Every time something happens, talk about it

[marietheresa]

Change is inevitable. And when it comes to cybersecurity, changes are often decided by someone in charge. That's just how it is.

But in this stage, we're nevertheless trying to create as much goodwill towards your change as possible. To do that, you must convince your developers (or whoever else is the recipient of that change) that going through that change isn't worse than the status quo.

In this issue, who'll do that by communicating everything you know the minute you know it.¹ Make it impossible to conjure up the specter of endless overtime and ever-changing deadlines by communicating often, clearly and in detail.²

So when management sets a meeting to decide on your change next week on Tuesday? Let people know. When you've got the okay and are trying to get the budget? Good job, but let people know. When you've talked your (chief) information security officer into not setting any deadlines in the next two months? Definitely let people know.

You know the saying, "communicate early, communicate often"? This stage is what that saying was meant for.

Footnotes

1. Maybe not the literal minute. There are considerations about who can hear what best and when. Maybe don't post about new deadlines on Friday afternoon. That kind of thing. ↩

2. Of course, then you'll also need to stand by your word. And sometimes, as circumstances change, you'll need to adjust. It's a bit of a balancing act, honestly. ↩