Leadership is not something that just happens. Leadership must be measured, managed, and invested in. After all, how IT leaders are selected, trained, evaluated, and compensated materially impacts the future performance of the enterprise.

So, again, when was the last time you had a substantive conversation about leadership with your direct reports? How frequently do you critically examine whether your IT/digital organization is well led? What set of metrics does your organization employ to evaluate IT/digital leaders?

The IT industry is undergoing a crisis of confidence. This is due in no small part to the erroneous presumption that IT and digital organizations have their leadership game in order. Quality leadership is not something that can be taken for granted. It’s time to turn an analytical eye to the state of leadership in our industry — and here are five key questions IT leaders must ask themselves to truly know whether they are successfully leading IT.

Is your focus on point?

Daniel Barchi, Naval Academy grad and award-winning CIO at CommonSpirit Health, explained to me that there are three areas IT leaders can allocate their time: People, process, and technology. Barchi suggests the optimal allocation for IT leaders is 80% people, 15% process, and 5% technology. Unfortunately, many IT leaders — especially those of the order-taker type — invert that triumvirate, placing the lion’s share of their focus on technology.

Are you and your direct reports allocating enough time to leading people?

Are your people primed for success?

In Good to Great, Jim Collins suggests that decisions about people — who is on the bus — have to precede decisions about objectives — i.e., where the bus is going. Several CIOs have shared with me the anecdote regarding how Apple design icon Jonathan Ives typically responds to the question, “What’s the secret to your design success?” Ives reportedly responded, “We fire the A- people.” The point being that a group of passionate high performers is what is necessary to deliver the sought-for end state.

Talent is a differentiator. Are your IT leaders doing everything it takes to attract, nurture, grow, and retain the kind of talent necessary to succeed?

Are you helping your organization ‘see the future’?

Barbara Cooper was the beloved and now retired CIO at Toyota Motors North America. Having served as an IT leader in five industries, she is one of the top CIO “coaches” in North America. Barbara counseled me that it is not enough just to have a vision of the future. Our industry is too full of sic “transformational” CIOs being airlifted into enterprises only to slink away 18 to 24 months later having abjectly failed to create digital value.

Creating IT value requires a team effort. One has to get the organization to internalize and unite behind a collective vision of the future. Barbara jokingly quipped that “as a child of the ’60s” she learned that while you “can’t share the trip” — i.e., one person’s vision is not enough — you can get everyone moving in a common direction. To do this she set her direct reports down one day in the conference room:

“Ok, I want you to think out three years. ’Cuz five is a little much. I want you to pretend that you are driving into the parking lot. You are walking into your office. You are going to go through your day. You are going to have your first meeting of the day. You are talking to somebody in the door. You go and get your coffee. You have a series of hallway conversations. You are thinking about some of the things and the problems you have. I want you to play that out — almost like a storyboard in your head — what is going to be different three years from now?”

These individual visions were shared, consolidated, amplified, and linked to enterprise objectives.

Is that kind of collective vision-making part of your company culture?

Are you emphasizing the value of relationships?

Most of the voluminous academic literature on leadership focuses on the traits/idiosyncrasies of the individual leader and not on their relationships with key associates. As an IT leader, do you have a track record of helping or hindering colleagues in fulfilling their career objectives?

Vince Kellen, a digital force of nature and CIO at University of California San Diego, borrows insights from NHL scouts. He is looking for IT “skaters” who, when they step onto the ice, make the other four teammates better hockey players.

How leaders view themselves and others and how they are viewed by others is a critical causal driver of leadership success or failure. Tony Blair was able to reverse a multi-decade decline in Labour Party electoral success when he realized, “People judge us on their instincts about what they believe our instincts to be. And that man polishing his car was clear: His instincts were to get on in life, and he thought our instincts were to stop him.”

Leadership success requires connectedness to the community. How connected are your IT leaders throughout the ranks?

Are you effective at making a positive impact?

Franklin Pierce, America’s 14th president, is viewed by most historians as being one of the very worst presidents. Every action he took “made things worse,” as was discussed on “The First 15,” Episode 93 of the American POTUS podcast.

Have your actions made things better or worse?

Business IT Alignment, IT Leadership

Despite its potential for relieving pressure on the workforce, automation in the workplace is often seen negatively, as a cause of job losses or a growing skills gap. Yet, done well, automation can provide critical support that frees people up to focus on more impactful work — and can lead to happier, more motivated and productive employees.

At a time when burnout has become a major issue — with Future Forum data showing 40% of workers globally experience it — automation can also help employees by simplifying work and saving them time.

So, how can IT leaders help reduce the cognitive load and automate common tasks such as creating sales decks using Salesforce data or raising purchase order requests? One way is through the digital headquarters (HQ).

Making automation a reality with the digital HQ

The key to effective workplace automation is keeping it simple and empowering end users. If a system is too complicated to set-up it becomes a burden on the tech team and is not scalable.

With most businesses still navigating the shift to hybrid, the one office that every employee comes into each day is the digital HQ — a single digital space where workflows between your people, systems, partners and customers. In transforming how teams work, communicate and collaborate, the digital HQ sits at the heart of automation initiatives, with free-flowing conversations built around specific projects or teams taking place in channels.

Heading into a tough economic climate, it’s more important than ever for organisations to keep teams motivated and engaged, so they are able to perform and deliver results quickly. Automation within the digital HQ is a major step towards this — empowering employees to liberate their time from manual tasks and helping them breeze through multiple requests that might otherwise perforate their day.   

Offering a no-code solution that everyone can use, Slack’s Workflow Builder hands control back to the team, boosting efficiency in the process. Just ask telecommunications giant Verizon, who used Slack’s digital HQ — alongside automations — to improve output and employee experience.

Slack

Personalised problem-solving

Verizon’s Planning and Engineering team were the first to identify the potential of Slack’s Workflow Builder to bring solutions to, not just their own department, but the whole company. This is because Workflow Builder is an easy-to-use tool that requires no coding experience, with over 400,000 people around the world having built workflows so far — 80% of whom are in non-IT roles. It was therefore easy for Verizon to see its potential to give teams autonomy in solving their own pain points.

Verizon launched the Citizen Builder Programme, encouraging staff to leverage automated workflows to create solutions. This level of personalised problem-solving meant issues were resolved with far greater precision than if another team had been tasked with the job. With one impactful example being how Verizon’s Wireline Network Operations team used Slack’s Workflow Builder to coordinate field technicians for last-mile service calls. Automating parts of this process not only reduced the load on the team but also led to more accurate customer appointment times — all without adding any additional pressure to Verizon’s IT team.

With an expansive telecommunications operation, and a reputation for excellent customer service, Verizon faces a huge amount of admin every day. But with Slack’s Workflow Builder, they have ensured it doesn’t take its toll on workforce motivation, and satisfaction isn’t reserved exclusively for its customers.

For more information on how Slack’s Digital HQ can help your business click here.

Application Performance Management, Change Management, Networking, Remote Work

With the threat landscape evolving to be more dangerous and sophisticated, board members may wonder where their own organizations stand when it comes to cybersecurity readiness against threats such as ransomware and data breaches. After all, board members have a duty to ensure their organization protects itself against cyberattacks and accidental data leaks. 

Here’s a list of questions CIOs should be prepared to answer to ensure the organization is making the right strategic investments in cybersecurity.

Questions for CIOs about cybersecurity readiness

1. Have we prioritized our objectives and our risks?

Risks are uncertainties about outcomes. Risks matter most when they pertain to the outcomes an organization prioritizes. Is there a risk management practice in place that identifies its highest-level objectives? For most organizations, those objectives will include:

Business continuityData confidentiality, integrity, and availability (data “CIA”)Regulatory comp

2. Have we identified the IT resources and processes that support our objectives?

Besides identifying key objectives, an organization needs to identify the IT resources and processes that support those objectives. For example, if business continuity depends on an eCommerce website, which IT assets, processes and teams does that website depend on? What are its most valuable assets? Do they include intellectual property, financial data, physical infrastructure, or something else? Where are those assets stored, and who has access to them?

3. Have we identified the risks associated with each of those IT resources and processes? 

Board members and the executive team need to understand what makes the IT resources, processes and teams supporting each key objective vulnerable to attack. Unpatched software? Unreliable hardware? Lack of training? Have governments or industry groups adopted new regulations that will require redesigning and redeploying software and hardware?

4. Have we assessed the likelihood of these risks? 

If the organization estimates the odds of a data breach to be just 1%, that’s too low to be realistic. If the odds are 80%, then it isn’t making the right investments in cybersecurity. What is our confidence level in our cybersecurity posture, and how does that compare to those of our peers? Has the organization assessed the combined likelihood and severity of each risk, so that risks can be compared and prioritized?

5. Have we developed a software Bill of Materials (SBOM) for all our key applications and software services?

An SBOM is a catalog of all the software components and their versions that goes into an application or software service. By compiling SBOMs, organizations make it much easier to identify applications and services that are at risk when new vulnerabilities are announced, such as the Log4j vulnerability that was announced in December 2021. Has the organization begun the practice of automatically compiling SBOMs for key applications and services? What’s the plan for doing so? How far along is the process now? How is this work being automated so it’s always up to date?

6. Do we have a real-time inventory of all our IT assets, including laptops, desktops, servers, and IoT devices?

You can’t secure something if you don’t know you have it. An organization needs a comprehensive inventory of all its IT assets as part of its cybersecurity program and recognize that this inventory changes continually. How are we compiling this inventory? How regularly is it updated? How are we determining that it really is complete and accurate

7. Have you identified likely adversaries and their goals?

Doing this helps an organization focus its investments on cybersecurity. Are there specific parties such as cybercriminal gangs, nation-states or activists who are likely to attack us? If so, what are their goals? Are they hoping to steal information, inflict a ransomware attack and demand funds, cause mayhem, or somehow damage the organization’s brand? How is this knowledge shaping our cybersecurity strategy?

8. How are we prioritizing our spending on risk?

Trying to eliminate all risks would be cost-prohibitive. How are we prioritizing our investments? Who is involved in making decisions about spending? How often are those decisions reviewed and, if necessary, adjusted?

9. What plans do we have in place to mitigate risks if attacks or other undesirable outcomes occur?

Do we have teams ready to respond to our most serious risks? Are communication channels in place? Do team members have the tools they need to act quickly and effectively? Have teams practiced responses to attacks to ensure that people, processes and tools are ready for action?

Learn how Tanium can help you make the right strategic cybersecurity investments here.

Security

Board directors like Jean Holley can be a CIO’s best friend or worst nightmare. A former CIO herself, Holley always reaches out to the CIO before board meetings to offer her advice on how to handle inevitable questions. “It’s amazing how many times they don’t take me up on it,” Holley says.

These CIOs, especially those new to the role, often come off as overly techie, out of touch with the business, or worse, out of their depth in the position, she says. On three different boards, directors have asked Holley if the company chose the right CIO, and three times her answer was no. Don’t be that CIO.

CIOs hold more influence than ever in the boardroom. The CEO and board may steer the ship, but they’re relying on the CIO’s radar to see what’s coming. Preparation is key and can make or break the relationship. Get ready for these questions and curveballs.

First, know your audience

Before meeting the board for the first time, it’s important to research the background of each board member and the other boards they’re on, says Gary Cantrell, former CIO and senior vice president of IT at manufacturing company Jabil, who spoke with his board quarterly.

“Most of the board members aren’t deeply versed in IT, but they know what’s important from reading the news or from what they’ve learned from other boards that they sit on,” Cantrell says. “If you follow those companies on your feed and read up on an incident before you get in front of the board, you can answer questions easy enough. If not, you have to dance as you go.”

1. ‘Are we vulnerable to current cyber threats?’

Cybersecurity remains a top board concern, especially given the war in Ukraine and ongoing global unrest. CIOs should always prepare for this loaded question without giving doomsday predictions or appearing overconfident.

“Prepared for cyber questions in the context of risk,” says Jay Ferro, chief information and technology officer at Clario. “Explain that the likelihood of a risk X happening is very low, but the impact could be high, so here’s what we’re doing to mitigate it,” Ferro says. “Have a conversation about where you aren’t as secure, too, but follow immediately with how you’re getting better, what your plan is, and how they can hold you accountable for getting better.”

Here, CIOs can help the board see improvement by reusing and updating performance graphs and charts that were presented at previous board meetings, so directors can see progress, he adds.

Vulnerability isn’t the only cyber-related question CIOs should be prepared to address. Ferro says he was put on the spot many times with the question, “Are we spending enough on cybersecurity?”

“You always want to spend more, but your CEO is in the room, and you have to be very careful about your answer,” Ferro says. “You don’t want to throw your CEO under the bus.”

On the flip side, the current economic climate has some boards asking, “Can you do this more cheaply?” says Alexander Lowry, host of the podcast “Boardroom Bound.” Typically the answer is no if the company wants to remain well-defended or needs to retain talent, he says. “Time, cost, and quality form the triangle of balance,” he adds, and CIOs must explain the importance of all three factors.

Directors who sit on several boards may also inquire about the security chain of command in the organization, Holley says. Because of this, CIOs are often asked, “Should the CISO report to the CIO or to someone else?”

“About 90% of CIOs will say yes, I want it,” Holley says. “But if you’re a technology-based company and you develop technology for a living or maybe in the security space, it should not be under the CIO. The board prefers the checks and balances of two different leaders in this case, she says.

2. ‘Are we investing in the right technology that aligns with our strategy?’

The board wants assurances that the CIO has command of tech investments tied to corporate strategy. “Demystify that connection,” Ferro says. “Show how those investments tie to the bigger picture and show immediate return as much as you can.”

Global CIO and CDO Anupam Khare tries to educate the board of manufacturer Oshkosh Corp. in his presentations. “My slide deck is largely in the context of the business so you can see the benefit first and the technology later. That creates curiosity about how this technology creates value,” Khare says. “When we say, ‘This project or technology has created this operating income impact on the business,’ that’s the hook. Then I explain the driver for that impact, and that leads to a better understanding of how the technology works.”

Board members may also come in with technology suggestions of their own that they hear about from competitors or from other boards they’re on. So CIOs should also be prepared to answer the question, “Should we be using the same technology as company X?”

Avoid the urge to break out technical jargon to explain the merits of new cloud platforms, customer-facing apps, or Slack as a communication tool, and “answer that question from a business context, not from a technology context,” Holley says. “[The answer] depends on how the business is doing and where you are competitively. Are you trying to be a leader or a fast follower” in the digital space?

It’s also wise to prepare a list of three areas that you would invest in if capital were available, Holley says. “That’s a key question to always have a good answer to in case the business is throwing off more cash or somebody isn’t spending as much capital,” she says. “For instance, if we throw $5 million now at this active project, we could pull in this ROI in six months. It may not be IT-related either. If we’re looking to pull in that acquisition in Q1 of next year, why don’t we pull it in Q4 this year because people have the bandwidth.”

Holley had a similar short list of projects to slow or stop if the business was contracting or the company had a rough quarter and needed to pull back. Top contenders were projects where the business is not engaging enough, or those the business can’t bring the right head count to make it move faster, she says.

3. ‘How are you retaining and attracting tech talent?’

Board members read about a worldwide IT talent shortage and they’re asking CIOs what they’re doing to develop talent in-house, and how they’re retaining workers, Cantrell says. They’re also asking about attrition rates and how you’re attracting new talent. Are you only offering higher salaries or other perks?

4. ‘Should we be looking to automation to fill hiring gaps?’

Without enough qualified workers, some board members may also ask about automation or robotics as an alternative, Lowry says. “The question might be, ‘Since we can’t get enough human beings to do these things anyway, could we do it more efficiently with automation? Not just today, but for the medium or long term would it make the organization more resilient or help us operate more cheaply?’” CIOs should prepare a list of what parts of the business could be or should be automated, Lowry says.

5. ‘How are you cultivating the most diverse, equitable, and inclusive tech team?’

With the increasing emphasis on diversity, equity, and inclusion (DEI) as a key workplace objective and productivity driver, CIOs should also be prepared to describe their DEI initiatives, including how they are going about sourcing for this talent, such as partnerships with organizations that can help, Ferro says.

These types of corporate responsibility topics may also include sustainability questions, he adds. “What are you doing to run a more sustainable technology organization — whether that’s reducing your data center footprint or moving to the cloud,” he says.

6. ‘What should we be concerned about that’s not on our radar?’

The board is relying on your radar to help them shape business strategy. A crisp top-three list should start things off. “This is not an invitation to go apocalyptic or to overtalk or overexplain,” Holley says.

“I would always pre-think an answer internally and externally,” Holley says. “I start with something like, ‘Externally there’s an opportunity to grow revenue by x%.’ Or I would ask, ‘Do you know what our competitors are doing?’ And I would expand on that. Or I would start with, ‘The competitor we don’t even see today is probably doing this.’”

Instead of elaborating on each idea, she would follow up with, “Would you like to know more?” The board chair or a committee chair would usually say yes or want to follow up at a later time.

Dealing with the unexpected

If any question comes out of left field that you aren’t prepared to answer, never make up the answer, Ferro says. “Be prepared to say, ‘I would like to come back to you on that, or just say, ‘That’s a great question. Generally, it’s on our radar. Let’s do a separate call on that.’”

Preparation can pay off big time, Cantrell says. “It’s always the first impression. If you can get off on a good foot in the first three meetings, life gets a lot easier. If not, it gets to be a challenge.”

CIO, IT Leadership