What do you do if your stakeholders have unrealistic expectations for Information Security projects?

Set clear boundaries and manage expectations by defining realistic objectives, timelines, and deliverables. This helps stakeholders understand what can be realistically achieved within given constraints and resources.

I'll arrange meetings to explain the complexity of Information Security with real-life examples. We'll discuss potential risks if we don't manage these challenges properly. Together, we'll set achievable goals based on our resources and prioritize what's most important for the company's needs.

Security projects sometimes have a tendency to be over-estimated by clients, in terms of the effectiveness and value it attempts to deliver. Hence, it is important to paint a realistic and practical picture of the outcomes of the security project. This maybe due to the specific nature of the problem they are facing, or the fact that the security implementation has to be done in a short time to meet urgent requirements. It could also be due to the fact that the stakeholder might have some past experience or preconceived notion or comparing with other organizations - that a security project can be done in a certain way. While that may be true, it is important to put security into context and sensitize the stakeholder on realistic aspects.

Acredito que parte desse problema se dá por uma falta de comunicação aberta, onde líderes e equipes de segurança não compartilham suas preocupações e objetivos. Gestores que são tão distantes de suas equipes, a ponto de não conhecerem o potencial delas. E isso pode acontecer para os dois lados, tanto dele achar que tem uma equipe muito forte (e não ter), tanto, dele achar que tem uma equipe fraca, e não verdade tem os melhores dentro da empresa, que poderiam estar entregando muito mais.

O melhor approach em situações como essa é o "dá pra fazer, mas custa tanto". Porque não existem expectativas irreais em termos técnicos. A questão é que com orçamento baixo, não dá pra fazer milagre. Então, deixar claro para os stakeholders que dá pra fazer, mas não com o orçamento apresentado. Mostrar valores ($$) realistas, tabelas de prós x contras, benchmark de mercado, situações de security breach recentes... tudo isso ajuda a montar um cenário mais adequado e embasado para decisões. Lembrando que tudo é "base" para tomada de decisões. Monte uma boa base que as decisões irão se sustentar a longo prazo.

Leveraging visual communication not only improves clarity and transparency but also fosters a shared understanding of project goals and objectives among stakeholders, reducing the potential for misinterpretation or misalignment.

The most important and first step is to document clearly all the relevant aspects. These maybe: scope, objectives, timelines, expected outcomes, limitations, blockers, dependencies, stakeholders, etc This provides a clear picture to everybody involved and obtain a sign-off from all stakeholders. Next is to define the communication plan, frequency, template, contents and audience. This can be in the form of meetings, reports, demos, JIRA board, etc This way, stakeholders are kept in the loop on all progress and they can get themselves involved at the right step. This ensures that everyone are on the same page and there are no surprises towards the later stages. It also allows time to collect feedback, fine-tune approach and course correct

It's important to establish an open and transparent dialogue as soon as possible, explaining the limits, scopes, and challenges involved in the project, highlighting the benefits and gains that can be achieved, and if necessary, working together to review and adjust the project resources to meet expectations. The important thing is to ensure alignment of expectations, avoiding frustrations or disappointments.

Building strong communication links with stakeholders is key. Make sure you really understand what they want and make sure that they understand clearly the scope. If you can, talk directly with people from the client's and project team to avoid confusion, keep you eyes into the indicators.

Consider implementing agile change management which emphasizes continuous adaptation and responsiveness to changing circumstances, enabling teams to address emerging challenges and opportunities in real-time.

Throughout the progress and implementation of the project, scope may change and new requirements or aspects might pop up. This is a natural part of the process and must be accounted for during the initial stages. Be realistic and practical about the feasibility of including these changes, since not all changes are the same. Major changes may add value, but may derail the originally stated objectives, outcomes and deliverables. So these may need a hard look and decisions made on how to address them. If such changes are considered for inclusion, get consensus and approval from stakeholders - while also highlighting any significant impacts it might have on pre-agreed aspects of the project.

Gaining a thorough understanding of requirements and expectations is key, but it is often the case that these will change over time or miscommunication can occur. By remaining flexible, and keeping a constant flow of communication, you can keep up to date with the state of affairs with your key stakeholders. As things change, you'll often need to refresh your understanding of stakeholder's needs, and pivot your current plan to enable business objectives via your security program. Hold regular stakeholder meetings, and be sure they are dialogues from all sides so you can clearly manage expectations, and adjust your plan to accommodate the stakeholders' needs.

🤑The best way to win stakeholder buy-in and approval is to provide information on risks and expectations in ways relevant to them. This clicks the mind of many stakeholders more than other information. 📜This requires you to prepare a report or email of some sort, the information at minimum should have the following: 💠Risk assessment and impact. 💠Project outcome vs investment. 💠ROI projection on the investment done. 💠Research on similar security incidences. ✅The risk assessment should highlight the probability of occurrences of security incidents vs measures put aside. ✅Do not forget to explain about the security resilience gained after such projects are successfully executed. ✅Get data on similar incidences, do enough research.

Security professionals sometimes make the assumption that stakeholders are fully aware of and value the role of security projects; and hence their co-operation and support is taken for granted. But it is not always so. It is the duty of a security professional to create a culture of security, which includes sharing knowledge, showing demos, presenting use cases, demonstrating methods and logic on how certain decisions are arrived at (like CVSS score for risk rating), present authoritative sources of best practices, etc. This will create an increased sense of appreciation from the stakeholders and they maybe more motivated to collaborate and work with you on common objectives.