Hello, and welcome to another episode of CISO Tradecraft -- the podcast that provides you with the information, knowledge, and wisdom to be a more effective cybersecurity leader. My name is G. Mark Hardy, and today's episode is about how to better mentor your people (and in doing so, improve yourself as well.) Mentoring is an important part of being a leader, and I would venture that most listeners have achieved their current level of success with the insights of a mentor, along with a lot of hard work. Today we're going to give you a template for creating a personal development plan you can use with your team. I also want to introduce you to a booklet that I keep on my desk. It was written in 1899. Do you have any idea what it might be? Well, keep listening and you'll find out, and you may end up getting yourself a copy of your own.

Let's take a moment to hear from today's sponsor Obsidian Security.

Career success rarely happens independently -- it usually involves multiple milestones, promotions, and sometimes moves. But success shouldn't be a secret. As Tony Robbins said, "success leaves clues." One of the best ways to achieve personal or professional success, or indeed help others do the same, is through mentoring and sponsorship. But the right person rarely shows up at our doorstep offering us the key to the future -- we have to go out and make that relationship happen. Today we're going to talk about mentors, protégés, sponsors, and that little booklet that has a repeatable secret for success.

Definitions

Let's start with what is a mentor - the dictionary definition is "an experienced and trusted adviser." My definition is it's a person with more experience and WISDOM who is willing to provide guidance to someone else -- a protégé. Notice I didn't say anything about careers -- you can have a spiritual mentor, an academic mentor, and if you're a new grandparent you want to pass along some tips to help raise your grandkids. You may also hear the term "mentee" instead of protégé -- I see that used from time to time, but it makes me think of those big slow sea creatures that keep getting run over by speedboats.

Mentor

Let's talk about the who, what, when, why, and how of being a mentor. The WHO part is someone with experience and wisdom willing to share insights. Insights about WHAT, at least as far as we're concerned today, is usually career-related -- what jobs or assignments may be best, what personal characteristics are important, whom should you meet and why.

The WHEN portion of mentoring is usually a condition of the type of relationship. A traditional one-on-one mentor relationship may be established formally or informally. We established a program at work where those willing to offer advice could volunteer as a mentor and those seeking advice could request the assistance of a mentor. I was asked by our most senior technical security expert if I would serve as his mentor -- an assignment which I was pleased to accept, and we held mentoring sessions quarterly. Of course, we worked together more frequently than that, but those sessions were specifically about what he could learn from me as a mentor, and what I could do to structure his experiences to help with his personal and career growth. [Irish whiskey story]

The WHY can be either because there is a mentorship program at your organization (and if there isn't one, do your homework and consider proposing one) or because someone reached out and requested assistance. Mentoring is not like doing the dishes where anyone can do a competent job. It requires empathy, communication skills, wisdom, and time commitment. I'm at the point in my life and career where I actively try to help others who are not as old as I am. Many times, that's appreciated, but some people seem to prefer to make all of their own mistakes and resist the effort. Oh, well. As my Latin teacher used to say, "suum quique" -- to each their own.

Finally, the HOW. Mentors should prioritize their sessions by preparing in advance and setting aside time without interruptions. Establish an agenda based upon specific requirements -- not just what the protégé wants but what the mentor believes he needs. Martina Bretous published an article on HubSpot where she points out ten ways to be an amazing mentor:

Understand what you want out of the relationship.
Set expectations together in the very beginning.
Take a genuine interest in your mentee as a person.
Build trust.
Know when to give advice.
Don’t assume anything about your mentee – ask.
Share your journey.
Celebrate their achievements.
Seek out resources to help your mentee grow.
Be sure you have the bandwidth.

In summary, if you want to be a mentor and seek out the right people in whom to invest your time, here's a short checklist. Look for protégés with a strong work ethic -- people who have built a reputation of delivering on time on budget. Select only those people of the proper character -- you don't want to be teaching a sociopath how to take over the organization. And you'll find you work better with others who share similar values. If you value hard work, honesty, humility, and perseverance, look for those characteristics, or at least the potential to develop those characteristics, in your potential mentee. We all know how hard it is to change ourselves. Think about how much harder it is to change someone else. In the end, you're just showing the way and it's up to the other person to take the appropriate actions, but you want to build a winning record of successful mentorships -- it doesn't help your own career if you're viewed as the incubator of failure.

Protege

As listeners of this show, you are likely in a position to be a mentor. But that doesn't mean you can't benefit from having a mentor yourself. Let's look at the who, what, when, why, and how of being a protégé. The WHO is someone who can gain insight from a relationship with someone farther along in a given path. Mentees may be assigned a mentor relationship, or they may seek out that relationship on their own. Both are valid paths, and even if a formal program exists it's often up to the mentee to select from available mentors. It doesn't always work the other way around [Navy mentor story.]

The WHAT is the reason for participating in this type of relationship. Usually, it's to gain insight into career and professional goals, but as I mentioned earlier, it can be about most anything where you could learn from someone who's not in the role of a teacher or supervisor.

WHEN should you seek the advice of a mentor? Well, there's probably never a time NOT to seek advice, but if you're heads-down in a long project that you enjoy or find yourself in a position where you're content and soon winding down your career, then I suppose you're fine going it alone. Otherwise, after you've been in a position for a year or so and you've figured out your current role and how you fit in, that might be a suitable time to start looking for a mentor.

I think the WHY is obvious, but let's address it. No one knows everything, but someone usually knows what you need. Seeking a mentor is a rational way of gaining insights that can help move your career along.

And HOW do you become a protégé? You need to a-s-k to g-e-t. Potential mentors are usually busy people -- they don't go looking for more things to add to an already overwhelming calendar. That said, the saying "if you want something done, give it to a busy person" is often true, because busy people are in the business of making things happen. If your organization offers a mentorship program, jump at the opportunity. Just make sure that the person with whom you are paired has the time, the expertise, and the interest to help you in your career.

When searching for a mentor, remember that you should have a clear goal in mind. "Hey, I need a mentor" isn't very specific, and the Mr. Rodger's "won't you be my mentor?" isn't very compelling. Rather, start with a specific objective. For example, it could be, "how do I become fully qualified to become a first-line manager?" or "what does this organization look for when selecting a C-level executive?" Once you have your goal, you can start your search, but remember that you need to stay professional. You're not seeking a drinking buddy -- a mentor rarely is a peer (although technically I have heard of peer-to-peer mentoring, but that runs the risk of the parable of the two blind men who both fall into a ditch.) You want someone with relevant knowledge and experience. And ideally first develop a working relationship before you pop the question. A busy mentor will feel more comfortable working with a known quantity than being left to wonder if this person represents a reputational risk.

Let's turn our conversation now to sponsors.

Sponsors

Executive coach May Busch recommends forming a career board of directors to advance your career. She points out that you need both mentors and sponsors -- sponsors are those in your organization with sufficient clout to put you into key assignments and can advocate behind closed doors for your career advancement. Wow -- sounds great; where do I sign up? The issue is that you typically can't recruit sponsors; they come looking for you. Like a mentee, a "sponsee" represents potential risk to sponsors -- they are putting their own credibility with peers on the line by advocating for you. If you crash and burn, you both lose.

Like any sales effort, you shouldn't put all of your eggs in a single basket, so if you want to identify a potential sponsor, look for a couple of candidates. Now, where you work there may be exactly one person who controls the vertical and the horizontal, but in most matrixed organizations, there is a range of opportunities to find advocacy. Find out who is senior enough to influence the decisions that can affect your career and also whether they are "in on things" to ensure that recommendations move you in the right direction. There are people who continue to serve past their key roles -- often called "emeritus" as an honorary title, but they probably aren't keeping up with the details. Look for someone who is still actively "in the game." And, like finding a mentor, you must identify a natural link between their business interests and your interests. Now, the intersection of all these criteria might yield exactly zero people, and if so, it's up to you to figure out your own way forward. But if you do identify potential sponsors, you need to attract their attention. But how?

Your potential sponsors need to see you in action. Find ways to deliver executive presentations where they are present or participate in working groups and let the quality of your work differentiate you from peers. Circulate innovative ideas that represent a step forward for your organization. The result of these efforts should be to get you noticed. Note also that you can do this for members of your team. You may want to sponsor them for bigger and better things but don't have the organizational capital to make it happen on your own initiative. By placing your best people in front of these more powerful decision-makers, you can facilitate their sponsorship when one of them decides this person should be going places.

Now, it's not just about performance. During COVID, most of us got comfortable working in bunny slippers from home, but that's not going to differentiate you to a potential sponsor. If you want to convince executives that you're C-level material, then you need to consistently look the part. Check your appearance. Do you look like the other executives in your organization? I spent 30 years in the military, so part of that "look" was proper grooming, a pressed neat uniform, and being physically fit. I remember my last semiannual physical fitness test -- I scored 295 out of 300 points and the young Sailor taking scores remarked, "not bad for an old man." But looking the part is important if you are going to be present yourself as a leader. [story at CNL -- overweight memorandum.] Now, I suppose if you work in a dot com startup and the founders all wear t-shirts and jeans every day, then wearing a three-piece suit is not going to help. But find a way to align with the organization's senior leadership culture so that you don't look like an outsider, which translates into risk.

Make sure your office space isn't full of junk and clutter and your home background on Zoom calls looks like a professional office space (or at least blur out the background.) Better yet, use a corporate-logo themed background which says, "I'm on the team."

Okay, so let's say you've done all this and are now looking like you just came out of casting for The West Wing and you're sufficiently visible to senior executives. Beyond looking the part, you need to act the part. Sit up straight in meetings; don't fiddle with your phone when executives are in the room, no matter how boring the conversation may be at that moment. I remember back in 2000 when I was working at a startup, our CEO nearly lost our biggest client because she couldn't put down her Blackberry when we were briefing the client's head of security. He was a retired Navy captain and remarked to me privately (as a fellow Navy officer) how offended he was that this person couldn't be bothered to put down that phone for half an hour and focus on the conversation. Better yet? There is a superpower that few people have but you could master if you're a phone addict -- leave your phone on your desk when you go to a meeting. That's right -- separate yourself from your "life support unit." Now, in some circumstances you feel you need it because, "what if they ask who's available for a meeting next week and I don't have my calendar?" Bring your laptop or tablet instead, and only consult it when you're asked something that needs looking up to answer. Remember, even a CEO doesn't get a pass on distractions when your biggest client is in the room.

In addition to looking the part and acting the part, you need to deliver. Make sure your work is exceptional and error-free. At the Pentagon we had a term -- "finished staff work." It means that what you turn in is correct, complete, and free of grammatical or typographical errors EVERY TIME. That's a tough discipline. I was a computer science and mathematics major at Northwestern, and there was nothing I wanted to avoid more than an English composition or writing class -- after all, I was going to be a technologist. Years later when I joined the staff of Booz|Allen, I saw the importance of mastering a professional writing style. As a consultant, you live or die by the pen -- how well you write proposals and deliverables. As I became more senior in both my civilian as well as my military career, I kept improving that ability to write well.

A small but powerful book you should own and master is Strunk and White's The Elements of Style. It's the most succinct summary of writing rules I've read -- think of it as a syntax guide to the English language. Granted, some of these conventions are considered quaint or even obsolete -- the Oxford comma and two spaces after a sentence, but I still write that way. There's no reason if you can write a program that will compile (or if you're a Python programmer, not throw a Syntax Error) that you cannot write English with the same consistency.

May Busch points out that there are four mistakes you can make that will ruin your attempts to attract a sponsor. One, which seems obvious, is that you're perceived as lacking potential. Note I said "perceived." I think all of us have slightly inflated expectations of ourselves -- that's called a healthy ego, but let's face it: some people are rightly classified as low potential, high achievers -- they work really hard to achieve mediocre results. "But I do consistently outstanding work at my current job!" Okay, I'll give you that. But remember -- we're talking about getting a sponsor for the NEXT job, and if you're not virtue signaling that you can perform at the next level, then a wise boss is likely to leave you where you are -- delivering consistently outstanding work. Remember my four-phase career model: technical, management, leadership, political? You can often move easily within one of those phases without sponsorship, but to get to the next level usually requires something or someone external to yourself.

The second disqualifier is to be seen as "selectively motivated," meaning you only put forth full effort at the last minute. It's somewhat of a synonym for a procrastinator -- many of us know there's nothing like the last minute to make sure things get done. Sure, there are important things that are urgent, but if your MO is to goof off until just before a deadline and then rush out a finished product, that calls into question your long-term reliability for more responsible assignments.

The third disqualifier is lack of self-confidence. If you present yourself as hesitant and uncertain, you do not inspire confidence. "Do you think, umm, maybe we might possibly consider doing this?" is not as reassuring as, "Here's what we're going to do." I'm not advocating for arrogancy here; but if you secretly worry about imposter syndrome or a belief that you're not as good as others perceive you to be, then that's likely to leak out in your words and actions and cause potential sponsors to pause.

The fourth way you can discourage a potential sponsor is to be inappropriate. You say and do the wrong things at the wrong time to the wrong people. You put your feet up on the conference table or make inappropriate or even offensive jokes when no one was looking for that type of input. Walking up a senior executive and saying, "won't you be my sponsor?" is another example. It's fine for Mr. Rodgers to ask, "won't you be my neighbor?" but as you know by now, you have to become the one who attracts attention, not demands it.

Being Inspirational

One of the best ways to help others move forward is to show them an example of what represents success. I mentioned earlier the booklet that sits on my desk -- have you figured out what it might be? It's "A Message to Garcia" written by Elbert Hubbard, the founder of the Roycrofters in East Aurora NY. Hubbard was a writer, publisher, artist, and philosopher, who wrote that he sat down and penned this essay after dinner in under an hour. What started as article in his magazine grew rapidly. After receiving requests for a thousand copies of that issue, he inquired as to the reason. "It's the stuff about Garcia." The New York Central Railroad reprinted over one million copies in booklet form. The Director of Russian Railways was in New York, was so impressed that when he returned to Moscow, ensured a translated copy was given to every railroad employee in Russia. Every Russian soldier in the Russo-Japanese war had a copy, and when the Japanese officials noted Russian prisoners of war all carried it, they concluded it must be a good thing, translated it into their language and gave copies to every employee of the Japanese government. By December 1913, over forty million copies of A Message to Garcia had been printed. Tragically, Hubbard died on the 7th of May 1915 as a passenger onboard RMS Lusitania, which was torpedoed by a German U-boat. I have a number of his publications, but this is the one that I reread the most. It's not that long -- less than fifteen hundred words, and if you haven't heard it before, you should, and if you have heard it before and you're like me, you'll want to hear it again. Remember, the context is 1899. Here is…

A Message to Garcia By Elbert Hubbard

In all this Cuban business there is one man stands out on the horizon of my memory like Mars at perihelion. When war broke out between Spain and the United States, it was very necessary to communicate quickly with the leader of the Insurgents. Garcia was somewhere in the mountain vastness of Cuba- no one knew where. No mail nor telegraph message could reach him. The President must secure his cooperation, and quickly.

What to do!

Some one said to the President, "There’s a fellow by the name of Rowan will find Garcia for you, if anybody can."

Rowan was sent for and given a letter to be delivered to Garcia. How "the fellow by the name of Rowan" took the letter, sealed it up in an oil-skin pouch, strapped it over his heart, in four days landed by night off the coast of Cuba from an open boat, disappeared into the jungle, and in three weeks came out on the other side of the Island, having traversed a hostile country on foot, and delivered his letter to Garcia, are things I have no special desire now to tell in detail. The point I wish to make is this: McKinley gave Rowan a letter to be delivered to Garcia; Rowan took the letter and did not ask, "Where is he at?" By the Eternal! there is a man whose form should be cast in deathless bronze and the statue placed in every college of the land. It is not book-learning young men need, nor instruction about this and that, but a stiffening of the vertebrae which will cause them to be loyal to a trust, to act promptly, concentrate their energies: do the thing- "Carry a message to Garcia!" General Garcia is dead now, but there are other Garcias.

No man, who has endeavored to carry out an enterprise where many hands were needed, but has been well nigh appalled at times by the imbecility of the average man- the inability or unwillingness to concentrate on a thing and do it. Slip-shod assistance, foolish inattention, dowdy indifference, and half-hearted work seem the rule; and no man succeeds, unless by hook or crook, or threat, he forces or bribes other men to assist him; or mayhap, God in His goodness performs a miracle, and sends him an Angel of Light for an assistant. You, reader, put this matter to a test: You are sitting now in your office- six clerks are within call. Summon any one and make this request: "Please look in the encyclopedia and make a brief memorandum for me concerning the life of Correggio". Will the clerk quietly say, "Yes, sir," and go do the task?

On your life, he will not. He will look at you out of a fishy eye and ask one or more of the following questions:

Who was he?

Which encyclopedia?

Where is the encyclopedia?

Was I hired for that?

Don’t you mean Bismarck?

What’s the matter with Charlie doing it?

Is he dead?

Is there any hurry?

Shan’t I bring you the book and let you look it up yourself?

What do you want to know for?

And I will lay you ten to one that after you have answered the questions, and explained how to find the information, and why you want it, the clerk will go off and get one of the other clerks to help him try to find Garcia- and then come back and tell you there is no such man. Of course I may lose my bet, but according to the Law of Average, I will not.

Now if you are wise you will not bother to explain to your "assistant" that Correggio is indexed under the C’s, not in the K’s, but you will smile sweetly and say, "Never mind," and go look it up yourself.

And this incapacity for independent action, this moral stupidity, this infirmity of the will, this unwillingness to cheerfully catch hold and lift, are the things that put pure Socialism so far into the future. If men will not act for themselves, what will they do when the benefit of their effort is for all? A first-mate with knotted club seems necessary; and the dread of getting "the bounce" Saturday night, holds many a worker to his place. Advertise for a stenographer, and nine out of ten who apply, can neither spell nor punctuate- and do not think it necessary to.

Can such a one write a letter to Garcia?

"You see that bookkeeper," said the foreman to me in a large factory.

"Yes, what about him?"

"Well he’s a fine accountant, but if I’d send him up town on an errand, he might accomplish the errand all right, and on the other hand, might stop at four saloons on the way, and when he got to Main Street, would forget what he had been sent for."

Can such a man be entrusted to carry a message to Garcia?

We have recently been hearing much maudlin sympathy expressed for the "downtrodden denizen of the sweat-shop" and the "homeless wanderer searching for honest employment," and with it all often go many hard words for the men in power.

Nothing is said about the employer who grows old before his time in a vain attempt to get frowsy ne’er-do-wells to do intelligent work; and his long patient striving with "help" that does nothing but loaf when his back is turned. In every store and factory there is a constant weeding-out process going on. The employer is constantly sending away "help" that have shown their incapacity to further the interests of the business, and others are being taken on. No matter how good times are, this sorting continues, only if times are hard and work is scarce, the sorting is done finer- but out and forever out, the incompetent and unworthy go. It is the survival of the fittest. Self-interest prompts every employer to keep the best- those who can carry a message to Garcia.

I know one man of really brilliant parts who has not the ability to manage a business of his own, and yet who is absolutely worthless to any one else, because he carries with him constantly the insane suspicion that his employer is oppressing, or intending to oppress him. He cannot give orders; and he will not receive them. Should a message be given him to take to Garcia, his answer would probably be, "Take it yourself."

Tonight this man walks the streets looking for work, the wind whistling through his threadbare coat. No one who knows him dare employ him, for he is a regular fire-brand of discontent. He is impervious to reason, and the only thing that can impress him is the toe of a thick-soled No. 9 boot.

Of course I know that one so morally deformed is no less to be pitied than a physical cripple; but in our pitying, let us drop a tear, too, for the men who are striving to carry on a great enterprise, whose working hours are not limited by the whistle, and whose hair is fast turning white through the struggle to hold in line dowdy indifference, slip-shod imbecility, and the heartless ingratitude, which, but for their enterprise, would be both hungry and homeless.

Have I put the matter too strongly? Possibly I have; but when all the world has gone a-slumming I wish to speak a word of sympathy for the man who succeeds -- the man who, against great odds has directed the efforts of others, and having succeeded, finds there’s nothing in it: nothing but bare board and clothes. I have carried a dinner pail and worked for day’s wages, and I have also been an employer of labor, and I know there is something to be said on both sides. There is no excellence, per se, in poverty; rags are no recommendation; and all employers are not rapacious and high-handed, any more than all poor men are virtuous.

My heart goes out to the man who does his work when the "boss" is away, as well as when he is at home. And the man who, when given a letter for Garcia, quietly take the missive, without asking any idiotic questions, and with no lurking intention of chucking it into the nearest sewer, or of doing aught else but deliver it, never gets "laid off," nor has to go on a strike for higher wages. Civilization is one long anxious search for just such individuals. Anything such a man asks shall be granted; his kind is so rare that no employer can afford to let him go. He is wanted in every city, town and village- in every office, shop, store and factory. The world cries out for such: he is needed, and needed badly- the man who can carry a message to Garcia.

-THE END-

In 2009 as president of the Association of the United States Navy, I wrote a short article entitled "A New Message to Garcia." There I called out the actions of a Sailor who went above and beyond what was expected without even being asked. I hope he went on to bigger and better things because he had the right stuff.

Take Action

Let's put all of this together. One of the best ways to formalize mentoring is to create a written performance development plan. We've included a sample template in the show notes. This is a way to memorialize conversations with SMART goals -- you remember, specific, measurable, achievable, relevant, and time-bound? If you are a mentor, you can use this as a template for your counseling sessions. If you are a mentee and there is no template in your organization, feel free to introduce this to your mentor -- you're showing initiative and creating potential value for more people than just yourself.

By putting goals in writing, they experience a magical transformation. It was Napoleon Hill who wrote that "a goal is a dream with a deadline." Until you write it down, it's easy to find other things that seem more important or urgent at the moment. In addition, a written set of goals offers accountability -- it's a commitment between mentor and mentee that can be honored like a contract.

Start with the manager's organizational priorities and goals that provide a context for the session. For example, if you are in the cybersecurity organization, these could be things such as, "create a cyber vigilant organization," "enable cybersecurity controls and compliance," and "safeguard the organization against major threats." Each of these could have subgoals that get into a little more detail -- awareness training for users, secure coding training for developers, establishing a governance structure around cyber risk. This requires inside knowledge, and if the mentor is within the same organization, it shouldn't be too difficult to ascertain. In addition, if the mentor is the supervisor, then even better -- this shows how the protégé's goals fit in with the boss's vision of what should happen. Better to find out early on that an idea isn't practical then to spend a year working on it only to find out it will never be implemented.

Next, the protégé lists individual development goals. Not too many, especially if you are meeting quarterly. Two or three may be sufficient. If there are too many things to work on, the natural tendency is to go for those that are easiest, which may not be the ones that are the most important. Next comes the BHAG -- the big, hairy, audacious goal -- the one that will represent a signature accomplishment. Chances are, this won't happen in a month or a quarter, but it's perfectly reasonable for an annual cycle to align with performance reviews to specify a stretch goal. And by doing it in writing and knowing someone is holding accountability, it's more likely to happen.

When it comes to making progress, actions can be separated into experiences, relationships, and learning. Most of our progress is done through experience, so list multiple experiences that one expects to accomplish before the next session. It can be part of a larger goal -- work on the team deploying a SIEM or complete a particular phase of a larger project. This is where the majority of the accountability will reside -- did you complete what you set out to do? It's helpful to be a bit aspirational, but this isn't another set of stretch goals.

List at least two relationship improvement opportunities -- these can be key relationships or even potential sponsors. For example, it could include the head of a particular business unit that has specific security requirements -- that meeting would help address those concerns and provide an opportunity for the person seeking visibility.

Lastly, include learning opportunities. Not all of us are going to school full-time, but we all should be working on self-improvement. For example, you might set a goal to complete the next course in your degree program or take the exam that grants a particular certification.

What you have is a template for action and professional growth. The action comes from the accountability of a written document, and the growth comes from the joint goal-setting that takes place under the guidance of a mentor. Don't just file it away with the rest of your paperwork -- put it where you'll see it every day and challenge yourself to check off another accomplishment by week's end. By encouraging this culture of accomplishment, you'll significantly increase the probability of success.

Conclusion

Inside the front cover of my Garcia booklet is a short essay entitled "Initiative." Let me leave you with this as a final thought:

The world bestows its big prizes, both in money and in honors, for but one thing. And that is Initiative.

What is Initiative?

I’ll tell you: it is doing the right thing without being told.

But next to doing the thing without being told is to do it when you are told once. That is to say, carry the Message to Garcia: those who can carry a message get high honors, but their pay is not always in proportion.

Next, there are those who never do a thing until they are told twice; such get no honors and small pay.

Next, there are those who do the right thing only when necessity kicks them from behind, and these get indifference instead of honors, and a pittance for pay. This kind spends most of its time polishing a bench with a hard-luck story.

Then, still lower down in the scale than this, we have fellow who will not do the right thing even when some one goes along to show him how and stays to see that he does it; he is always out of job, and receives the contempt he deserves, unless he happens to have a rich Pa, in which case Destiny patiently awaits around a corner with a stuffed club.

To which class do you belong?

Thank you for listening to CISO Tradecraft; we hope you've found this show valuable. If you learned something that you like, please help us by leaving us a 5-star review on your favorite podcast platform -- those ratings really help us reach other security leaders. The more CISOs we can help, the more businesses we can protect. This is your host, G. Mark Hardy. Thanks again for listening and stay safe out there.

References:

Example: Individual Performance Plan

Name: ________________________________ Date: ________________

Leadership's Cyber Priorities and Goals

Create a Cyber Vigilant Organization

Cyber Awareness Training, Secure Developer Training, and Proper Risk Approval and Governance

Enable Compliance, Controls, and Cyber Security

Controls (IT General Controls & SOX), Audits, and Cyber Maturity Frameworks (ISO 27001, NIST CSF, or FFIEC)

Safeguard the Business against Key Threats

Phishing and Ransomware, Software Vulnerabilities, and Third-Party Risks

Individual Development Goals

Goal:
Goal:

Signature Accomplishment

My Big Goal is to accomplish …

Actions I am taking this year (How)

Experiences (70%)
- Experience 1
- Experience 2
- Experience 3
- …

Relationships (20%)

Relationship Improvement Opportunity 1
Relationship Improvement Opportunity 2

Learning (10%)

Learning Opportunity

Support Needed from My Manager

I need help with …

#102 - Mentorship, Sponsorship, and A Message to Garcia

CISO Tradecraft®

#102 - Mentorship, Sponsorship, and A Message to Garcia