You're caught in the middle of an IT and HR clash over cybersecurity. How will you bridge the gap?

The complexity within the technical terms and the "namerisms" will often scare away the individual. More often than not, we will see people resisting or avoiding proper learning process with the excuse of being too complicated. I do believe that if HR and IT can work together they will find a clever solution to explain and exemplify to people that technology, security and privacy are already part of their daily routines, with significant impacts to their personal and professional lives and that people actually understand more than they realize it. The knowledge and awareness are both there, but it is a must to reach out to people with clearer explanations, resourceful examples, putting the individual at the center of the discussions.

To bridge the gap between IT and HR over cybersecurity, facilitate open communication by organizing a joint meeting. Encourage both teams to express their concerns and objectives. Highlight common goals, such as protecting company data and ensuring employee safety. Develop a collaborative plan that addresses both technical and human aspects of cybersecurity, fostering mutual understanding and cooperation.

Every time when any new security controls are added there is always a registance from employees,here before implementing any new security controls we discuss this with the Management and senior leaders and then only do the implementations to avoid conflicts.

One effective approach I’ve found helpful in navigating the clash between IT and HR is utilizing the balanced security prism. This framework fosters a collaborative environment that prioritizes functionality, usability, and security. It encourages both departments to work towards a shared goal: improving the organization’s cybersecurity posture while also supporting employee engagement and productivity. By promoting clear communication, joint initiatives, and a commitment to continuous improvement, the gap between IT and HR can be bridged. This collaboration ultimately leads to a more secure and cohesive organizational culture that benefits both the workforce and the overall business objectives.

'In the midst of an IT and HR clash over cybersecurity, it is crucial to establish open communication channels and foster collaboration. By promoting cross-departmental training sessions and workshops, both teams can gain a better understanding of each other's priorities and work towards a common goal of enhancing cybersecurity measures. Emphasizing the importance of teamwork and knowledge-sharing can help bridge the gap between IT and HR, ultimately leading to a more secure and cohesive organizational environment.

On the flip side, HR's role is just as critical. They are the ones who understand the human element, ensuring that policies are not just secure but also fair and supportive of employee well-being. It's essential to remember that cybersecurity policies shouldn't feel like a burden to the employees. HR's insights into how people interact with technology can help shape policies that are both secure and user-friendly. By acknowledging HR's expertise in managing people, we create a more balanced approach that considers both security and our team experience.

When facing a confrontation between IT and HR regarding cybersecurity, bridging the gap requires a strategic approach that combines technical understanding, empathy, and clear communication. Here’s suggestions to address the situation: 1. Understand Both Perspectives 2. Establish Open Dialogue 3. Identify and Agree on Common Goals 4. Develop Joint Solutions 5. Implement and Monitor 6. Promote Collaboration and Continuous Education 7. Document and Communicate Resolving a confrontation between IT and HR regarding cybersecurity requires a collaborative approach, focus on common goals, and effective communication.

A healthy cybersecurity organization has a good relationship with HR, legal, IT, and the broader Engineering organization. Security leaders should always present their plans to the aforementioned groups when relevant, and take their feedback into account when developing security policies. For example, a good incident response plan includes what to do when a user or employee is affected by the incident. HR and Legal will certainly have perspectives on how best to handle the communications that take place with the affected party, and may also have opinions on how to handle the investigation as ethically and fairly as possible.

To add to this session, I would say that culture is the base of a company's structure. Without the culture a company will not be able to execute its strategy twords it's long-term goals. One of the strategies must be cybersecurity, as businesses becomes more and more reliable on data analytics and technology. With that in mind the whole approach to people's strategy must be redesigned to consider those relevant changes.

HR should consider a few new responsibilities alongside IT/IS, such as: 1. Talent acquisition - where can we find those brilliant minds that will help navigate this new landscape 2. Talent retention - do we have a strategy to handle a very competitive market with regards to cyber and privacy talent? Do we consider within the benefits the specific certification or recertification of our talents? Can we support that? 3. Hiring and resignation procedures - do se support IT on building profiles and the type of access each one needs? Do we support the company on properly tracking the termination of contracts and all that is implied in it? 4. Communication - how can we simplify a technical message to build a privacy/security centered culture?

Emphasize that both IT and HR departments ultimately share the same overarching objective: protecting the organization from cybersecurity threats. By highlighting this common ground, you can foster a sense of unity and collaboration. Both departments need to recognize that their combined efforts are crucial to safeguarding the company's data, systems, and reputation.

At the end of the day, both IT and HR are striving towards the same overarching goal. A secure and productive workplace. It's about aligning their efforts to ensure that security measures don't stifle creativity and productivity. As a founder and CEO, I've seen firsthand the magic that happens when these two departments come together. It's about fostering a culture where IT and HR can collaborate, communicate openly, and understand each other's challenges and objectives. When we align their goals, we create a more cohesive strategy that benefits the entire organization to Roar.

The first step in bridging the gap is recognizing that IT and HR share common cybersecurity goals: protecting the organization and its employees. Both departments seek to prevent data breaches and maintain a secure work environment. By focusing on these shared objectives, you can foster a sense of teamwork and collaboration. IT can provide training on cybersecurity practices that HR can integrate into onboarding and employee development programs. The IT department is responsible for implementing and maintaining security systems, while HR is responsible for ensuring that all employees receive adequate training and are aware of security policies.

Suggestions: Continuous Feedback: Establish a feedback system where employees from both departments can suggest improvements in communication and security processes. Continuous feedback helps identify issues before they become critical. Shared Goals: Set common goals for IT and HR, focused on improving cybersecurity. Shared objectives reinforce the idea that security is a collective responsibility and promote collaboration. Training and Capacity Building: Invest in training programs for both departments, focused on cybersecurity best practices. The more informed employees are, the more effective their contribution to the organization's security will be.

Establishing clear and open lines of communication between IT and HR is essential. This includes regular meetings, joint task forces, and shared communication channels where both sides can discuss concerns, share updates, and work on strategies together. Encourage transparency and ensure that both departments understand each other's roles and responsibilities in the cybersecurity framework.

Here's the thing about communication: it's about listening and finding the common ground between seemingly opposing goals. The "So What?" Factor: Don't let either side get stuck in technical jargon or HR legalese. Translate concerns into business impact. Does a security policy hinder hiring top talent? Does a lax onboarding process increase breach risk? The "Translator" Role: Find someone who speaks both languages. Maybe it's a tech-savvy HR rep, or a security analyst with people skills. They can bridge the gap between the two departments. "We" Not "They": Frame the discussion as a shared problem to be solved, not a battle between departments. Emphasize that everyone's goal is to protect the company and its assets.

Suggestions to improve and enrich this communication: Regular Meetings: Establish periodic meetings where IT and HR can discuss their strategies, challenges, and progress. These meetings should be a safe space for exchanging ideas and resolving joint problems. Joint Workshops: Organize interdepartmental workshops that address relevant cybersecurity topics for both departments. This not only improves mutual understanding but also promotes team cohesion. Dedicated Communication Channels: Create specific communication channels, such as a Slack or Teams group, where cybersecurity information can be regularly shared. This keeps everyone updated and facilitates ongoing collaboration.

HR manages staffing, including hires, role changes, departures, temporary staff, and contractors, and oversees the organizational structure. This impacts user access and identity management to company systems. To manage system access, HR must regularly inform IT about any staff changes. This keeps access rights updated and removes unnecessary privileges and accounts. It would be beneficial to have standardized procedures or automated systems in place to share this information between HR and IT. Moreover, system owners should regularly vet user access rights to ensure privileges are granted on a need-to-have basis. This way, managing access rights can be done efficiently and securely.

Promote continuous education and training for both IT and HR staff on cybersecurity issues. This can include joint workshops, seminars, and online courses that cover the latest threats, best practices, and compliance requirements. By fostering a culture of continuous learning, both departments can stay informed about new risks and improve their collaborative response to potential incidents.