Chapter 31 — Change management

Chapter 31 — Change management

Lesson map

Lesson 31 published. Map, example, EX091.

flowchart TD
  N0["Learning outcomes"]
  N1["31.1 Security changes affect people"]
  N2["31.2 Planning communication"]
  N3["31.3 Supporting people"]
  N4["31.4 Measuring adoption"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX091"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["31.1 Security changes affect people"]
  N2["31.2 Planning communication"]
  N3["31.3 Supporting people"]
  N4["31.4 Measuring adoption"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX091"]

[Learning outcomes]
    |
    v
[31.1 Security changes affect people]
    |
    v
[31.2 Planning communication]
    |
    v
[31.3 Supporting people]
    |
    v
[31.4 Measuring adoption]
    |
    v
[Worked example] --> [Exercise EX091]

Learning outcomes

You will (1) plan security changes that affect people; (2) communicate and support change; (3) measure adoption.

31.1 Security changes affect people

In her final year, Aisha studies how security changes succeed or fail. Ashfield plans to introduce app-based multi-factor authentication for all staff remote access. Technically simple, the change affects how every staff member works from home. Dr. Carrow explains that many security projects fail not because the technology is wrong but because people were surprised, unsupported or unconvinced. Aisha's task is to plan the change so staff understand it, can use it and do not look for workarounds. She starts by interviewing five staff.

31.2 Planning communication

Aisha plans communication in stages. First, the chief executive explains why the change matters, using a real example of a credit union whose staff accounts were compromised. Then staff receive step-by-step guides with screenshots and a date for enrolment. Branch champions, one per branch, help colleagues set up their phones. She learns that messages from leaders carry weight, while help from colleagues builds confidence in using the new method. She writes the guides herself and tests them with two staff members who have never used an authenticator app, revising unclear steps.

31.3 Supporting people

Some staff do not have smartphones or do not want work apps on personal devices. Aisha recommends hardware tokens for them, provided by Ashfield. She also arranges drop-in sessions in each branch during the enrolment week. The IT manager prepares answers to common questions. She learns that offering alternatives prevents a minority from being excluded and reduces resistance, because staff who feel forced into something often find ways around it. The IT manager orders twenty tokens, and seven staff choose them during enrolment, mostly older staff and two who prefer to keep work off personal phones.

31.4 Measuring adoption

Aisha tracks enrolment daily during the rollout. After two weeks, most staff are enrolled, but one branch lags. She discovers the branch champion was on holiday. Another staff member steps in, and enrolment completes the next week. On the switch-over date, remote access without a second factor stops. Support calls peak on the first day and fall quickly. She learns that measuring adoption reveals local problems early. She plots enrolment by branch each day on a simple chart shared with branch managers, which makes the lagging branch obvious and encourages friendly competition between the others.

Worked example

Aisha plans a multi-factor change with leader messages, guides and branch champions, provides hardware tokens as an alternative and tracks enrolment to find a lagging branch.

Synthetic case. The rollout is synthetic.

Errors and limits

Changes that surprise staff often produce workarounds.

Exercises

• EX091 — Leader message. Who explains why the change matters? Rubric: 3 = the chief executive;; 2 = partly correct;; 1 = other;; 0 = none.
• EX092 — Alternative method. What is offered to staff without suitable phones? Rubric: 3 = hardware tokens;; 2 = partly correct;; 1 = other;; 0 = none.
• EX093 — Lagging branch. Why did one branch lag? Rubric: 3 = its champion was on holiday;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 31 (chapter 31 of 40)

← Chapter 30 · Course chapter index · Chapter 32 →

Continue to the next authored lesson.