,
7 tweets,
1 min read
Read on Twitter
I did a podcast interview the other day and we went on an interesting tangent about risk and business consequence. Here’s an important question for my security folks: do you know your organization’s mission statement?
(To clarify, I mean the company / division/ broader org, NOT your security team)
So, I want to encourage every person who replied they didn’t currently know their company mission statement to look it up today.
If you don’t have one as an org, you have deep problems beyond security.
If you don’t know it, you can’t accurately identify Crown Jewels or risk.
If you don’t have one as an org, you have deep problems beyond security.
If you don’t know it, you can’t accurately identify Crown Jewels or risk.
Companies that succeed generally have a really solid mission and communicate it well.
Ex: “We rent DVDs and VHS from stores” was ultimately less successful than “we provide convenient movie and TV entertainment to consumers”
Bad missions can’t adapt to technology change.
Ex: “We rent DVDs and VHS from stores” was ultimately less successful than “we provide convenient movie and TV entertainment to consumers”
Bad missions can’t adapt to technology change.
A good mission statement helps a security team understand consequences that the organization is concerned with. This helps guide identifying critical functions and assets, and proactively build defense and detection.
If it’s too vague to be actionable, or a company doesn’t have one that is conveyed well, worry. It typically indicates the organization won’t be adaptable and financial and design direction will be confused.
People are replying with an interesting assortment of good and bad mission statements. Let me turn this on its head. A good mission statement should clearly convey what your company’s worst day ever would be (beyond not making money).
