We All Play a Role in Creating a Culture of Belonging and Diversity

Jen Easterly, CISA Director, and Lauren Zabierek, director of the Cyber Project at Harvard Kennedy School's Belfer Center and co-founder of the #ShareTheMicInCyber movement, write about the importance of diversity and belonging in cybersecurity fields. This article is published ahead of the 2022 #ShareTheMicInCyber activities.

The topic of diversity has been at the forefront of the cybersecurity conversation for years. This has been both valuable and necessary in creating the language and tools needed to understand the benefits of a diverse workforce that will help defend the nation in cyberspace. Organizations like the Cybersecurity and Infrastructure Security Agency (CISA), the National Cybersecurity Alliance, SANS Institute, and RSA Conference, and movements like #ShareTheMicInCyber and #MakingSpace have been leading the charge, making diversity a priority, and raising awareness. As a result, countless professionals across various organizations have told us that they know they must prioritize diversity. That case has been made. Now, the question we hear repeatedly is how. How can we collectively create and foster a diverse workforce and a culture that supports all the benefits that come from the resulting various perspectives and skills?

We know that diversity doesn’t just happen overnight, nor does it happen in a smooth, linear manner. A recent article in Harvard Business Review stated, “In practice…diverse teams often underperform relative to homogenous teams. Why? They face communication challenges that get in the way of their undeniable potential.” The risk here is that these challenges may lead people to believe that diversity efforts will fail right out of the gate—that the promise of diversity cannot deliver, and that we’re stuck in an endless negative loop. However, we cannot think this way. Just because something is hard doesn’t mean that it’s not the right thing to do, nor that we can’t do it. That's why we're exploring the importance of Belonging in Cyber and how to cultivate it for this year’s #ShareTheMicInCyber campaign.

It is important to understand that diversity is more than just putting diverse individuals together in different teams and expecting everyone to get along. That limits their ability to perform at their best. Instead, we have to set the culture that will allow them to thrive and that requires a continued and intentional focus on creating a culture of belonging in the workplace.

A key enabler of an environment of belonging is a concept known as Psychological Safety. This means creating an environment where people feel like they can be their authentic self; where they feel cared for, supported, empowered, and always treated with dignity and respect; where they feel a sense of ownership for mission; and where they welcome accountability and responsibility for their actions. Similarly, the Harvard Business Review article defined it as, “a shared belief that team members will not be rejected or embarrassed for speaking up with their ideas, questions, or concerns.” Even further, as Roy Bahat, Head of Bloomberg Beta recently noted, “People need to feel safe in order to innovate and create”-- and this is especially true in cybersecurity and critical infrastructure where we face an ever-evolving threat.

Building psychological safety begins at the leadership level. At CISA, psychological safety is built through a Cultural framework that includes a set of “Core Principles” that represent what we expect from each other and what we aspire to be. The themes include collaboration, trust, inclusion, innovation, empowerment; and belonging; and are underpinned by the fundamental belief that no asset is more important to any organization than its people, and that people must feel psychologically safe to perform at their best. Indeed, according to leading pioneer Dr. Amy Edmondson, psychological safety is a key factor in healthy teams. A leader’s job—whether at the top of an organization or somewhere in the middle—is to create a safe space for people to speak up, make mistakes, and bring their full selves to work.

We are all responsible for an environment in which our colleagues feel safe, valued, and included. Organizations set norms across the cybersecurity industry, but it is important for them to ask themselves what steps they can take to set the standard for belonging within the workplace. Leaders of organizations, including managers, must set policies and practices and model the behaviors themselves. So, ask yourself, what can you do to set a culture of belonging? What decisions can you make to ensure people feel safe in speaking up, both as incentives and disincentives? When your team sees your actions in modeling inclusive behavior, they too will model the right actions and look out for harmful behavior.

Curiosity can help us to investigate our own feelings and actions and can help us to break down the barriers that isolate us, to create connections that lead to a sense of belonging. The Harvard Business Review article provided additional questions that we could ask of each other:

Hopes and goals. What do you want to accomplish?
Resources and skills. What do you bring to the table?
Concerns and obstacles. What are you up against? What are you worried about?”

Additional suggestions for creating psychological safety on teams included, “framing meetings as opportunities for information-sharing; framing differences as a source of value; asking open questions; and asking questions that build shared ownership and causality.”

Some of us are working to find our voices, while others feel that they cannot share their own voices and be heard from their team. It is on all of us to recognize these behaviors and elements and to take action in building a culture of belonging and safety. Remember, we all have the power to act, not just to build better cybersecurity teams, but for the overall security and resilience of our nation.