EkaLore’s series, “Hunt for Talent” is a business fable that illustrates what happens to an imaginary company gets caught by a cybersecurity breach. This post is a continuation of our discussion of assessments and evaluations.
The purpose of the assessment phase of the process is to gain an understanding of the data available and what people think/understand about the enterprise. Gathering up data in an assessment is about listening. An important deliverable in an assessment process is a written document that gathers together relevant data and the state of the enterprise as a “snapshot” in time.
Self-assessment is a form of asking what local folks think are important questions and listening to the discussion and answers to understand. The self-assessment can only describe what folks observe, comprehend, and can communicate. Few people will communicate “objectives set by managers are unrealistic and unreachable” whereas they might communicate “recommendations to upgrade security measures have been made for 4 years and rejected multiple times”. Key Performance Indicators and other management-objective formats a self-assessment may demonstrate glowing results – and the self-assessment will agree. A key limitation of self-assessment is a lack of external perspective.
To Be Continued
Comments