How do you communicate cyber risk and resilience to senior management and stakeholders?

Behind every person there are needs. Desires. Fears. Aspirations. Wants. So get out of intellectual analysis justifying position, which is most cases is fixed, and connect to the other person at the level of human needs. Understanding at stakeholders’s needs is of utmost importance when trying to communicate important changes Here are 3 things you can do to understand the other person on a deeper level and communicate more effectively: 1. Focus your attention on how you can enrich their lives in terms of their needs 2. Be curious and draw the other person out. People will talk at length about what matter to them and what bothers them. 3. Use strategic empathy to see the needs of the other person without perception and bias

i will start from the what of that risk. Then i will use risk example that already occurred in other place. Then i will close by using the consequence that we will have if happen in our site and what strategic objectives that will impacted.

I love what Anastasia says and completely agree. Your success at building relationships is going to be positively correlated to your risk and resiliance posture communication success. Adding onto one of her points further, using those relationships to further understand the context of their world. Your risk posture sits within the larger one of the organization, can you articulate that to some extent? If not, you're going to struggle to build a meaningful message. Security risk is contextual and requires resourcing to fix. Knowing priorities and where (and why) resourcing is being prioritized is important.

To connect to the other person better, you need to build rapport with them first. Rapport is the sense of being in sync with the other person and it’s build on a feeling of commonality. So look for things in common you can refer to in the conversation like family, recent holidays etc.

Yes...and no. Keep things simple and concise, but wherever possible, educate in a way that resonates and is retained. Introduce the occasional technical term or jargon and use it over and over again consistently until you've upped the education level of your executive team and they have talking points to head out into the world with. Security is the name of the game for a lot of companies now, and having an educated stakeholder team will become more important. Don't dive too deep and drown everyone, but do consistently educate where it makes sense to do so.

This is a tougher one to do, but is essential to staying relevant to the business as well as the environment. What are the strategic goals? Where and how are they being resourced? Here is where you can tell your story of how security needs to be matured and tailored in a way that makes sense to the organization that you work in. Relevancy and prioritization reigns supreme when it comes to planning work with other groups.