1. Cyber Strategy Workshop for African Union Member States July 23-27, 2018 Addis Ababa, Ethiopia

2. Understanding the Forces of Change in Cyber Capacity Building

3. Change Happens
In every situation, there are forces or factors that support change, and forces or factors that resist change
Cyber Capacity Building brings significant change, in technology, processes, work skills, transaction speed, risk, personal relationships
Cyber also brings opportunity, in connection, access to knowledge, spread of technologies, transparency, investment and innovation

4. Example Drivers Against Change
Many factors may weigh against change related to cyber capabilities:
Resourcing (fiscal and human)
Comfort with existing, well- established processes
Fear that technology will undermine traditional values and skills
Concerns about shifting power balances
Cost or complexity of technology
Long lifecycles (e.g., infrastructure)
Current Laws or Policies

5. Example Drivers for Change
Many factors may also support change related to cyber capabilities:
Evolving technologies or changing risk factors
Societal Expectations/Demands
Desire for speed & transparency in services
Top-down mandates
Improved security in key systems and services
Credibility of government
Growing cybercrime
Jobs and investment

6. Force Field Analysis Example
In this example, a company is considering changing their management structure from hierarchical to hub-spoke
From Gamestorming, Dave Gray, at

7. Force Field Analysis Exercise
People
Processes
Technology
This exercise looks at the forces for and against increasing government emphasis on cyber capacity that may be common among the participants’ countries. It is framed in terms of P/P/T/I, but other environmental or other aspects may emerge—these can be captured around the edges. This slide or a similar handout can be in the take-away package—we can do this on a central whiteboard in breakout groups (preferably after the initial intro slides/discussion in plenary). Emphasize that it is meant to help consider all perspectives of a change problem and that it can help illuminate otherwise unnoticed or hidden factors influencing the strategic environment and help clarify stakeholder perspectives.
Infrastructure

8. Common Reasons People Resist Change
What Does That Mean?
What Can We Do?
Misunderstanding the need or rationale
People may not understand the risks and opportunities associated with cyber
Explain cyber risks and goals in narrow, simple terms that are meaningful to individuals
Concern that things will be worse
People may fear that changes will make even more things go wrong
Listen to their fears. Many reflect a lack of information about the technology or the plans to pursue it
Fear of Irrelevancy
Cyber requires new skills—many people may fear they will not be able to compete
Discuss training options and other types of compensation for people with traditional skills
Saturation
Cyber is everywhere. People can’t process it anymore
Focus on communicating only those aspects that are immediately relevant to people, and explain why they matter in personally relatable terms
Perceived Disadvantage
People feel that building more cyber capacity will shift resources away from them
Communicate the role of cyber in national prosperity and connect that prosperity to them. Explain why spending resources on cyber is important.
Lack of Communication/ Inclusion
People simply don’t feel like they know what’s going on or why
Communicate at every opportunity—goals, reasons, plans, expected benefits!

9. Take-aways
This exercise is not unique to cyber—it can be used to help groups understand the reasons various stakeholders support or resist change, and communicate their perspectives to each other
It can be used to identify environmental or contextual factors that are hindering a desired change, or forcing an undesired one, so that those factors can be addressed
It can help identify stakeholders and their roles, as well as processes or institutions that might affect or be affected by a particular change
We recommend trying this exercise on some minor change when you return home, in order to familiarize other stakeholders with it, and to facilitate the kinds of discussions that foster good internal understanding and partnerships