What is the Status?

What is the status of …?


I cannot even guess how many times I have been asked that question in my lifetime. There was a point where I started providing daily updates on things to avoid being asked about the status of something. 


I think this is because it is never an easy question to answer. After all, it is not like I can answer it with a one-sentence response. Status of malware: the correct answer is not that it is malware and that it infected the asset. No, there is a long conversation about all the different methods that were used to clean it up, if it has spread, how it got on the asset, or how it is going to be prevented in the future. 


Early in my career, I had to give briefings to a bunch of high-ranking military officers every single morning. They did not ask about the status. You put the information on a slide and had 4 minutes to present your information. They either had questions or did not have questions. It was as simple as that.


Now, I have to explain the status of everything that I am working on in terms that anyone can understand. Sometimes I just want to say that I am working on the thingy and it is doing a thingy and the thingy should be done soon.


Or maybe skip the whole status thing and do my work.

I have learned that the higher you progress in your career, the more meetings that you have to go to.


The more meetings that you have to go to the more status discussions that you have to have with everyone. This is an ongoing problem in which you talk about the status more than working on the status.


I remember when I was working on a time-sensitive matter and I started asking people to do certain tasks to support my efforts in figuring out the solution to the problem. I did not realize until later that when I thought I was asking, I was just telling. I was working on something and so engrossed in figuring out how to unwrap all the parts that I did not check myself to ensure the message I was delivering was being received in the manner I intended it to be sent. 


Did the issue I was working on get resolved? Yes.


Did the communication of the status go well?  No, not at all.


I have learned many things since then and now I learned that people know I am mad when I get overly polite. I laughed hard to first time I heard that. 


I have learned that often when someone asks the status of something it is either I have not communicated enough or they are checking a box. The first one is easier to fix because I can set calendar reminders to send updates. The second one is mostly a waste of time because it is not productive in any way.

Comments

Post a Comment

Popular posts from this blog

Understanding Protection (SC)

Understanding Protection (SC) These controls focus on protecting system boundaries, communications, and preventing unauthorized data exposure. Let's break down the key SC controls with examples. SC-1: Policy and Procedures This foundational control requires documented policies and procedures for system and communications protection. Example: SYSTEM AND COMMUNICATIONS PROTECTION POLICY Version: 2.1 Last Updated: 2025-01-02 1. PURPOSE This policy establishes requirements for protecting the organization’s cloud infrastructure and communications. 2. SCOPE Applies to all cloud systems within the authorization boundary. 3. POLICIES 3.1 Encryption Requirements - All data in transit must use TLS 1.2 or higher - All data at rest must use FIPS 140-2 validated encryption - Key rotation required every 365 days 3.2 Network Security - All external connections must traverse a DMZ - Firewall rules follow deny-by-default principle - Monthly review of access control lists 4. PROCEDURES 4.1 Firewall ...
Read more

Security Assessment (SA) Controls

The Security Assessment (SA) family of controls, derived from NIST 800-53 Revision 5, plays a pivotal role in keeping systems secure over time. What Are the Security Assessment (SA) Controls? The SA family of controls focuses on ensuring that security controls are assessed for their effectiveness and are continuously monitored throughout the life of the system. This means checking whether the security measures in place are not only effective but remain effective and up-to-date as time progresses. For FedRAMP Moderate, these controls are crucial because: They ensure security controls are evaluated regularly. They support continuous monitoring for vulnerabilities or weaknesses. They establish corrective actions when necessary. SA-1: Security Assessment and Authorization Policies and Procedures Control Overview SA-1 requires the development of security assessment and authorization (A&A) policies and procedures. These procedures outline the process for conducting security assessm...
Read more

FedRAMP Moderate Rev 5 SI Controls

  In this post, I'll break down each SI control in FedRAMP Moderate Rev 5 and provide tips.   SI-1: System and Information Integrity Policy and Procedures The key to a strong base is well-documented policies and procedures.  For SI-1, organizations must: - Develop and maintain system and information integrity policies that address purpose, scope, roles, and responsibilities - Define procedures for implementing security controls - Review and update these documents at least annually Example:  Create a System and Information Integrity Policy document that includes: - Malware protection requirements with procedures - System monitoring procedures - Software and firmware update processes - Security alert handling processes and procedures - Error handling protocols  SI-2: Flaw Remediation Flaw remediation is key for maintaining system security.  Organizations must: - Identify, report, and correct system flaws promptly - Test software updates before deployment...
Read more