1. Cyber Strategy Workshop for African Union Member States July 23-27, 2018 Addis Ababa, Ethiopia

2. Managing Change and Other Keys to Successful Implementation

3. Objectives Why do we care about implementation?
Discuss planning vs. implementation
Why to use change management principles in implementation
How to use framework in implementing cyber strategy initiatives

4. Why do we care about implementation?
Developing a National Cybersecurity Strategy
(Day One)
Implementing National Cybersecurity Plans
(Day Two)
Who will lead on different goals or plans?
How do we decide which internal and external stakeholders do we need to engage?
How do we develop our communication strategy and message?
How do we determine what training needs to be developed?
How do we align our goals with resources and accountability?
8 Preparatory Questions
Identified readiness for planning
Developed list of national areas of attention
Strengths and Challenges
Examined 8 Key Elements of Strategy
Self-Assessment
Building a Strong Foundation
Establishing Goals
Leadership
Risk Management
Involving Stakeholders
Strategic Foundations don’t stop after plan has been developed– Need to continue to leverage leadership and stakeholders in implementations
Without these considerations, a strategy will sit on the shelf or not achieve desired outcomes!

5. Going from Goal to Implementation
Example Goal: Reduce vulnerabilities to phishing threats
How can we make progress towards goal?
Consider:
Leadership/Roles & Responsibilities
Stakeholder Engagement
Communication
Training
Workforce Alignment
Important to consider transition in strategy development

6. Planning vs. Implementation
Involvement of group of key decision makers
Involves analysis of current landscape and planning for future
Relates to developing and prioritizing goals
Implementation:
Requires broad level of support from many levels of an organization
Relates to figuring out how to make change happen and make it stick
Focus on identifying the ways that strategy will occur
Example: Goal may be to getting a job working for a government ministry. What are the steps? In order to achieve this, required talking with different people to understand landscape/how to approach, going to school and learning from professors about the profession, figuring out where the jobs are, applying for internships, going to networking events, understanding the job application process, learning what job interviewers were interested in.
Take 2 minutes to talk with your neighbor about when you had a goal that you had to navigate in order to implement that goal. This could be a professional example or a personal example. It could be a situation where you wanted a new job. How did you go about taking the steps to plan out a way to achieve that goal?
Where are we going?
What are doing to get there?

7. Why Use Change Management Principles in Implementation
The goal of the people strategy is to minimize the disruption of activities and the typical dip in performance that accompanies change.
During Change in Strategy: Minimize the risk to key goals
Post Implementation: Optimize and benefits gained
Performance
(+)
(-)
Time
Baseline: Identify drivers and barriers to change
It has been shown that when a change first occurs, there is a decrease in performance. Change management mitigates this dip and seeks to optimize organizational performance throughout the process.
Example: Think about when you changed jobs the last time. At your old job, you were sending s and new who the person to go to for dealing with the mail. But when you start a new job for the first time there is a learning curve. The first week you had to learn who the players were, get your computer set up. Even if that change to the new job was a better fit with more opportunities, there is an initial dip in your performance as you adopt the new change. If that job has better opportunities and is a better fit for you, you will ultimately be able to perform higher, but it took you some time to adapt to the change. Change management is about making that transition as efficient as possible.
During Strategy Implementation: Encourage the acceptance of the innovation

8. Implementation Approaches
Change Management Framework
Implementation Approaches
Leadership
Identify and align champions and senior leaders to program goals, priorities, and new operating norms and behaviors
Stakeholder Engagement
Communication
Training
Workforce
Alignment
Analyze stakeholder groups, their concerns, and resistance levels, and engage stakeholder groups for impact
Build the organization’s communication capability, and develop and execute a communication strategy
Identify gaps in knowledge, skills, and abilities and develop a plan to address
Design and implement adjustments to the organizational structure, roles and responsibilities, reward systems, etc.
Present
How things are currently done…
Consider people, process, and technology.
Implementation of Future Goal
How things will be done…
Consider changes for people, process, and technology.
2 Minutes: Think to yourself
2 Minutes: Share with a partner
2 Minute: Share with the group

9. Applying the Framework: Scenario
Employees are unaware of phishing threats
Employees click on malicious links
Employees freely enter sensitive information
What steps are needed?
Awareness of phishing threats
Mouse over and question all links
Employees know to be cautious entering personal and financial information
Obutuland Land has a goal to reduce vulnerabilities to phishing threats targeting government employees.
Present
Implementation
Goal

10. Implementation Approaches
Goal: Reduce vulnerabilities to phishing threats targeting government employees
Implementation Approaches
Leadership
Identify and align champions and senior leaders to program goals, priorities, and new operating norms and behaviors
Stakeholder Engagement
Communication
Training
Workforce
Alignment
Analyze stakeholder groups, their concerns, and resistance levels, and engage stakeholder groups for impact
Build the organization’s communication capability, and develop and execute a communication strategy
Identify gaps in knowledge, skills, and abilities and develop a plan to address
Design and implement adjustments to the organizational structure, roles and responsibilities, reward systems, etc.
Present
Employees are unaware of phishing threats
Employees click on malicious links
Employees freely enter sensitive information
Goal
Employees have awareness of phishing threats
Employees mouse over and question unknown links
Employees know to be cautious entering personal and financial information
2 Minutes: Think to yourself
2 Minutes: Share with a partner
2 Minute: Share with the group

11. Applying the Framework
Implementation Approaches
Leadership
Identify lead for developing a training initiative
Create vision and establish business case for phishing threats
Establish a workforce cyber training coordinator in each ministry
Stakeholder Engagement
Communication
Training/Education
Workforce Alignment
Hold town hall meetings within government ministries to discuss
Talk with employees about phishing targets
Develop communication strategy to reach employees
Hang posters in break rooms
Integrate training in employee orientation
Develop training to government employees on the risks.
Develop FAQs for employees
Identify metrics related to completion of training
Monitor click rates
Addressing Cybercrime through framework- use this framework tomorrow with different goal

12. Questions?