Choose Your Own Culture
It's easy to say what culture you want ... but do you know how to get it? This newsletter originally appeared on the DuhaOne substack.
Leadership Moment: Empty Platitudes
Since I have two teenagers, this summer has included college scouting, with our last two weeks including 4 college visits. At one of them, a very large state school, the person running the information session said, “There are a lot of ways to make a big school feel like a little school. There’s no way to make a little school feel like a big school.” I could nitpick, given that a previous visit had been to a very tiny school – 150 undergraduates – which had a dual degree program with a neighboring Ivy as a counterexample (but that argument isn’t the point).
What I found in the session and tour was that … there were no examples provided. Everything shown off had a big school vibe. A student could work to create a small clique, but there was only one program, which we heard about later, that even remotely felt like a smaller community.
It takes a lot of work to make a large organization “feel” like a small organization, and that’s expensive work. The benefits of a large organization – scale, diversity, specialization – are all ones that make it more effective, and it’s an uphill battle to take advantage of those benefits while keeping the feel of a small organization. It takes both support from senior leaders, and direct effort by line managers to make it happen.
One Minute Pro Tip: Document Your Culture
Hopefully, you have a vision for your organization: a definition of who you will be as you accomplish your mission and the tasks ahead of you. You should have values to support that vision, and you can evaluate if you’re succeeding by comparing your vision and values to the culture that your team experiences. Culture is the garden of the plants you celebrate and the weeds you tolerate, and they combine to define who your organization is to your team.
So start documenting your culture. Write down the things you celebrate - that’s easy, and fun to do. Notice compliments that leaders give within the team. Now, start noticing what you tolerate: every friction with the bureaucracy, every bad behavior that you uncomfortably let slide, every unfixed problem. Together, that’s your culture.
Appearances
Recently published
CISO Series podcast co-host: If You Care About Security, Maybe This Guilt Tactic Will Work
Recommended by LinkedIn
Future appearances
Aug 30: The Perkins Platform
Sep 20: SANS CISO Roundtable
Sep 20-22: HexCon 2023, Four Dimensions of Building a Security Program
Oct 20: Triangle Infoseccon, Leadership Track
Interested in having me speak at an upcoming event? Contact me via speakers@duha.co.
Chapter Cameo: Vision
Chapter 40 of 1% Leadership kicks off the start of the section on Organizational Leadership: You need vision to know if you're on a right path. The subsequent two chapters on Values and Culture help you define how you want to lead your organization, setting the stage for the remaining chapters’ lessons on how to actually do so.
Without a vision for your organization, though, you run the risk of your organization gradually evolving away from the things that make it special, and turning into an organization optimized to deal efficiently with whatever short-term problems you were presented with. That might be who you ought to be – but it might not be an effective organization.
Content: Board Cybersecurity Experience
When people talk about bringing security expertise onto the Board of Directors, there are often two subtly different, yet intertwined, questions at play. One is, “What does cybersecurity expertise look like on a Board?,” and the second is “What does a cybersecurity expert need to be a credible Board candidate?” Both of those might be aimed at changing the culture of your Board to one that can discuss cybersecurity risk issues.
This newsletter continues on the DuhaOne substack.