Executive Sponsorship
Identify one or more key executives in a supporting role. Ensure they understand the importance of implementing EKCM best practices and the objectives and timelines.
Summary
Provide them regular updates with measurable results. Raise issues as they arise and track resolution.
What is this?
Executive sponsorship means enlisting the support of one or more executives who clearly understand the importance of implementing EKCM best practices and will enlist the support of all necessary groups and take ownership of issues that arise.
Why should I care?
Getting support from executives in your organization for implementing EKCM best practices is critical due to the cross functional nature of key and certificate management in most organizations. Implementing EKCM best practices requires cooperation, time/resource investment, and changing processes. Many groups see encryption as a necessary evil which they would prefer to be managed by somebody else and not be bothered with. The reality is that multiple groups have a role in EKCM. The groups you will likely need support from include:
- PKI Administration
- Network Administration
- IT Operations – Each group responsible for certificates where certificates and private keys are deployed.
- Application owners
- Systems owners
- Security Architecture
- Active Directory Management
- Firewall Administration
- Project Management
- Audit/Compliance Group
If you don’t get the support of these groups, your EKCM project may experience delays. An executive is often needed to communicate at the highest levels about organization imperatives for proper encryption management and ensure that organizational inertia is overcome.
What should I do?
- Identify at least one executive with sufficient organizational authority to make things happen.
- Gain mutual agreement with the executive(s) on the drivers for implementing EKCM best practices, project objectives and timelines, resources needed (dedicated and supporting), and roles and responsibilities.
- Ensure the executive(s) proactively communicate these items (drivers, objectives, etc.) to the executives responsible for stakeholder groups needed as part of the EKCM ecosystem.
- Provide regular updates to the executive champion(s) on progress and any issues encountered. (See Reporting for more on this.)
- Only use your sponsorship to overcome organizational resistance as a last resort. Wherever possible, enlist other stakeholders in the value of adopting EKCM best practices.
