Faculty Advisor: The Need for Effectively Telling Security's Story

Q. I’ve been in the top security position for three months. I’m the first security director for the company and about to start communicating security responsibilities to the organization. What is the best message I should be putting out?

A. What we've found is many security departments start with prescriptive messaging without creating a message that articulates their internal "brand value" story first. The key to this is being able to clearly and successfully influence your constituency (e.g., senior management) through value messaging; something successful leaders achieve. Security’s program story may be expressed through a targeted communication vehicle, or what we call a “storyboard.” You likely have many reasons for effectively telling a cohesive story ranging from management’s need for more clarity on what security’s role is, to gaining buy-in and support to fully implement the security program in field and international locations.

Tell your story using messaging that will level-set awareness on what security’s role is and how it brings value to the business. Use whatever format works best in your culture.

As for how you effectively tell your story and what should it include, we've found that successful security leaders use a strategic story catalog or master to choose briefing material from that fits the audience and culture. Some of the major components include:

• A detailed history (e.g., timeline of program development)
• Strategic initiatives and strategic plan with current year areas of focus, the next several years’ areas of focus, and how it’s tied to funding
• How your program is organized and at what capacity
• Value analysis status (e.g., customer use, customer satisfaction, cost by customer)
• Snapshots of the current program state in heat map, or SWOT, analysis formats to quickly frame up challenges (e.g., gaps, security risks) and highlight direction
• Business value metrics
• Due diligence on emerging trends seen that may impact the company and security

Once you have your master story created, you need to think about who you need to communicate this to. We’ve identified up to eight audiences you likely should tell your story to (see below); each audience will receive a part of your story that is relevant to them. You will find that some of your messaging will overlap between audiences.

1. An elevator speech specific to various audiences
2. Executive management
3. Employees or new employee
4. Outsider (e.g., industry group)
5. New boss or business unit head
6. New security staff
7. Internal customer (e.g., site, country, peer departments)
8. Review, e.g., year-end update to various audiences

A few examples of audience specific messaging follow.

As the new security person, having a simple elevator speech in your back pocket that quickly explains what security does and what it can do for the business is an effective communication tool to have readily available. This may be used for a variety of audiences you come across during your day-to-day activities.

Some of your first meeting stops will be to the executive management team and your new boss. For those meetings we suggest a concise program overview. An example of a "story" may be one of a transformation; that is - no formal program existed 3 months ago; here’s Security’s current role; and recent accomplishments and future opportunities (e.g., program elements, plans and objectives) identified. For this audience focus on how the program adds value to the organization (e.g., protects assets: people, processes, brand and information). This may be built upon to include activities and operational excellence using data to support your story. It may also include elements such as emerging and futuristic trends that will affect the company and security. The messaging may take 45 minutes to deliver in whole; however, it’s best to be prepared with one or two of the most important messages you want to convey up front in one or two charts, in the event you’re only given a short meeting time.

For the general employee population the communication may simply cover your role and include department mission and vision statements, functional organization chart and summary detail of the programs and services you are responsible for executing.

It is critical that you the security leader, your boss and the entire security team are telling the same concise, cohesive "brand story" to the different levels of audiences and internal company stakeholders. The goal is consistent messages that are delivered through multiple channels over long periods of time.

Answer provided by Liz Lancaster, Director of Tier 1 Leader Services & Projects, Security Executive Council.