Before starting any cybersecurity project, asking the right questions can make a huge difference. I like usingĀ Heilmeier's Catechism. I suspect that most of you, knowingly or otherwise, do the same. While my typical focus is on cybersecurity projects, this does apply across all domains.

Named after George H. Heilmeier, a former DARPA director, this set of questions ensures clarity, feasibility, and impact in any innovative endeavor.

Here are the critical questions of Heilmeier's Catechism:

  1. What are you trying to do?Ā Articulate your cybersecurity objectives clearly without using technical jargon. Preferably, do this in business-relevant terms.
  2. How is it done today, and what are the limits of current practice?Ā Understand the current state of cybersecurity measures and their limitations. What are the existing solutions for your problem, and where do they fall short?
  3. What's new in your approach, and why do you think it will be successful?Ā Highlight the innovation in your approach. Is it a novel approach? How does it address the limits referenced above?Ā Have you seenĀ this approach work somewhere else? Explain why your method has the potential for success.
  4. Who cares?Ā Identify your stakeholdersā€”businesses, government agencies, individual usersā€”and explain why they should be interested in this project. How will it benefit them?
  5. If you are successful, what difference will it make?Ā Consider the impact of your success. Will it significantly reduce cyber threats, protect sensitive data more effectively, or make digital interactions safer for everyone? Sometimes, success is also about reducing the 'security friction'- the barriers and complexities that impede the effective implementation of security measures - while controlling the risk. Friction is an important aspect to consider in cybersecurity projects, as it can affect end users' experience, usability, and acceptance of the solution.
  6. What are the risks and the payoffs?Ā Analyze the potential risks involved, such as technical challenges or implementation costs, and weigh them against the expected benefits like enhanced security and user trust.
  7. How much will it cost?Ā Provide a realistic budget estimate for developing and deploying your cybersecurity solution. Consider both initial development costs and ongoing maintenance expenses. Remember that beyond the technology cost, there is always a people cost.
  8. How long will it take?Ā Establish a timeline for your project. When can stakeholders expect to see results? Define key phases from development to testing to deployment.
  9. What are the midterm and final "exams" to check for success?Ā Define your milestones and criteria for measuring success. What benchmarks will indicate progress? What metrics will determine the final effectiveness of your solution?

For those of you who know me, I always have to add something, so here is theĀ Avivi Corollary to the Heilmeier's Catechism:

  1. Does the payoff justify the cost and time investment?Ā Using another expression I've seen floating around, do not apply a $100 bandaid to a $5 cut.
  2. What is the expected lifetime of this project, and how will you measure ongoing success?Ā Some projects are one-and-done, but some will be in place for several years. For the latter, it is essential to consider ongoing Key Performance Indicators (KPIs) and whether we will be looking to replace or evolve the solution.

Making sure I can answer each of these questions, preferably without using technical jargon, I can ensure that the project is not only ambitious but also achievable and impactful.

āœØ Whether you're developing new security software, leading an incident response team, or spearheading a new cybersecurity initiative, Heilmeier's Catechism empowers you to guide your planning and decision-making processes. It encourages us to take a more strategic approach to our goals, methods, and the broader implications of our work, instilling a sense of capability and control.

As a bonus, answering these questions jargon-free will allow you to communicate this to all stakeholders, making them feel valued and considered in the process.

#Cybersecurity #Innovation #Leadership #ProjectManagement #HeilmeiersCatechism #StrategicPlanning