We all know that information security management only works if we “close the loop”, i.e. that telling people to do things does not work unless you check they are actually doing it. The problem is that for far too long we have been using the wrong type of loop.
It started with ISO 27000 committee bureaucrats, who fell in love with the old-fashioned Deming loop of “Plan, Do, Check, Act”. This was long after leading US military strategists had fashioned the more relevant (to security) Boyd (OODA) loop of “Observe, Orient, Decide, Act”.
Now you might think these two loops sound similar. But you would be wrong. In practice, applying the Deming cycle is painfully slow. It typically translates to an annual budget-driven cycle. Deming himself also preferred the word “study” to check”, which suggests that we don’t spend enough time on it.
But OODA is all about speed. It’s about highly competitive dog fights. It was inspired by the challenges in air combat in Vietnam. The trick is to design your environment to go faster than your opponent. And that’s exactly what we need to survive in a hostile environment where competitors are aiming to exploit our intellectual property, i.e. the modern business world.
So let’s ditch PDCA and embrace OODA. It’s an entirely different philosophy, and one that we all need to adopt.