# data[].attributes.headline
Lundby - Digital storytelling - LIBRO screenshots

# data[].attributes.subject
Lundby - Digital storytelling - LIBRO screenshots

# data[].attributes.headline
Forbes article - Storytelling, skill clave

# data[].attributes.subject
Forbes article - Storytelling, skill clave

# data[].attributes.attachment_link.readable_text
As a recovering CIO and current CISO, I discovered one of the fundamental skill sets useful for technical leaders to drive informed decision making by nontechnical audiences is the art of storytelling. CISOs typically communicate in numerous formats, and I have known many of my peers to be masters at documenting and describing security architectures and emerging threats. However, to be truly effective in evangelizing the worth of a security program to the business, a CISO must describe their vision of cybersecurity, risk management and its business value to company employees and leadership stakeholders. This shift of taking highly technical information and transforming it into a presentation that non-technical people can understand and relate to is not easy. In fact, it is a skill that CISOs today must regularly practice as their role continues to evolve into one that supports business operations.

I've previously shared my views on the skill sets cybersecurity teams and CISOs require to be successful. And the one core skill I identified for both team members and CISOs was the ability to effectively communicate. However, even with all of the communication methods available, most security team members and executives struggle to convey a "security has value" viewpoint to audiences -- they get lost in the minutia of their organization's business culture for how employees should present issues. They use PowerPoint slides, memos and long, methodical missives based on corporate communication policy, then wonder why their efforts are in vain.

I believe this issue is especially critical for CISOs because they work in two worlds, that of security and business. Many of them overanalyze the message they want to communicate and then build their case for the solution they want using metrics, statistics and experience. However, a data-driven approach often doesn't resonate with what the audience knows and feels. The audience's disparate views will oppose the CISO's presentation because it doesn't resonate with the viewpoints of the audience, and in the end, the audience often dismisses the importance of the CISO's message. This analytical approach loses audiences who do not have the security and technology background to understand its intent. For these types of audiences, CISOs need to develop the communication skill focused on speaking to the heart - the skill of storytelling.

CISOs today are caught in a landslide of change as their roles within businesses undergo an extreme transformation. CISOs are required to manage risk, deploy an effective cybersecurity program and drive a vision for cyber resilience. A large part of their effort revolves on trust between the security teams and the business. Much of this work requires evangelizing the value of the security program to employees, which can be a relentless task. I have found laughter and storytelling are key tools to help me be effective as a CISO and relate why a change needs to be made to help the company. Storytelling is used to express ideas through emotion, to persuade an audience about a point of view by giving it context and relating it to the audience's current view of life at home and business. Storytelling brings the audience along on your journey - and point of view. I incorporate storytelling as a flexible formula to relate the current problems a business faces and the value added to the business when issues are addressed. I end my story by describing the future outcome that would be better for all of us. I picture the core components of using storytelling as follows:
Context + Value = Informed Decision Making
* Context: This is where the CISO seeks to provide insight into the audience and help them see the CISO's point of view. An example of this would be making the case that the company should be ISO 27001 certified. In describing the need for this initiative, I may relate it to how, as parents, we pick out a doctor for our children based on the certifications, education and experience we feel demonstrates a competence that would be appropriate for our family. Much how parents pick a qualified doctor, customers look at companies to seek external certifications like ISO 27001 to demonstrate they have taken the extra steps to protect customer data and meet industry best practices for cyber resiliency and risk management. Helping the audience see the security need through a personal lens such as a story helps the CISO deliver a technical message in a format that engages the audience and provides understanding. In essence, it builds the bridge between the CISO and the audience, who is now interested in the message.

* Value: After the CISO has delivered their contextual story and the audience has gained an understanding of the importance of the requested initiative, it's time to answer the question, "What's in it for me?" It is in this part of the storytelling process that CISOs touch on the current state of the organization and then describe a future picture of where the business should be after the initiative has been completed. In this stage, the CISO should mention methods and resources that will be used to accomplish the task, possible impacts to business units and, finally, describe the outcomes that are valuable to the business.

* Informed decision making: This final stage is the outcome of a good story. It is here the CISO, with peers and executive leadership, can make decisions on security initiatives and rely not only on numbers and statistics but also on a contextual understanding of the importance of the initiatives to the business.

The use of engaging stories to drive action and possibly shape the culture of an organization are key reasons why I believe communication skills need to be developed and used by security executives. It gives the CISO the chance to step out from behind the wall of their security program and be visible, to be seen as human and someone to trust. Through this trust, the CISO can develop their security program and ensure it is aligned to their business's needs.

All it takes to have an impact is to begin with a good story.

# data[].attributes.attachment_link.title
Storytelling Is A Critical Skill Set For CISOs

# data[].attributes.attachment_link.description
Taking highly technical information and transforming it into a presentation that non-technical people can understand and relate to is not easy. In fact, it is a skill that CISOs today must regularly practice as their role continues to evolve into one that supports business operations.

# data[].attributes.attachment_link.title
Theory of Change - Change.org Writing good Social Change Content

# data[].attributes.headline
Castillo - Audiencias de periódicos digitales

# data[].attributes.subject
Castillo - Audiencias de periódicos digitales

# data[].attributes.attachment_link.title
Castillo - Audiencias periódicos digitales

# data[].attributes.body
LO MÁS. This is it. Community engages in civic activities when there is good storytelling.

# data[].attributes.attachment_link.title
Nah & Jamamoto Comunicación Digital y Storytelling

# data[].attributes.headline
Yong-Chan - Community storytelling network

# data[].attributes.subject
Yong-Chan - Community storytelling network

# data[].attributes.attachment_link.title
Yong-Chan - Community storytelling network

# data[].attributes.attachment_link.title
What Is Storytelling? – National Storytelling Network

# data[].attributes.body
Dice poco: Vox como partido hizo un storytelling con la palabra "facha" y un relato de desencanto con los políticos actuales que le compró muchos votos andaluces.

# data[].attributes.attachment_link.title
Vox, un storytelling que ha obtenido doce escaños

# data[].attributes.headline
Duarte - Narrativas transmedia y audiencias

# data[].attributes.subject
Duarte - Narrativas transmedia y audiencias

# data[].attributes.body
Muy centrado en juego de rol. Tipo macho dekeabla

# data[].attributes.attachment_link.title
Duarte - Narrativas transmedia y audiencias

# data[].attributes.body
Teoría de cómo es una historia, de por qué los historiadores son contadores de cuentos/historias.
Poco útil.

# data[].attributes.attachment_link.title
Noguero, González y Pasillas - Fashion brands y Storytelling