadership in hopes to correct the following:

1) Our CISO has always tried to flatten our organizational hierarchy, resulting in about 20 direct reports in our HR system reporting to him. This not only includes the cyber tower leads, but also information security officers that he sees as key influencers, as well as individual contributors (ICs) that do not have any directs themselves. This resulted in having 20-25 people (including my team) in the strategy development meetings. The articles mentioned posturing and politicking as problems when you get a group this large. I experienced a different problem – lack of trust. There were too many people in the room that the tower leads did not trust, so no candid comments were made that dissented the CISO’s opinion. It may as well just have been the CISO and my team in the room, as we received zero input or real opinions from any of the leadership team in the meeting. Any feedback was collected afterwards one on one with the LT, feedback that the entire team should have heard directly from them. Going back, I would have limited the number of people in those sessions to 8-10, forming a tighter circle a trust where opinions could freely flow.

2) Over prepare and socialize the proposed strategy with the CISO and direct reports beforehand. We primarily worked with only one of the CISO’s MVP direct reports to develop an organized strategy for the cyber department. We failed to realize that the CISO already had a specific organization strategy in mind. We assumed that the MVP spoke for the CISO. During the meeting series, we found that this CISO and this MVP were severely at odds. Some of these interpersonal conflicts went above our paygrade, but we still should have fully vetted our plan with the CISO before meeting with the group.

3) Lastly, we needed to accept the leadership style of the CISO. The articles allude to this briefly, but the method to strategy development largely depends on the leader’s willingness to collaborate with his team. We know now that our CISO is more autocratic in nature, and already had his mind set on a vision and strategy for the Cyber department. The series of meetings were not designed to develop a strategic vision, but to rally his LT around his existing vision. Lesson learned – know your audience when developing strategy at the leadership level.