68 ◾ Security Strategy: From Requirements to Reality
Benchmarking yourself against other security services helps determine how effi ciently you
are providing security services and identifi es places where you might gain effi ciency by adopting
industry “best practices.” Benchmarking provides the data to answer questions such as: “Are we
above or below average in our costs, our cycle time, quality of services, and customer satisfac-
tion metrics?” “Can I explain to management why our security position is right or needs to be
changed?” “Do we have a strategy in place to move us where we need to be?” Remember: Your
competition for security services is also getting smarter, faster, and better connected globally. ey
aim to change the way the security industry does business. Are you leading or following?
Scenario Planning
inking through [scenario] stories, and talking in depth about their implications,
brings each person’s unspoken assumptions about the future to the surface. Scenarios
are thus the most powerful vehicles I know for challenging our ‘mental models’ about
the world and lifting the ‘blinders’ that limit our creativity and resourcefulness.
Peter Schwartz
Scenario planning is an approach to strategic planning that considers frameworks from multiple
perspectives, with a focus toward building multiple paths toward the future. is approach for-
mulates plans or prepares appropriate responses to probable future trends and events. e plans
produced usually cover a range from best-case to worst-case probabilities. Many organizations use
it to make fl exible long-term plans. Scenario strategic planning has been in the toolbox of strategic
thinkers for fi ve decades now. rough determining key driving forces, prioritizing those forces
by potential organizational impact, selecting possible scenarios, analyzing selected scenario envi-
ronments, and constantly monitoring key environmental factors, scenario planning helps strategic
planners determine which scenarios are the most adaptive to emerging realities.
When an organization utilizes scenario planning, an environmental scan is done, and several
key external forces are selected. Planners imagine changes in the environment as those forces
move along a continuum and adapt strategic issues and goals that might arise as the environment
changes around an organization—for example, changes in regulatory environments and technol-
ogy development. For each signifi cant change in force along those selected key issues, a planning
group develops organizational scenarios for best case, okay/neutral case, and worst case. Planners
then look at alternative strategies for the organization over the next three to fi ve years to adapt to
each of the scenarios chosen.
Scenario planning takes each strategy within the scope framed by key issues selected, defi nes
the key stakeholder, gathers information, analyzes trends, and looks at possible forces and critical
uncertainties in each of the selected scenarios. From these a “framework” is created for each of the
possible scenarios chosen. Typically, a scenario is continuously tested by modeling and/or analysis,
as the actual path of unfolding events is monitored for key indicators to adjust scenario plans.
Scenario planning helps organizations to better handle sudden shifts in reality whether tech-
nological, regulatory, cultural, economic, or otherwise, through the development of multiple strat-
egies. Scenario planning can give organizational stakeholders a better understanding of potential
risks and improve organizational responsiveness to future development. By considering a wider
range of strategic options, an organization can be more nimble and fl exible in responding to
unfolding events. Testing potential scenarios also helps the robustness of strategic plans. In the
TAF-K11348-10-0301-C004.indd 68TAF-K11348-10-0301-C004.indd 68 8/18/10 3:03:56 PM8/18/10 3:03:56 PM
Strategic Framework (Inputs to Strategic Planning) ◾ 69
converging world of security, scenario planning provides a combination of creative and critical
thinking skills, as well as convergent and divergent possibilities, while considering the advantages
and disadvantages of both.
e diffi culty, or hard work, of scenario planning is determining the critical factors or driving
forces. As scenario planning has evolved, the move has been from the selection of two key forces
(i.e., a two-dimensional framework, for example, one based on regulatory environment and open-
ness to markets) to models that now utilize multidimensional frameworks. Regardless of which
method you might choose in scenario planning, many of the same challenges remain in utilizing
scenarios, notably:
1. Developing strong senior management support for utilizing scenario planning. (Organiza-
tional cultures can be extremely resistant to new forms of strategic planning. Scenario plan-
ning, if conducted correctly, should challenge and change organizational assumptions about
the future, which often creates organizational discomfort and resistance.)
2. Adapting scenario planning to the decreasing planning cycle times required in organiza-
tional environment. (You will fi nd benchmarking associations in nearly every industry that
will also be benefi cial in building business expertise. Professional benchmarking associa-
tions present many opportunities for networking, educational opportunities, and industry
support.)
3. Keeping consideration broad in determining the probability of scenario in initial
discussions.
4. Determining key driving force factors, major forces/minor forces.
5. Crafting detailed and compelling stories for each scenario.
6. Linking scenarios to tactical actions. (Each scenario requires specifi c strategies associated
with organizational action.)
Scenario planning helps determine potential frameworks for
diff ering versions of the future. Scenario planning can help an
organization move more quickly and nimbly in rapidly chang-
ing environments.
Futurist Consultant Services
e role of a futurist (and anyone can be one)—is to honor the past, inhabit the present
(notice what’s going on now) and engage the future—to be involved in a process of
stimulating our friends and our loved ones and even strangers to getting the grips with
the fact that the future itself is a race between self-discovery and self-destruction.
Richard Neville
Another method of envisioning future developments that
will potentially impact your organization is hiring futurist con-
sultant services. We aren’t talking about crystal balls, psychic
hotlines, or other types of star gazing, but thoughtful consultant
services that help an organization imagine and move toward a
desired future. ese types of services are quite useful for devel-
oping think tank sessions to identify important areas of explo-
ration for an enterprise and then providing methodologies for
There is nothing more diffi cult…than to take
the lead in the introduction of a new order
of things.
Niccolo Machiavelli
(Futurists focus) in any of three areas:
1. Forecasting the future, using quantitative
and qualitative means,
2. Imagining the future, using primarily
intuition and writing skills, and
3. Creating the future, using techniques of
planning and consulting.
Glen Hiemstra
Futurist
TAF-K11348-10-0301-C004.indd 69TAF-K11348-10-0301-C004.indd 69 8/18/10 3:03:56 PM8/18/10 3:03:56 PM
70 ◾ Security Strategy: From Requirements to Reality
in-depth exploration of future events, trends, and developments. From this focused exploration
and analysis, the organization can then develop strategic priorities, initiatives, and strategic plans.
Futurist consultant services can greatly assist an organization in scenario planning as well.
Regardless of whose services you employ in your eff orts or whether you choose to create your
strategic plans from largely internal resources, the key to good strategic planning is to remain
forward looking in day-to-day activities as a security leader.
Blue Ocean Strategy versus Red Ocean Strategy
Why join the navy if you can be a pirate?
Steve Jobs
Blue Ocean strategy, developed by W. Chan Kim and Renée Mauborgne of INSEAD, an
international business school, is an approach to strategic planning through the metaphors of Blue
and Red Ocean strategies. ese strategies are approaches to the marketing universe. Red Ocean
strategy refers to a competitive model of approaching the market, which has specifi c and defi ned
boundaries in which groups compete. As the market grows smaller with increasing competition,
eventually competitors battle it out, turning the oceans red. In contrast, Blue Ocean strategy
approaches strategy from a more exploratory set of assumptions in which market space is shaped
or created and is therefore “uncontested.” Competition is much less relevant, as the game of
marketing has not yet been shaped in Blue Ocean strategies. e course that must be set in Blue
Ocean strategy is that of “value innovation.” Strategies must create value for both the consumer
and the enterprise through innovation. e Blue Ocean approach is critical of Michael Porter’s
approach, which produces low-cost providers or niche players in the market. Blue Ocean’s cre-
ators maintain that by using their approach you can create both value and low cost across market
segments.
A whole set of tools have been created for companies utilizing this approach to strategy, such
as Strategy Canvas, the Tipping-Point Leadership approach, and the Four Actions framework
(Table 4.1). Many of these tools existed in previous strategic planning methods and are employed
by those who use Six Sigma Practitioners and other strategic management approaches.
Table 4.1 Strategic Planning Tools
Basic Tools of Blue Ocean Strategy
Frameworks/Methodologies Applicable to
Strategy Execution
The Strategy Canvas Tipping-Point Leadership approach
The Four Actions framework Four Organizational Hurdles framework
Eliminate-Reduce-Raise-Create Kingpins approach, Fishbowl management,
atomization
Grid Hot spots, cold spots, and consigliere approach
The initial litmus test for Blue Ocean Strategy:
focus, divergence, compelling tagline
3 E Principles of Fair Process
Source: Vector Study.
TAF-K11348-10-0301-C004.indd 70TAF-K11348-10-0301-C004.indd 70 8/18/10 3:03:57 PM8/18/10 3:03:57 PM
Strategic Framework (Inputs to Strategic Planning) ◾ 71
Additional tools/methodologies/frameworks for strategy formulation are as follows:
e Six Paths framework ◾
e sequence of the Blue Ocean strategy ◾
e buyer utility map ◾
e buyer experience cycle ◾
e profi t model of the Blue Ocean strategy ◾
e price corridor of the mass model ◾
Four-Step Visualizing Strategy Process ◾
Pioneer-Migratory Settler Map ◾
ree Tiers of Noncustomers framework ◾
Companies that have used Blue Ocean strategy frameworks include Southwest Airlines,
Netjets, Cirque du Soleil, Home Depot, Nintendo’s Wii, and China Mobile. e critics of this
approach to strategy (and there are many) maintain that even a Blue Ocean approach to strategy
is overly simplistic and will eventually turn red. e challenge remains to be the fi rst to sail into a
new Blue Ocean strategy, which is basically a get-there-fi rst with the most creativity approach.
Future (the Need to Be Forward Looking)
Neither a wise man nor a brave man lies down on the tracks of history to wait for the
train of the future to run over him.
Dwight D. Eisenhower
Clearly, strategic planning has to be forward looking in design, even though many of the inputs
into strategic planning are datasets from the past (i.e., risk management metrics, forecast budgets,
already determined infrastructure requirements, enacted policies, customer requirements). And
yet, strategic planning requires a visionary mind-set that anticipates and prepares for possible
futures. is synthesis of past data and insight into the political, economic, technological, regula-
tory, and human resource realms that are driving change require a continual kind of conjecturing
or reframing of possibilities.
A future-oriented security group may seem like a bit of a
conundrum to normal organizational perception of security.
It has been our collective experience that occasionally security
leadership has underdeveloped strategic planning skills. Even
where this might be true, security leadership may still be making informal strategic decisions that
are not always clearly understood or communicated to the rest of the organization. When this
occurs, often the organizational leadership’s resulting actions toward security are less than desir-
able. Conversely, when security leadership has a clear sense of the future and their strategic plan
is well integrated to organizational strategic goals and objectives, and they meet organizational
expectations and fi scal targets, then security leadership is well regarded as an important member
of the leadership team.
Many of the latest discussions about the role of security leadership in magazines like CSO
refer to the changes required for CSO, CIO, and CISO roles in many companies. e days are
past when a technical expertise regarding security is enough to successfully lead a security group.
As the security fi eld has matured, organizational expectations for leadership skills in security now
I skate to where the puck is going to be not
where it has been.
Wayne Gretzky
TAF-K11348-10-0301-C004.indd 71TAF-K11348-10-0301-C004.indd 71 8/18/10 3:03:57 PM8/18/10 3:03:57 PM
72 ◾ Security Strategy: From Requirements to Reality
include increased focus on risk management, expanded knowledge of ever-expanding policy and
regulatory requirements, and increasing business savvy regarding the organization.
Conclusion
Strategic planning is hard work and requires time, knowledge, practice, and skill to master. e
challenges it presents are many. When security groups engage regularly in strategic planning, they
can create robust plans by considering the frameworks we have just reviewed. In the distillation
process of determining key business drivers, conducting a vital environmental scan, reviewing
internal and external business requirements, and gaining a fi rm understanding of these arenas,
a strategic planning group can provide a basis for detailed planning as well as better explain the
business to others to help inform, motivate, and involve them in a well-developed security strate-
gic plan. Security can become more than a business problem to be solved. Security can become a
business core competency that helps enable the business and creates organizational resiliency to
market vicissitudes.
Understanding the framework inputs to strategic planning forms the cornerstone of strategy.
e critical success factors for framework implementation are:
Using a business-driven strategic planning methodology ◾
Showing clear vision and planning ◾
Having committed management support and sponsorship ◾
Possessing strong data management skills ◾
Using quality sources of data ◾
Mapping the solutions to the organizational requirements ◾
Creating a robust framework ◾
Determining and prioritizing key business drivers both at the enterprise level and for a secu- ◾
rity group itself (they may be in confl ict)
Some things cannot be spoken or discovered until we have been stuck, incapacitated,
or blown off course for awhile. Plain sailing is pleasant, but you are not going to
explore many unknown realms that way.
David Whyte
TAF-K11348-10-0301-C004.indd 72TAF-K11348-10-0301-C004.indd 72 8/18/10 3:03:57 PM8/18/10 3:03:57 PM
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.