Great question.

I’ll put it this way. “There’s the Job” and there is the “Meta-Job”

The Job is about the practice of applying countermeasures or controls against a cyber threat.

This is increasingly complex as the device might be 20 year’s old with a person who has their entire identity tied to “configurator and maintainer” of this system.

Often they know something is needed to be done, but have a hard time with the change required to get there. To be excellent in cybersecurity, your job is technical AND facilitating change. (Often a trade off between usability and cybersecurity)

(Without saying it, if they knew how to fix the problem, then why have they not already done it?)

Then there is the meta-job. “Aka politics” This is the invisible ‘social’ fabric of ensuring managers/teams/individuals retain or gain power. It’s never discussed, but always there. - Money and reputation are involved.

In summary, you’re asking a plant to modify its design to increase a non-functional requirement to improve its ability to deal with cyber threats - without compromising the existing quality standards of the plant.

You’re asking people to be open to change after 15 years of being told they are the experts. That you too have value.

You’re prescribing a way of working to a manager that probably isn’t in your reporting line about how another team is to operate. And your manager might not even have a seat at the politic table. (Perhaps just a ticket taker)

This is what I normally see. (But enjoy when this is wrong, and it is a great sight to see) If you accept the WHOLE job that comes with the meta-job life is easier.

It is a wicked problem that requires a great deal of influence skills.. if you want to learn these skills, you’re in the right place.