Definition:

A “Surge Deliverable” , surge week or surge sprint, is a period of increased work, it’s not quite “all hands to the pump” but is still a noticeable increase in effort.

Explanation:

Disclaimer: As always these posts are not aimed at anyone client or employer and are just my personal observations over a lifetime of dealing with both management and frontline associates.

1. , the word Sprint is not used so people don’t get confused by agile terminology[↩]

This is a long running subject for me and has impacted all the major projects I have worked on, often being the make or break factor, determining if they are successful or not. “Business engagement” is a phrase that is often used in a flippant way, thrown in as if it was a given.

It is not a given. It is not a given in any way, shape or form. Humans are tricky critters they pull in all different directions for all different reasons, and much to the surprise of their managers they often classify their needs as far more important than the orders they are under, but there are some general groupings that exist in nearly all corporates and there are a common set of engagements that you have to be on the lookout for, with the key being to empathise and take action on the engagement needs of groups different to your own.

The three different levels of engagement are going to be the same three as I have used in previous blogs, Lets go through them:

Stakeholders (The Fantasy Zone) :

What Engagement do you need off them?

1. Funds.
2. Political Backing and Authority

What do they need off you to provide their Engagement:

1. Proof that you can deliver.
2. Proof that your actions are competent, justifiable and provide ROI ¹.

This is the strategic engagement level, and it needs to be long term. Alas here we hit our first snag, strategic stakeholders are supposed to think like politicians, they are supposed to think long term, they’re supposed to think in terms of the good of the nation for decades in the future, but they don’t, they are still human. They tend to think in terms of the next election / financial year or even worse the next news cycle / monthly report.

So how do we fix this? we provide them ammo for them to fight off the pressures they are under, this includes

1. Status and proof that the budget and funding they are providing is being used correctly, and if there are extra costs and time slips that they are fully justified.
2. Evidence that this is still the correct path and if it is not, that we have adjusted the deliverable and direction to get the project back on course.
3. Knowledge and evidence that no one is going to pull a skeleton out of the closet and embarrass them in some form of power play.

If you provide these proofs to your stakeholders then they can maintain their engagement to the project, if you don’t, trust me they will yank their funding and without that, you are not delivering anything.

(Middle Management) The DMZ:

What Engagement do you need off them?

1. Access to SME’s ² , the real people who know how current processes work, Such people are often very hard to both find and gain access to.
2. Time: you need time from the business or Support services to get your program or process ratified and tested, and as operational levels are so tightly controlled normally, someone needs to sign off the initial loss in productivity that they will suffer in order to engage with you.
3. No stalling: If you don’t engage properly with the middle management then things grind to a halt, suddenly no decision will be taken without workshops, formal paperwork with every I dotted and T crossed. Time consuming “make work” will start to grow like mushrooms which will generate ill will all round.

What do they need off you to provide their Engagement:

1. Assurance that you are not going to disrupt their teams without some advantage to them.
2. Integration with their existing plans, most middle management already have plans for their teams as well as multiple other projects wanting their time, you need to work with them to reach a balance as your project will not be the only game in town.
3. Proof that you are not the latest stakeholder fad, projects come and go so often in most corporations that many middle management have become jaded, as when an exciting new project is suddenly dropped they are often left with not only partly completed infrastructure moves, but also an expense in committed resource that they now can’t offset.

In Summery: Middle management will already have multiple other plans going on, work your plans in with these and you stand a far better chance of getting support.

Operations (The Coalface) :

What Engagement do you need off them?

1. They need to actually use and accept the new system or process as a long term change.
2. They need to tell you the unofficial and undocumented quirks and work arounds that are being used in the current system so they are addressed before the new system of process goes into production.

What do they need off you to provide their Engagement:

1. Assurance that what you are doing will not lead to them losing their job.
2. Proof that what you are doing is not going to make their job harder or mean they have to do extra work for no advantage ³
3. Proof that what you are doing is not going to effect commission or end of month payroll.

The Operations area are the most important in a true sense, because ultimately they are the part of the business that actually makes the money.

1. Return on investment[↩]
2. Subject Matter Experts[↩]
3. Often projects that seem a great idea to back office just mean lots of extra work at the operational end without any visible improvement[↩]
4. Sound of Mark being sick at the cheesy line[↩]

Last month I got to go to my very first IISYG Meetup, now IISYG is one of the oldest Cyber/Security Groups in the UK, and up till now, I simply haven’t been senior enough or brought enough to the table to be invited as a member. I had seen it for years as a tantalising event that people went to, but other than the subject of its talks I did not know its contents, only that there was a number of senior guests speakers, and a lot of conversations about details in the security industry. So it was with much excitement I received an invitation and potted along to the House of Lords with my security ID, all suited and booted.

Now, the whole of the meetup is under Chatham House rules, which will make this review understandably vague, however it wasn’t its actual content that I wanted to review. It was about the fact that I have seldom enjoyed a professional meetup more, particularly as it was my first time, everybody was instantly friendly and likeable, easy to get on with and most surprisingly, there was none of the normal conference posturing, there was no titles or anything like that, I was engaged within minutes of walking through the door, and people said what they did, but not the level that they did it. when we did a quick roundtable of who was there, it was like a who’s who of security, massive industry representation across the board, incredibly impressive but not one of them was trying to me the most important ¹. It was a minimal name, title, and what they did, which was an indication of things to come.

This was a forum in which people share expertise, shared their knowledge and shared them in a way that everybody else could learn from, it was truly a safe space where you could ask for help, where you could repeat how you’ve done something and would do it differently again, or what plans you had, and people with decades of experience would help you address issues that they could see coming up for you. It was simply like that. there was so little ego in the room, it was unbelievable, just a vast amount of help and experience. conversations would go from deeply technical security details, to laughing and joking then back to serious. It was a very dynamic and very, very open experience.

I don’t know what else to say about it, other than I felt like the most junior person there and I have not felt that for a decade, also that in a couple of hours, I learnt more that weeks of Internet research and public conferences.

However, I did make one mistake. It turns out that even though it officially finishes at 1pm, people go to the pub, have lunch and keep the conversation going, and I’d already got stuff booked for the rest of the day. I’m not going make that mistake again.

1. Often on a new project when you do a round table, there will be a few people that can’t resist tooting their own horn, there was none of that here[↩]