A Business Technology Place

The data we see

What we see

When I was an intern in college I worked as a desktop service technician for computer support. I remember an internal financial auditor on the fourth floor of my building that I would occasionally help. Reese was much older than me, but took time to talk to me about life as I fixed his computer. I wish I would have appreciated it more at the time, but I was young and learning my way in a corporate environment.  I thought about him recently because the world of auditing and compliance is changing rapidly in the areas of security and availability of data. While Reese was making sure our company followed GAAP for our financial books I wonder what he would think about compliance controls for information security.

Our news feeds are filled with incidents, thefts, and breaches of company assets involving personal and protected information. A whole new generation of auditors is here to check compliance with controls for how we protect data like credit card numbers, health records, and education records. Identity thieves and hackers have created a gold-rush in recent years to steal data bits that when assembled correctly tell them about you and me. Digital gold.

What we do with it

Today, I have to answer the auditor’s questions about controls in the audit. Unlike my time with Reese, I’m no longer part of the auditor’s day to fill time with a nice break and chit-chat. When I am answering an audit, I often try to really understand the basis of a control or as I as the “spirit” of what the control is trying to achieve (auditors don’t always like this, they’re often a bit stiff).

But here’s my take. The essential question behind the myriad of compliance controls is “what do we do with and how do we protect the data we see in our jobs?”  The intention of the controls is to modify our behaviors to take greater care of the data we see. To do this we have to modify our behavior to treat the data we see like our personal accounts. That means we have to consider who has access to the data. We have to consider the classification of the data we see (confidential, private, restricted, public, etc.) and take action to protect the data in storage and transit.

Thieves rely on our inconveniences to be successful. Restricting access to data in storage and transit is rarely convenient. It requires we think, classify, and take action. It could mean we need to password protect a file, use a secure site for sending a file to a customer, or check to make sure the network folder is only accessible to people in our immediate workgroup. But it doesn’t stop there; sometimes we need to challenge people asking for information.  Tailgating and phishing are made possible because it is uncomfortable for us to challenge people.

Behaviors worth changing

One thing is certain. We are stewards of the data we see each day. Our customers expect us to treat the data with confidentiality and care as if it were own personal data. Forming good habits in data security is worth a little bit of hassle. So here are some practical steps I can offer to help us be better stewards of the data we see each day at work:

  • Take the annual Information and Security Awareness training seriously. Much of the information will repeat each year, but it serves as reinforcement for good habits and the tactics used by thieves.
  • Be cognizant of the data we handle. Classify the data and treat it accordingly. This may mean marking the data classification on documents, storing data in secure places, or using encrypted controls for transferring data to others.
  • Challenge others who ask for access to data. Make sure they truly need access to the data to complete their assigned job function. Make sure they understand the classification of the data.

It’s rarely convenient. But it’s worth the effort.

Onward and upward!

Photo credit: Robert Couse-Baker via creative commons

More or Less?

Truth.

There will always be more work to do than is possible to accomplish by my team.

Think more. Whine less.

Earlier this year I penned some thoughts about thinking through resource contention, Do more with what you have!, because I was looking for better ways to address resource contention than to simply say more people are needed. Getting stuff done is as much a mindset as it is a collection of work output. I’ve learned that when I am overwhelmed with size of the backlog of tasks then the frequency of my output decreases.

In the book, ReWork,  Fried and Hansson address the value of staying lean with less,

“I don’t have enough time/money/people/experience.” Stop whining. Less is a good thing. Constraints are advantages in disguise. Limited resources force you to make do with what you’ve got. There’s no room for waste. And that forces you to be creative. “

Do I believe that? The words do inspire me to look at my backlog through a different set of lenses. One thing I know is this. If I’m able to produce consistent output that adds value to the customer and mission of my team then conversations about the priority of the backlog are easier.

In the book Blue Ocean Strategy, Kim and Mauborgne say it this way,

“instead of getting more resources, tipping point leaders concentrate on multiplying the value of the resources they have.”

The Theory of Constraints management paradigm teaches us to first find the constraint within a process and then to exploit the constraint by shifting resources, managing work queues, and possibly adding capacity. With this lense, value is unlocked by first examining the underlying process instead of trying to add more people.

More or less?

As I sit writing this, I’m led to these conclusions:

More is contentment with less because having less allows me to get more done.

Less is obsession about more, because having more often leads to getting less done.

Onward and upward!

Revisiting – What are you known for?

Deja Vu

I recorded a few rambling thoughts one day after work this week. That’s how many of my blog posts originate. Things happen through the course of a day that stick with me into the evening. When I jot down my thoughts, I see interactions with people, process observations, desires for a better solutions, and things I want to change.

This week I looked over my notes and thought, “What do I want to be known for?” It’s a question I knew I had asked myself in the past. Three years ago, I wrote a post entitled What are you known for?  In that post I expressed my desire to be known more for providing solutions over following processes. I’m a practitioner of following processes, but the process itself isn’t bigger than the results it provides.

Dr. No

Fast forward to today. The Information Technology landscape is increasingly burdened with applying more security and availability controls to keep customers data safe and to achieve compliance with standards. But compliance is never convenient. The IT guy is caught in the cross hairs of a battle between making the work environment more secure and the extra burden it places on other employees. Burden in this context means restrictions. Lots of them.  

Traditionally, IT has been known as Dr. No. There are restrictions on what hardware employees can use and what software they can install; Internet sites are blocked, software can’t be downloaded, etc. This is the seed that birthed Shadow IT where departments arrange and install software outside the approvals and processes of their local IT group.

A better way

I’ve had too many experiences in my career watching people telling someone else they can’t do something for one reason or another. It’s not only frustrating; it drains the energy and motivation of those involved.

But it doesn’t have to be this way in every situation.

A better partner explains the constraints of the problem and solution. Instead of ending a discussion with ‘no’, he or she will offer alternatives for a solution.

 

“We can’t do that for you, but what we can do is this…..”

“That’s not possible, but I know a way that is….”

“We are prohibited by policy/contract/compliance control from doing that, but there a few different ways to accomplish something similar….”

 

Of course, the person on the receiving end has to be able to compromise and think about the solution in different way as well. It takes two to make the partnership happen.

If you are a solution provider, don’t stop at the word ‘no’.

If you are a solution receiver, be open to alternative ways of doing things.

What do you want to be known for?

Onward and upward!

 

Level loading straight talk

Listen to the clues.

This week was not unlike many others. I had multiple conversations with colleagues about the amount of work expected of them. Common phrases include:

“We don’t have enough resources.”

“I’m overworked.”

“We are working hard, but are we working smart?”

“I’m drowning.”

“Are we working on the right things?”

“I plan my day with important activities, but then urgent activities take my time.”

Thoughtful answers to this classic dilemma usually involve some form of level loading to try to even-out and prioritize the work expected from employees. Last year I wrote about one technique my group uses to try to control the volume of input on our development team leads.  One the biggest challenges in controlling work inputs is a concept I call organizational entropy. I define organizational entropy as a measure of disorder or randomness by which work is created within a company.  This ultimately causes workers to be out of alignment.  The misalignment isn’t necessarily with organizational goals; rather it’s more so a timing alignment with other workers and expected delivery dates for projects.

It’s chaotic in the middle of it all.

A common scenario helps add color to my thought. Jane is a manager of a team that provides customer service functions. Jane is asked by HR to complete a new required training by a specific date. Jane is asked by a process improvement analyst to participate and own tasks in a customer service improvement project. Jane is asked by a Sales manager to participate in a project to onboard a new customer. Jane is asked by a compliance analyst to update a process because new compliance regulations require it. Jane is also asked by her manager to complete managerial and process tasks related to her day-to-day operational jobs. The chaos ensues when the due dates conflict with each other.

Unfortunately, situations like this are not uncommon. All the colleagues that asked Jane to complete work by a certain deadline do not know if their due dates overlap or cause conflict with Jane’s schedule (and truth be told, they usually only care about their project deadlines). So it’s very easy for Jane to quickly become over-tasked. If Jane is late on a task, then the project leader may escalate to management. Escalation does have a purpose, but it also can easily promote more organizational entropy.

How do we find relief?

There are no easy answers to this dilemma, but I have a few thoughts that may drive conversation between employees and managers to reach a better understanding of what is happening and to better load level expected work:

  1. Managers need to acknowledge the employee may have been asked to do more than is possible in a standard week. Seek more input from the employee, examine their workload. Ask for visibility to the situation in a tangible format. You can’t help level load and employee’s work for what you don’t see or acknowledge. This is the best way to help lead your employee and position them for success.
  2. The employee should provide visible proof of the situation and not just say “I’m overworked”.  This means listing tasks, requested due dates, and effort required to complete them. You can’t expect a manager to help level load your work unless you give them specific and actionable evidence. This isn’t a call to make excuses or place blame. It’s a call for an honest assessment of your situation and to make it visible.
  3. Time management techniques like the Eisenhower Method provide good tactical methods for organizing multiple tasks.
  4. As much as possible try to perform level loading before committing to new work. Over extending commitments creates more unmet deadlines, causes irritation with requestors and customers, and creates more process waste. But remember to use the tangible evidence when making your case.

Maybe this topic is proverbial elephant in the room for you and others. I don’t proclaim to have all the answers. But I’m wrestling with the concept and looking for ways to improve.

Onward and Upward!

Photo Credit: Graeme Newcomb via creative commons

Hope @work

You are not here merely to make a living. You are here in order to enable the world to live more amply, with greater vision, with a finer spirit of hope and achievement. You are here to enrich the world, and you impoverish yourself if you forget the errand.” – Woodrow Wilson

Hope is the great motivator in our world. It gives us anticipation and an expectation for some desirable result. President Woodrow Wilson spoke of the spirit of hope in 1913 while addressing a group of college students. His hope was to inspire the next generation to leave the world a better place than they found it.

A few weeks ago, I watched the movie Dunkirk from director Christopher Nolan and I found the presentation of the historical events in the movie deeply moving. The film’s characters reacted to their situation in a variety of ways. Some exhibited a great hope for survival and acted courageously while others felt hopeless and resorted to acts of cowardice and selfishness.

I considered the role hope plays in an office environment:

  • Workers hope for advancement and it motivates them to go beyond their job description.
  • Workers hope to close a sale and it inspires them to create solutions that never existed for a customer.
  • Workers hope to create a new product and it drives them to consider new ways of thinking.
  • Workers hope for a job in a different field and it inspires them to train and study new skills.

The ability to influence actions is powerful. That’s what hope does. While people have different hopes based on their situation, one thing is the same. All of us are driven to action when we have a strong hope for a different tomorrow. Hope is the great equalizer that can help someone who is less skillful or knowledgeable out-perform a competitor. Where there is hope there is achievement.

May the hope be with you.

Onward and upward.