The Priority Matrix

Prioritisation and Execution Tactics to Manage Workload

Everyone has, or should have, their own definition of success. It will look different for everyone. However I'd hope that most people's definitions would include being proud of doing a high-quality professional job; making a positive impact on the world, organisation, or domain in which you work; and doing this without so much stress that you burn-out or damage your relations.

One of the realities of life when working in cyber security, and other high change roles, is that we will never be done. Threats, technology, organisations, society, regulations, and product lines all evolve - and we must constantly learn and adapt along with them. This creates a fire-hose of things we could be working on at any given time, and poses the challenge of determining where our limited resources should be focused to produce the greatest return on investment with regards to risk management. Below I outline one of the mechanisms I have developed to deal with this; though I wouldn't consider it solved - it does help identify a way forwards.

Introducing the Priority Matrix

When your role involves judgement with respect to which activities you should be focusing on I have found a two-step process of triage works well. First assess importance and urgency, and use this to identify which bucket on the Eisenhower Matrix the task falls into. Then select which of the available tactics for managing it will be used in order to focus your effort in the highest impact areas. This model builds on the original matrix, outlines some of the key tactics I have found effective in these area, where effort should be directed, and why. I will expand more on each of the items below.

Determining importance

Importance is subjective however key considerations are going to be the consequence should it go wrong; the importance of any relationships that depend on the activity; and how costly it would be to remedy a mistake (e.g. is it a strategic decision?).

Determining urgency

Urgency is usually more clear-cut however there is still a lot of nuance. It's always worth asking "When do you want this by?" and also determining when it is required by. Be certain you understand where those dates have originated, and where there may be flexibility or very hard limits. Likewise with regards to scope. How much of what they ask for do they need and by when?

A Note on MoSCoW: Must, Should, Could, Won't

I first came across this about 15 years ago in software engineering and it has stuck with me ever since. It is an intuitive and straightforward mechanism to give importance labels to activities and tasks. To maximise the value it is worth being quite clear what we mean by each.

• MUST: The challenge here is being strict with ourselves on what MUST really means. It should be exceptional, or exceptionally bad, to miss an item identified as something that must be done. Often only part of a delivery will be a MUST though so it can pay to split tasks out further. Likewise some routine activities will be MUST too.
• SHOULD: Much of what we do is likely to fall into this category. These are all the important things we should be doing to drive change and make a meaningful impact.
• COULD: These are opportunities; things to do when they align with other important activities; where there is an opportunity to go above and beyond; or where they represent low hanging fruit.
• WON'T: The often overlooked priority - sometimes the best thing to do is to be clear and explicit about what won't be done and why.

Important and Urgent

These things MUST be dealt with, promptly. They are also important so need to be handled well. The danger here is that this could mean they squeeze out other even more important activities; things that are going to be long-term more beneficial. It is also important to manage the proportion of activities that are considered to be MUST as if it is approaching your capacity you risk dropping something that truly matters and it will lead to stress and burnout. To avoid this trap try the following tactics:

1. Timebox it; how much time do you need to spend on it? Can this be divided into the urgent tactical piece, and a strategic element that can be prioritised in bucket (2)? Can the most important aspects be done now, and the rest be dealt with in buckets (3) and (4)?
2. Tactical convergence on strategy is a key tool in continuous process improvement. It's the business equivalent of sneaking vegetables into your kids meals - delicious and good for everyone. For this to work you need to have defined a strategy so you know your target state (this is urgent and important!). When weighing up tactical options take into account which ones will move you closer to the target vs. further away. Be prepared to invest or advocate for a little more time or effort now for something that aligns with the longer term strategy. Is this an opportunity to advocate for greater investment in the strategy? Be particularly wary of taking tactical actions that could present significant obstacles to getting to the strategic solution in the long-run. If there's interest I'll write more on this at a later date.
3. When are we done? Important and urgent tasks can still be absorbing significant time and energy long after they should have been shelved. Define outcomes early, what does done look like? What is the acceptance criteria? Make sure there is a clear plan to "get to done" and draw a line under it. Be careful that your action list doesn't have long-running or strategic activities unless they are clearly marked as such and moved from the urgent delivery.
4. When you have your action plan for getting to done make sure there are names and owners against them. Seeing their name on a list of important/urgent actions should never be the way someone learns about an action; always ensure the action owner or person accountable for prioritisation has accepted the action first. Once they've accepted have them provide a date they expect to be done by. If they can't meet the timelines who else could do it or make a priority call? Circulating actions then supports and highlights responsibility and progress.
5. Check-in regularly on progress, especially with regards to long-running tasks, tasks on the critical path, or tasks which will become critical path and have long lead times. Make sure people know why their task is important and urgent. Small independent tasks lend themselves to statistical tracking through a burn-down chart. Larger more complicated elements benefit from a more detailed dependency / critical path analysis.

When all the sub-tasks identified as important and urgent are completed send around a note thanking those that helped to deal with it promptly. Advise how other aspects will be treated: what is strategic and has been moved to the road map / forwards plan (bucket 2)? What is less important and will be dealt with as BAU (bucket 3)? What won't we be doing and why not (bucket 4)?

Important but not Urgent

This is the place you want to spend the majority of your time. It is the opportunity to be strategic, pay down tech debt; invest in activities that will increase and act as a force multiplier with regards to your productivity or the quality of your service. And therefore in turn represents the biggest opportunity to have a positive impact and leave things better than you found them. One of the first areas to focus on is anything addressing the root cause of the fires in buckets (1) and (3); these are costly distractions and should be tackled early.

1. This is very similar to the timebox in the bucket (1). Except here the goal is not to limit the time to the box, but rather to ensure a minimum amount of time is spent on making meaningful progress towards an important outcome or activity. This can be achieved by booking time in your diary, or setting up working sessions.
2. This is where we really need to have a clear strategy and map out a deliberate path to achieving it. What is the end-state vision? What will it take to get there? What are the key obstacles that need to be addressed. Many people never leave buckets (1) and (3) and therefore never engage in strategic improvement at great cost to themselves and their organisation.
3. Defined milestones help to give some structure and goals to what may otherwise seem like a distant and elusive mirage. This should represent a series of tactical intermediate deliveries.
4. Iterative delivery takes advantage if improvements and value early in a process giving a significantly improved return on investment as well as allowing stakeholders to see the direction you are going and the value it is bringing. It is worth looking at this article on MVP when considering what these deliveries look like. It may be a touch more work on each delivery but it will make a world of difference to your outcomes.
5. Learning and Development will also often fall into this category. Investing in ourselves and our teams, if done thoughtfully, will increase the quality of decision making, work, and outcomes. This will also often mean less rework and more productivity. It is one of the reasons I'm writing this blog - for my teams. It costs me time now - but it will pay back many times over as well as hopefully benefiting others more widely.

It is easy to get side-tracked into "science projects" or "ivory towers" once you've managed to get some time allocated to this sector. That is why the agile product development methods are so important. Early incremental delivery of meaningful value keeps everything grounded. Also consider the Pareto Principle - there's a good chance that doing 20% (the MVP) of each of your should items will deliver the vast majority of the value. Then re-evaluate the roadmap and consider where the next tranche of value is going to come from.

Not Important but Urgent

This might still be important to someone else, be kind and empathetic! Consider the context of what you are doing. You should seek to minimise the time spent doing these activities. Many things in this sector need to be done though - here's some strategies for reducing the distraction:

1. Avoid: Can we head this sort of activity or task at the outset. Are they in fact being misdirected? Could we reset some expectations to avoid it coming to us in the first place?
2. Reject: When something does come in is there an option to simply say "no" in the most helpful possible way? Ideally with some process improvement or education such that we avoid it ever coming to us in the future (1).
3. Empower: Are people coming to us for decisions which we could define some guidelines / guardrails around. And some gates (triggers for escalation). Could we encode some principles that would allow people to make informed decisions?
4. MVP / Automate: If we really must do it what is the least we can do without letting anyone down? Might it be possible to automate all or part of the activity? If the time payback interval of increased productivity is meaningful this automation is in fact a key strategic activity to include in bucket (2).
5. Delegate / Transfer: Could this be handled by someone else on your team? You may need to use the Empower strategy above to facilitate this. Even if you can't delegate a task you may be able to transfer it to a person or team who are better placed / more suited to handle it. I have also written this article on effective delegation which you may find useful: Active Calibration

Not Important and Not Urgent

Finally deciding and being explicit on what we Won't do is a critical and often overlooked activity. It is quite liberating to explicitly take something off our backlog. It also helps the stakeholders interested in it as they can consider alternative options. Given the overlap with the previous section I will start from 4.

4. Reframe: Is there a different way of looking at the problem or task that either makes it not relevant anymore, or changes the priority or owner? For example a different approach that means it's no longer needed?

5. Defer: Setting an explicit date at which point an activity or decision will be revisited is helpful. This might be 6 months or a year out. But by keeping it on the list and checking in periodically we can be confident that circumstances haven't changed making it more important or urgent than was previously the case.

Summary

The biggest constraint in most businesses is the availability of skilled people. Therefore maximising our productivity, and ensuring effort is being directed to the most valuable activities is crucial. Likewise investing in activities that improve people's productivity and quality of work.

Determining first what MUST be done, and minimising it. Reducing the time spent on things that COULD be done. And deciding what WON'T be done; maximises the time available to spend on the things that SHOULD be done - which is where the magic happens. Too much MUST is going to lead to stress and burnout. People's MUST/SHOULD ratio is also a key indicator of capacity to take on new initiatives.

Applying the two stage process of considering all BAU (ongoing), and one-off activities to determine which quadrant they fall into, and then selecting the appropriate tactics to apply to them, can be a powerful mechanism to coordinate, communicate, and decide on the most productive course of action. In a world where there is always more work than time available we must adopt proactive strategies to manage or we will, like Icarus, soar briefly but ultimately burn out.