We finish MSIA graduate Timothy Dzierzek's case study analysis of burnout and turnover in help desk and computer security incident response teams (CSIRT). This last part of three discusses how his case-study organization ("Smith & Smith" is a pseudonym) addressed the problems of turnover and finishes with recommendations for readers.

* * *

Smith & Smith took a number of steps to address the problem with the turnover of help desk technicians. Most of these steps were an effort to prevent the burnout of employees.

* First, the firm established policies that required all employees to take vacations. Employees failing to take vacation stopped accruing vacation time after a certain level. The firm also tasked managers with ensuring that employees took time off.

* Second, the firm provided an Employee Assistance Program (EAP) to help employees deal with stress and other problems that affect their performance. The EAP offers counseling to all employees at the firm’s expense. The firm’s EAP policy states, “[E]mployees experiencing personal problems are encouraged to seek assistance [from the program].”

* Third, the firm provides time for help desk personnel to attend training and technical conferences. The firm also reimburses them for the classes and any certification exams that they pass.

* Fourth, IT management involves help desk personnel in many firm-wide projects. Although not a job rotation scheme, it provides help desk technicians with the ability to work on challenging projects outside the scope of the help desk function.

The steps taken by Smith & Smith to address the burnout of help desk technicians have been notably effective. Human Resources managers there state that the firm has not lost a single member of the help desk to turnover in two years. Help desk managers have focused on expanding their staff levels instead of looking for replacements for vacated positions. In addition, conversations with help desk technicians revealed that they are happy with their jobs and look forward to coming into work. They feel that the firm provides them opportunities to get away from the stress and rigor of the help desk function.

Every organization should develop effective personnel management processes for its CSIRT by analyzing the approaches used by its help desk organization. By using the techniques demonstrated in this case study, readers can ensure that their CSIRT effectively manages its personnel and maintains adequate staffing levels to effectively respond to computer security incidents.

M. E. Kabay, PhD, CISSP-ISSMP, specializes in security and operations management consulting services. CV online.