Chapter 3 of 14 · Weeks 2–4
The Org Chart Is a Map, Not the Territory
- Who actually makes decisions here?
- Why do some people with small titles have so much pull?
- How do I find out who to call at 2 a.m.?
The org chart shows reporting lines. It does not show who gets listened to, who holds the passwords nobody else has, or whose quiet no ends a project. You need that second map, and nobody will hand it to you.
Three questions that draw the real map
- "When something important breaks at night, who gets called?" The names you hear are your real operations team, whatever their titles say.
- "Whose sign-off does a big change really need?" Sometimes it is a committee. Often it is one respected engineer.
- "Who here has been around long enough to know why things are the way they are?" Find these people early and treat them well.
Draw the map yourself, privately. Note who people go to for advice, who blocks and who unblocks. Update it as you learn. It will be wrong in places, and that is fine.
The question you might not ask out loud
Is it political to think about influence like this?
It is practical. Security work crosses every team. If you only work through formal lines you will be slow, and in an incident slow is expensive. Knowing who really decides is how you get a decision at 2 a.m.
Turn the map into an incident roster
Your map pays off when something goes wrong. For each kind of incident you can imagine, write down who decides, who must be told, who does the work and who speaks outside the company. If a name appears only because of the org chart and not because they actually know the system, fix it now, while it is calm.
- List your five most likely incidents: ransomware, a lost laptop with data, a compromised admin account, a supplier breach, a leak of customer data.
- For each one, name the decision maker and a deputy.
- Check every name with the person named. Many will be surprised.
- Put phone numbers somewhere that still works when email and chat are down.
Expect the map to change. People move, leave or lose interest, and a reorganisation can redraw the formal chart overnight while the real one stays the same. Look at your list again every quarter, and after every incident, because an incident is the moment the real map shows itself most clearly.
Rule of thumb:Rule of thumb: if a name on your incident list has never seen the list, it is not a list yet.