Managing Resources

The successful delivery of a security program depends as much on the people executing it as on the quality of its design. Governance frameworks, risk treatment plans, and control architectures are only as effective as the individuals responsible for implementing and sustaining them, and a program that has not explicitly addressed its human resource requirements is structurally vulnerable to delivery failure regardless of the rigour of its technical and process design. Talent management during the security program rollout is therefore not a peripheral concern to be addressed after the substantive program work has been planned. It is a core governance discipline that must be integrated into the program’s planning, resourcing, and ongoing management from the outset.

The talent dimension of the security program encompasses three interdependent populations:

• the internal security function responsible for leading and sustaining the program;
• the broader internal workforce whose behaviours, awareness, and cooperation are essential to the program’s effectiveness;
• the external resources, whether consultants, managed service providers, or specialist contractors, whose expertise supplements the organisation’s internal capability during the program’s delivery.

Each population requires a distinct management approach, and the program’s talent strategy must address all three coherently.

Assessing the Current Capability #

The starting point for talent management during program rollout is an honest and structured assessment of the organisation’s current security capability relative to the demands the program will place on it. This assessment should not be limited to the security function. It should encompass all roles across the organisation that carry material security responsibilities, including IT operations, risk management, legal and compliance, and the business process owners whose cooperation is needed for effective control implementation.