How One Association Leads on Data
Innovation is about ideas and passions, but ISACA succeeds with it by putting research first.
As prompts for innovation go, being stuck in traffic isn’t the worst thing.
Earlier this year, Timothy J. Mason, chief marketing officer at ISACA, was listening to a news report during his morning commute about the upcoming State of the Union address. Cybersecurity would be one of themes of the president’s speech, and that topic was top-of-mind at ISACA, an information-systems association that recently launched a training program called Cybersecurity Nexus. Mason called a meeting.
“I said, ‘We should target to be the State of the Union address,’” he says. “It looked like I was in a room with people who had just got off a scary carnival ride.”
It was an ambitious idea, but from Mason’s perspective not absurdly so. Mason came to ISACA in 2012 after more than two decades leading marketing at Motorola, where he emphasized data-driven strategies. At ISACA, he’s ramped up the tools to gather information on the effectiveness of its marketing campaigns, implemented more sophisticated surveys, and trained up staffers.
But, as Mason says, “the analytics are only good if you apply them to strategic initiatives.” ISACA’s takeaway from the data that it was gathering was to start Cybersecurity Nexus as well as create new programs focused on women in cybersecurity, and to host and sponsor the annual Global CyberLympics, an hacking competition. “If we wouldn’t have had the insights, we wouldn’t have been able to drive innovation into our customer experiences,” he says.
This all sounds like an easy, slam-dunk act, though of course it’s not. Part of the challenge, especially for many associations, is that “innovation” is often defined in imprecise or anxiety-inducing terms. (It’s one of the reasons why the term is overused.) And when you’re challenged to “innovate” but don’t have useable data to do it with, bad ideas have a way of taking flight—or good ideas don’t get support. When Mason arrived, he says, “There was no ability to have any insight into something other than opinions for what was happening, and as we know opinions are dangerous things to base strategy on.”
What’s appealing about ISACA’s approach is that it leads with information—and that, as Mason suggests, gives confidence to the teams that are trying to do something new. That is, so long as there’s strong leadership that knows the connections between the information and strategy, and can inspire others to get behind the ideas that spill out of them. “I think if organizations are having a hard time doing that, one should consider what are the leadership profiles that they’re bringing in to help change the organization, what do the leaders look like that are truly leading change?” he says. “You need an individual spark somewhere in the organization, and you need the culture to allow that spark to thrive.”
Which brings us to the State of the Union address. In response to Mason’s challenge, ISACA deployed a survey on cybersecurity to its members and freshened up its website to include information on the president’s proposals. On the morning of the speech, the association had talking points ready to go and coverage from political news outlets; ISACA was posting information throughout the speech itself and in the days after. (Signature magazine recently covered ISACA’s approach in detail.) If ISACA didn’t get a direct mention from the president that night, the association did position itself as front and center on cybersecurity—ISACA CEO Matthew S. Loeb attended a White House cybersecurity summit the following month.
Strong opinions about what an association should be doing isn’t necessarily a bad thing, Mason says. But don’t get it backward—let the strong opinions be a function of the research the association has done to find out what its members are concerned about and where the association can best position itself. “The data forces people to say, ‘That’s the reality as we know it.’ After that, the opinions matter. But you have to have that flagpole to go back to to say, these are the facts. Let’s act on the facts.”
What do you do to help encourage your organization to be more data-driven? Share your experiences in the comments.