Team Building
Nothing will delay a project more than people who just cannot get along. As an information assurance (IA) professional, whether you’re an employee or a consultant, you may have to become the subject-matter expert (SME) of teamwork to keep the project on track and on course with your contract. You will have to foster good working relationships with all team members and help to smooth out the rough places.
The IA Professional’s Toolkit Part 1
Security consultant Gordon Merrill continues his series on fundamental management tools for IA professionals in general and IA security consultants in particular. His insights and recommendations will also help clients choose consultants wisely and judge their performance appropriately.
* * *
The project you are asked to consult on may not be the only problem with the company’s security solutions or indeed, with their management processes. You must word your proposal and your contract with each client so that you do not inadvertently become responsible for areas of security and of general management that you do not intend to address in your project and contract. The same principle applies to IA employees: be careful not to allow mission creep to consume your life and ruin your chances of definable success when taking on internal projects.
Depending on the size of the organization, you may be working with an information technology (IT) team of eight people or a group of hundreds of staff members. Large corporations may have a team for security architecture, one for security compliance, one for threat abatement, and so on. It is important to have all the players in the room when you talk with them about the project, the contract, the scope, the cost, return on investment, and so on.
If you are an external consultant, you should request (require, demand politely, include in your contract) that one person from each affected team within IT security be part of the meeting. Every team involved in the operational flow of the project must be represented in the project team or project committee. It is critically important that you identify the people who must sign off on project stages to keep the project progressing and that they officially be part of the project team. Failing to include key participants in the planning can result in information gaps, contradictory data, policy reversals, interference, stonewalling, backbiting and much more stress than anyone should have to bear.
Sometimes you may be asked to be the SME on a project team already in place in a corporation. You may have limited influence on the actions of the team; however, you may find yourself constructively serving as a coach and mentor to the project manager or leader. Two areas you should be most concerned with are:
(1) Failure of participants to provide their deliverables and milestones on time, thus delaying the project and your ability to participate as stipulated in your contract, and
(2) The potential for scope creep or a change in scope imposed by client personnel despite the terms of your contract.
For you as a consultant, either issue can be a serious problem. Although most consultants realize how important it is to include clauses in their contracts that require renegotiation or time-and-materials charges for scope changes, many forget to build into their contracts additional charges for delays caused by client personnel which cause them to work on the project longer than planned – and therefore end up working without payment.
Delays and scope creep in the contract with one client will damage your business and your availability to other clients for projects to which you may have committed yourself. You cannot afford to damage your own reputation and offend both your current and your future clients at the same time through lack of proper planning in your contracts.
[MK adds: consultants starting their career would do well to have their contract template checked by an attorney with experience in consulting services contract law. The cost of an hour or two of attorney fees will be repaid manyfold if you can avoid even one argument with a future client.]
Some of these principles are discussed in detail in a useful textbook by S. P. Robbins and T. A. Judge (2007). Essentials of Organizational Behavior, 9th Ed. Pearson (ISBN 978-0132431521).
As mentioned in Part 1, an excellent reference for project management of all kinds is the Project Management Institute’s Fourth Edition of A Guide to the Project Management Body of Knowledge (PMBOK® Guide).
In the next part of this series, Gordon discusses business justification.
* * *
Merrill, MSIA, currently lives and works in Tennessee. His career has taken him to 48 of the 50 states and to six foreign countries. Gordon’s information assurance background has included working for major computer companies such as IBM, managing IT projects for Fortune 250 companies in the risk management field, owning his own business, and working as a private consultant. You may contact him by e-mail.
This series is based on some of the papers Merrill wrote during his MSIA Program at Norwich University from 2007 through 2008. Merrill and I have collaborated closely in rewriting his research for this series.
