01. Use Good Judgement

Ideally, our employee manual would be three words long, “Use Good Judgement.” Most situations would be well handled by using good judgement. Asking for help when you are not sure is using good judgement. When in doubt, act in Fractional CISO’s best interest.

02. Celebrate Success

Gong! There is no better sound than that of the gong ringing after the success of a project. Make sure to celebrate life’s and work’s successes by ringing the gong. When in doubt, Ring the gong! Not only is the gong a physical instrument, it is also a metaphor. Make sure to ring the gong by congratulating and acknowledging milestone’s in co-workers’ lives and careers.

03. Honor commitments

Do what you say you are going to do when you say you are going to do it. Be reliable and deliver on your commitments every time. This includes being on time for all phone calls, appointments and meetings. If a commitment can’t be fulfilled, notify others early and agree on a new commitment to be honored.

04. Speak straight

Speak honestly in a way that moves the action forward. Make clear and direct requests. Say what you mean, and be willing to ask questions, share ideas or raise issues that may cause conflict when it’s necessary for team success. Address issues directly with those who are involved or affected. Don’t say anything about anyone that you wouldn’t say to that person’s face.

05. Listen generously

Listening is more than simply “not speaking.” Give people your undivided attention. Be present and engaged. Quiet the noise in your head and let go for the need to agree or disagree. Create space for team members to express themselves without judgement. Listen with care and with empathy. Above all, listen to understand.

06. Set and ask for expectations

Create clarity and avoid misunderstandings by discussing expectations upfront. Establish mutually understood objectives and commitments. Where appropriate, confirm your communication by asking others to repeat back their understanding to ensure total clarity and agreement.

07. Run great meetings

Great meetings lead to great results. All meetings should have a meeting owner, published agenda and appropriate attendees. Location or virtual location of the meeting must be in the location field of the meeting. 

Meeting owner must exhibit good time management. Toward the end of the meeting, follow up action items should be explicitly agreed to. Written follow up should occur in email or project management system.

08. Take great notes

Unless you have an eidetic memory, you need to take notes during client (and other) meetings. You will rarely remember what happened in the meeting the next day, week, month. These notes can be valuable tools for better understanding of the clients’ needs and requirements. Clients often like to see that you are taking notes. Typing sometimes can be a distraction.

09. Take Initiative

We look for ways to constantly improve ourselves, our company and our clients. When we see a client problem, we work to fix it. Even if a client asks for something specific, we should understand what the underlying need is. 

We should deliver what the client needs, not just what they ask for. If the problem is systemic, we should either work to resolve it or escalate it so every client and employee can benefit. We give employees lots of freedom, power and information so they can take ownership at Fractional CISO.

10. Celebrate Failure

Every mistake or failure is an opportunity to learn, grow and share. Focus on accountability and resolution rather than accusation and blame. Whether a problem is beyond our control or because of an individual’s or team’s actions, apply your energy and creativity first to solving the problem, then to learning from it, then to preventing it from happening again. When we celebrate our failures and share our learnings from them, everyone grows.

11. Always add value

Clients hire us because they need expert guidance. We should always be adding value to the client experience. If we are not adding value on a consistent basis, we should be doing more preparation in advance of client meetings so that we are able to always add value.

12. Give Great Feedback

Aim to assist. Feedback must be given with positive intent. We do not give feedback when we are frustrated. We do not aim to hurt others. Clearly explain how a specific behavior change will help the individual or company.

Actionable. Feedback must focus on what the recipient can do differently. “Your presentation is undermining its own messages,” is not helpful. “The way you ask the audience for input is resulting in only Americans participating,” is more helpful. “If you can find a way to solicit contributions from other nationalities in the room your presentation will be more powerful,” would be the best. (Follow the 4A feedback guideline. See Receive Great Feedback.)

13. Receive Great Feedback

Appreciate. When you receive feedback, you need to overcome the natural resistance to criticism and instead ask yourself, “How can I show appreciation for this feedback by listening carefully, considering the message with an open mind, and becoming neither defensive nor angry?”

Accept or Discard. Listen and consider feedback provided. You are not required to follow it. Say “thank you” with sincerity. The decision to react to the feedback is entirely up to the recipient. (Follow the 4A feedback guideline. See Give Great Feedback.)

14. Learn more about security

Be a life-long learner. We are in the early stages of the cybersecurity industry. What is true today will not be true in five years. You must stay current with your security knowledge. You must learn new methods and theories about security. You often learn by doing. Sometimes you need formal training. Make sure to learn by doing AND via training.

15. Learn. Generalize. Standardize.

World-class organizations are built on a foundation of highly effective, repeatable processes. Look to create processes for every aspect of your work. Create great checklists, templates and documentation for other employees to benefit from your learnings. Use those processes to achieve consistent results. Campground rule: Leave things better than you found them.

16. Embrace change

Our industry and company do not look the same as two years ago and will not look the same in two years. We need to be prepared for change. We need to embrace change and direct the changes in a smart way.

17. Hire hard, hire fast

Great employees are the cornerstone of Fractional CISO. It is every employees’ duty to ensure that we are hiring candidates that have the intellectual capability, a growth mindset and will fit into the company culture. 

We must thoroughly vet candidates such that entry level employees will have a 60% chance of being successful and more senior candidates have a 80% chance of success. When we have an open position, we must move aggressively to fill the role. We should not allow delay in the hiring process so that we miss out on a great candidate because they take a competing offer. 

18. Manage easy with high expectations

Life happens. Managers should create a supportive work environment and react to employees’ personal needs with flexibility and understanding. In response, employees should push themselves to be high performers and to grow their capabilities.

When an underperforming employee has not responded successfully to coaching, we must move on quickly. Employees that tried their best but failed should be given a generous severance package to ease the transition. We do not put unsuccessful employees on a plan. It never works and drains the rest of the team.

19. Share deliberately

We share information deliberately. While we keep client specific information confidential, we broadly and openly share learnings from client work. We share internal information openly when it does not impinge on the privacy of employees. We make sure that people have the information they need to perform their job.

20. Lead with context not control

Leaders provide context so the teammates have confidence to make good decisions. Teams must make certain that they understand the vision and strategy. It is up to the individual employee to use good judgement and execute properly. The leaders’ job is to remove roadblocks and set expectations for results and not how those results are achieved.

21. Take great vacations

Every employee should take great vacations (as defined by the employee not the company). Employees should expect that their minds will be work free while they are enjoying themselves. It is the rest of our jobs to take on the work while our co-workers are enjoying their vacation. We love seeing trip photos and hearing about your trip when you return.

22. Make great risk-based decisions

No two clients or situations are the same. We should not have stock answers for questions that are environmentally dependent. What might make perfect sense for one client does not make sense for another. We should be calibrating our answers specifically to the environment in question, the assets, the values, and the risk tolerance of the organization.

23. Quantify the answer

Business leaders understand dollars and probability. They do not understand technical jargon or ill-defined words. 10% chance of a $5 million loss is much better than “high risk.” High, medium and low don’t mean anything if not defined in a particular context. If you say that low likelihood is a 1% chance or less of occurrence then everyone can be similarly aligned as to what it means.

24. Follow ISC2 Code of Ethics

Use the ISC2 Code of Ethics Canons when attempting to resolve an ethical problem. Remember, clients come first except when society demands that they don’t. Code of Ethics Canons: Protect society, the commonwealth, and the infrastructure. Act honorably, honestly, justly, responsibly, and legally. Provide diligent and competent service to principals. Advance and protect the profession.

25. Act in Fractional CISO’s best interest

There are a million situations that we cannot predict. When we run into a situation where we don’t know what to do, we should follow the Fractional CISO Fundamentals and act in the best interest of the company. Sometimes that means doing something that might be a short term negative for the employee. Sometimes that means doing what’s best for yourself to keep from burning out. When in doubt, Use Good Judgement!

26. Take care of employees

“Employees are the product.” Taking care of the employees means that employees feel safe and motivated. In turn they should do a great job taking care of our clients. We should take care of each other.

27.Security first

It is okay when things take longer if we are following good security practice. Security is sometimes annoying. Guess what is even more annoying? Getting compromised! We should be following good security practices unapologetically. We should always look to improve our security behavior. What was fine yesterday may not be fine tomorrow. Security first!

28. Have fun

A thirty to forty year career can be a grind. We spend more time at work than doing most other activities. We should aim to make work fun. We should have fun with clients (where appropriate). We should do fun things with co-workers. We should look to ways to improve our work environment such that things are just a little more fun.