How I Work
Reusable frameworks and operating artifacts: how I assess a program, how I plan the first ninety days, how I structure governance so it survives the person who built it.
-
How I Plan the First Ninety Days
Applies to: taking over a security program in a regulated business
The three-phase structure I use for the first ninety days, the rule for sequencing what gets built first, and the five things that carry across every use of it. Includes the detailed one-page plan as a PDF.
-
How I Build Shared Purpose in a Technical Team
Applies to: a technical team that has lost the thread back to why the business exists
A facilitated day that gave a thirty-six person architecture team a purpose it owned, the division of labor between a facilitator and the leader that made it work, and what changed for the two kinds of people in the room.
-
The Blended Cyber Governance Model
Applies to: a function accountable for security programs it does not operate
Three frameworks as three layers - who is accountable, what must be governed, and how the capability is built. Eight governance dimensions mapped to the NIST CSF Govern function, and the three questions that tell you whether an activity is governance at all.