There are different ways to describe "keep the lights on" work. It is essentially your normal day to day. It doesn't necessarily move you forward towards accomplishing goals, but it is essential to meeting the commitments of your organization.
In a security environment, this often involves things like creating rule content, triaging the results that return from that rule content, and follow-on actions based on the analysis of that returned content. Regardless of what some may think, even at the highest levels of the profession, there are humans who produce rules and review the hits from those rules. The subject of this post isn't about toil.
Automation is great, but there will continue to be humans in the loop for the foreseeable future if not forever. If you can prove me wrong on that, please stop reading this blog, and get ahold of me so I can be an early investor.
These sort of standard work day tasks are different from things like projects that are goal oriented and have a defined end usually in the form of some sort of completed objective or deliverable. Projects are normally seen as more impactful, because they move the organization forward. They also have defined stop points; if they're well defined outcomes or deliverables, then you either achieved and delivered them, or you did not. These can be more flashy and easy to communicate for evaluations and promotions.
Therein lies the focus and prioritization problem. If you divert all of your time and effort into project work, who is keeping the lights on? There are a variety of combinations to what that might turn into:
Team players pick up the keep the lights on work while others pursue projects.
Everyone neglects to keep the lights on and pursue projects.
There are other possibilities, but I'll stick with these for now. If option 1 happens, there can be some inequitable distribution of opportunities very quickly. If option 2 happens, you're going to have serious problems. You need, to the best of your ability, to equitably distribute business sustainment activities or "keep the lights on" work.
Instead, you should:
Establish a culture that values teamwork and equitable distribution of burden.
As equitably as possible, distribute business sustainment work in a systematic way.
Incentivize business sustainment work by recognizing and rewarding it.
Set the expectation that there is no "above and beyond" without meeting baseline standards established in 2.
Number 4 is arguably a sub-bullet of Number 3, but it's key to tone setting; it is the overt communication that you are not going to recognize project work as above and beyond when the bare minimum of expectation of being a great teammate is not met. It's daily operations PLUS goal achievements, not simply focusing on goal achievements. You need to eat your vegetables before you eat dessert.
One of the ways you can make this actionable is a prioritization decision tree or "order of operations" that any person on the team can use to make decisions day to day:
Priority 0: Things my manager has explicitly told me are priority 0. The manager must explicitly state a thing is Priority 0, because they are assuming responsibility for everything else that gets dropped.
Priority 1: Things that are declared emergencies. This is different than P0 in that a manager need not state it explicitly. These are things like organizational incident management. It is possible for P0 tasks to exist for an overall effort that is otherwise P1.
Priority 2: Daily Operations. These are normal day to day operations you perform as part of your predictable work.
Priority 3: Project Work. This is work that moves the organization forward.
The way this list can be used is as a series of questions. "Do I have anything my manager has told me is 'Priority 0'?" If yes, work that task until it's done and ask "Do I have anything that is Priority 1?" If yes, work that task until it's done and move to the Priority 2 and so forth.
The intent isn't to remove human judgement, but it is designed to enable smart decisions based on clearly communicated expectations. People who are doing the daily work should be able to exercise judgement and communicate with decision makers about priorities.
When I first put this "order of operations" together, I was personally surprised by the outcome. I essentially put my organizational goals at the bottom of my priorities. I asked myself if I was crazy. I am crazy, but also, I made a deliberate decision to have a healthy team culture that prioritizes equitable distribution of the daily work. We must eat our vegetables before we eat dessert.
Comments