Cyber Strategy Workshop for African Union Member States July 23-27, 2018 Addis Ababa, Ethiopia

Managing Change and Other Keys to Successful Implementation

Objectives Why do we care about implementation? Discuss planning vs. implementation Why to use change management principles in implementation How to use framework in implementing cyber strategy initiatives

Why do we care about implementation? Developing a National Cybersecurity Strategy (Day One) Implementing National Cybersecurity Plans (Day Two) Who will lead on different goals or plans? How do we decide which internal and external stakeholders do we need to engage? How do we develop our communication strategy and message? How do we determine what training needs to be developed? How do we align our goals with resources and accountability? 8 Preparatory Questions Identified readiness for planning Developed list of national areas of attention Strengths and Challenges Examined 8 Key Elements of Strategy Self-Assessment Building a Strong Foundation Establishing Goals Leadership Risk Management Involving Stakeholders Strategic Foundations don’t stop after plan has been developed– Need to continue to leverage leadership and stakeholders in implementations Without these considerations, a strategy will sit on the shelf or not achieve desired outcomes!

Going from Goal to Implementation Example Goal: Reduce vulnerabilities to phishing threats How can we make progress towards goal? Consider: Leadership/Roles & Responsibilities Stakeholder Engagement Communication Training Workforce Alignment Important to consider transition in strategy development

Planning vs. Implementation Involvement of group of key decision makers Involves analysis of current landscape and planning for future Relates to developing and prioritizing goals Implementation: Requires broad level of support from many levels of an organization Relates to figuring out how to make change happen and make it stick Focus on identifying the ways that strategy will occur Example: Goal may be to getting a job working for a government ministry. What are the steps? In order to achieve this, required talking with different people to understand landscape/how to approach, going to school and learning from professors about the profession, figuring out where the jobs are, applying for internships, going to networking events, understanding the job application process, learning what job interviewers were interested in. Take 2 minutes to talk with your neighbor about when you had a goal that you had to navigate in order to implement that goal. This could be a professional example or a personal example. It could be a situation where you wanted a new job. How did you go about taking the steps to plan out a way to achieve that goal? Where are we going? What are doing to get there?

Why Use Change Management Principles in Implementation The goal of the people strategy is to minimize the disruption of activities and the typical dip in performance that accompanies change. During Change in Strategy: Minimize the risk to key goals Post Implementation: Optimize and benefits gained Performance (+) (-) Time Baseline: Identify drivers and barriers to change It has been shown that when a change first occurs, there is a decrease in performance. Change management mitigates this dip and seeks to optimize organizational performance throughout the process. Example: Think about when you changed jobs the last time. At your old job, you were sending emails and new who the person to go to for dealing with the mail. But when you start a new job for the first time there is a learning curve. The first week you had to learn who the players were, get your computer set up. Even if that change to the new job was a better fit with more opportunities, there is an initial dip in your performance as you adopt the new change. If that job has better opportunities and is a better fit for you, you will ultimately be able to perform higher, but it took you some time to adapt to the change. Change management is about making that transition as efficient as possible. During Strategy Implementation: Encourage the acceptance of the innovation

Implementation Approaches Change Management Framework Implementation Approaches Leadership Identify and align champions and senior leaders to program goals, priorities, and new operating norms and behaviors Stakeholder Engagement Communication Training Workforce Alignment Analyze stakeholder groups, their concerns, and resistance levels, and engage stakeholder groups for impact Build the organization’s communication capability, and develop and execute a communication strategy Identify gaps in knowledge, skills, and abilities and develop a plan to address Design and implement adjustments to the organizational structure, roles and responsibilities, reward systems, etc. Present How things are currently done… Consider people, process, and technology. Implementation of Future Goal How things will be done… Consider changes for people, process, and technology. 2 Minutes: Think to yourself 2 Minutes: Share with a partner 2 Minute: Share with the group

Applying the Framework: Scenario Employees are unaware of phishing threats Employees click on malicious links Employees freely enter sensitive information What steps are needed? Awareness of phishing threats Mouse over and question all links Employees know to be cautious entering personal and financial information Obutuland Land has a goal to reduce vulnerabilities to phishing threats targeting government employees. Present Implementation Goal

Implementation Approaches Goal: Reduce vulnerabilities to phishing threats targeting government employees Implementation Approaches Leadership Identify and align champions and senior leaders to program goals, priorities, and new operating norms and behaviors Stakeholder Engagement Communication Training Workforce Alignment Analyze stakeholder groups, their concerns, and resistance levels, and engage stakeholder groups for impact Build the organization’s communication capability, and develop and execute a communication strategy Identify gaps in knowledge, skills, and abilities and develop a plan to address Design and implement adjustments to the organizational structure, roles and responsibilities, reward systems, etc. Present Employees are unaware of phishing threats Employees click on malicious links Employees freely enter sensitive information Goal Employees have awareness of phishing threats Employees mouse over and question unknown links Employees know to be cautious entering personal and financial information 2 Minutes: Think to yourself 2 Minutes: Share with a partner 2 Minute: Share with the group

Applying the Framework Implementation Approaches Leadership Identify lead for developing a training initiative Create vision and establish business case for phishing threats Establish a workforce cyber training coordinator in each ministry Stakeholder Engagement Communication Training/Education Workforce Alignment Hold town hall meetings within government ministries to discuss Talk with employees about phishing targets Develop communication strategy to reach employees Hang posters in break rooms Integrate training in employee orientation Develop training to government employees on the risks. Develop FAQs for employees Identify metrics related to completion of training Monitor click rates Addressing Cybercrime through framework- use this framework tomorrow with different goal

Questions?