Are you a CISO in the midst of a job transition? If so, check out my just-published How to CISO: The First 91 Days guide for an in-depth look at the questions you ought to be asking and how to make and communicate your plans.
Leadership Moment: An early wakeup
I think it’s annoying when my wife’s alarm wakes me before I’m ready (in fairness, I think that’s only 30% of the time; imagine who’s annoying whom the other 70%). Imagine being a Floridian last month, when at 4:45 am, a test emergency alert broadcast woke them up. The test message was apparently only supposed to go to broadcasters, and Everbridge, the company who handles* Florida’s emergency broadcast system, has apologized.
What’s fascinating is seeing who can afford to apologize, and who doesn’t have budget to do so. CEO Dave Wagner’s apology contains the usual nod to human error**, but does not stoop so far as to throw an intern under the bus. Instead, he notes the company will be adding further safeties into their system in hopes of preventing a future recurrence. The Florida Department of Emergency Management, however, quickly and publicly terminated Everbridge’s contract with the state, apparently unwilling (or politically unable) to absorb responsibility themselves.
*The termination of services appears to be shortlived. A contract originally through June 2024 was announced to end in June 2023. A subsequent filing shows the contract has since been modified to end in December 2023, with an option for a six month extension to … June 2024.
**As Nancy Leveson says, “Human error is a symptom of a system in need of redesign.”
One Minute Pro Tip: Celebrate Near-Failures
We love to celebrate what goes right, but how often do we celebrate almost going wrong? Rarely, if ever. Yet, just barely dodging a bullet is one of the best teaching moments: what was going wrong? How bad could it have been? How did you divert it? In the moment that a failure was turned into a near-failure, it likely required leadership at a pivotal moment. Unfortunately, most organizations move on very quickly. Why? Usually, most of the organization were probably contributing to the failure, and don’t want to remember it.
This is your opportunity as a leader to have a blame-free celebration. Understand that the organization almost made a failure, and cover that with your apology budget, but learn how someone derailed the failure train and saved the business. Others might see how to decouple themselves from driving at a failure, and the energy spent by the leader who was on the right side gets recharged in that moment.
Upcoming Appearances
May 31: Tufts radio
June 9: Talk, Building your leadership practice, RMISC, Denver, CO
June 14: Keynote & book signing, RVASec, Richmond, VA
June 15: SANS Executive Roundtable, The CISO’s Guide to Managing Cloud Security Risks
June 27: Fireside chat with Myrna Soto, Two Hall of Fame CISOs walk into a Zoom
July 20: Webinar, The First 91 Days of a CISO’s tenure, with Christina Shannon, KIK
Chapter Cameo: Apology Budget
Chapter 34 – An apology budget allows your team to take risks – is aimed at teaching one of the more important delegation skills. It’s relatively easy to delegate tasks within your team, but have you delegated the ability to fail? Until you make failure safe (from a career perspective), your team is going to be too risk-averse to make the big bets that you likely want them to.
Enter the apology budget. When your team fails, you fail. Are you going to throw your team under the bus, and blame the error on them, or are you going to accept the responsibility yourself? Of course, everyone says that they’ll accept the responsibility themselves, but if you asked your team in a blind survey, how many of them truly believe it? An apology budget is your way to tell your team that you’re willing to take the responsibility, and apologize to your peers for any failures. You don’t have to have a hard count (“you get 3 VP-level apologies and 1 CEO-level apology”), but, qualitatively, that’s the idea. When someone has made several failures in close succession, you can warn them that they’ve spent their apology budget and need to take a little less risk.
Leadership Q&A
To have your question added to our weekly Q&A, drop a note to AskALeader@duha.co.
Leader Y asks, I have a team member who basically demands to be micromanaged. You’ve written a lot about the need to delegate and let people solve problems their own way, but this person insists on getting detailed instruction for tasks I know they are capable of. Can you help?
Y, thanks for writing in. This sounds like there are a few possibilities going on, one of which I’m not sure you’re going to love.