Unlocking cyber security projects: The power of business analysis and change management

My presentation will focus on utilising skills in ICT and business projects, specifically in the context of cyber security initiatives and strategy development, while informing leadership throughout the process. Business analysis and change practitioners play an essential role in cyber security projects by effectively articulating the business problem when potential vulnerabilities are identified. I will present use cases demonstrating how these skills and personnel have been employed successfully, resulting in minimal disruption to business operations, and building cyber resilience.

Business analysis and change management skills can be crucial in cyber security, regardless of attendees' experience or their organisation’s capacity. These skills are just as important as technical ones, particularly in uplifting the organisation’s cyber capability and resilience.

First, I will run through how the audience need to identify the problem set when uplifting a cyber security capability in a multi-disciplinary team or when working with cyber security strategist. As a business analyst (BA) and/or change practitioner, it is important to articulate the problem to staff, stakeholders and leadership, minimise resistance to change. As a use case, in an Essential 8 project, my team found that some staff had unauthorized admin rights, compromising data access. The cyber team wanted to remove access immediately. However, to maintain business continuity, and manage internal customer expectation, I will explain the importance of undertaking stakeholder impact and analysis and change impact assessment, and engaging with affected teams.

Second, I will provide lessons learnt and using industry business analysis and change management frameworks to execute the changes, such as articulating the future state to key stakeholders (prevent unauthorised access to maintain confidentiality), documenting requirements and developing a communications plan which will be delivered depending on the audience.

My presentation will include a few real-world project examples from my experience (but not mention the organisations’ names), that relate to cyber security uplift such as a control in the Essential 8, restricting administrative privileges.

Finally, I will provide why industry tools and techniques from the field of business analysis and change management, complements the delivery of cyber security projects, and work in a MDT along with cyber specialists, so that the audience can take it back to their workplace to apply it even if they don’t have dedicated staff.