Organizational Views of IA - Information Assurance Architecture - page 117

5.9.2 Championing IA Outside the IA Environment

To be an IA champion takes broad shoulders, diplomacy, tenacity, and a bit of
ornery heel digging. Many practitioners like enterprise architects, system archi-
tects, project managers, business line managers, and executives do not see the need
for information assurance; these people need a lot of selling and education.
The FUD factor is not appropriate in IA leadership, nor is “the sky is fall-
ing” approach. Successful IA marketing delivers IA in small, digestible chunks all
positioned in terms of business benefit. For example, the enterprise architect will
relate well to the abstract visions of as-is, to-be, and transition states. Approaching
the EA with technical details about a wonderful new IDS product or firewall is
not appropriate. These are solutions to a would-be problem yet to be discerned or
defined. Going to the EA with an IA architectural plan showing an IA 2 Framework
and how to develop hooks into their to-be architecture presents useful information
in terms they are looking for.

5.9.3 Perception Management

Information assurance is a relatively unknown term. When IA is rephrased as com-
puter security , a knowing nod still gives way to a glazed stare of misunderstanding.
When faced with difficult business questions of IA justification, IA professionals
often turn to ever-deeper technical explanations, configurations, and reports. That
approach often widens the gaps of communication, understanding, and credibility.
The IA architect must communicate the IA story in terms readily understandable
and embraced by the audience, the project manager, customer, management, and
executives whose interests lie in investment, return on that investment, and share-
holder value, not the technical nuances of the latest IA wonder-widget.

5.9.3.1 Accommodate the People Factor in IA Perception

Perception management is the reason for distinguishing among governance, man-
agement, operations, and users; the architect must create the right message delivery
for the right audience. Communicate with people in terms they understand and
want to hear. For example, the CxO interests in IA are project investment, ROI,
internal rate of return (IRR) to hurdle rate comparison, market share, effect on rev-
enue per employee, cost of doing business, and aligning IA with a larger effort and
justification as part of overall cost of doing business. The bottom-line justification
is shareholder value in the private sector and constituent value in the public sector.

Fear, uncertainty, and doubt.