Security Confidential S3 E10 Jeff Manhardt

Manoj Tandon: Hello everyone. Welcome to another episode of Dark Rhino Security Confidential. Today we are honored to have Jeff Manhardt join us. Jeff is the Chief Project Officer at Kaleida Health, President of the PMI Buffalo Chapter, and an adjunct professor at Daemen College. Jeff believes in the art of the possible and the power of the “why.” Welcome to the show, Jeff. Thanks for joining us.

Jeff Manhardt: It’s awesome to be here, and I’m glad that you’re checking out my LinkedIn profile.

Manoj Tandon: Well, you know, there’s some interesting things on there, especially when you put the power of the “why” and the art of the possible. Those catch a lot of attention. Maybe start with that. Give a little bit on your philosophy here.

Jeff Manhardt: Sure, I appreciate that. I read a lot, and Simon Sinek talks a lot about the power of why. I read that a few years ago and have really built that into everything that I do, whether it’s part of PMI, teaching at Daemen, or my work at Kaleida. You bring people with you when they believe in the why, and so that’s how I believe in the power there. The art of the possible is about discovering what you may not already know. Sometimes we get into the things that we know, we stay on that path, and we forget to look outside that path and discover new possibilities.

Manoj Tandon: Those are two tremendous statements. On the cybersecurity side at least, we always try to preach to our clients that their biggest cybersecurity asset is their people—bigger than any technology or anything else they have in place. If they take the time to bring people into the fold and explain the why behind policies and behaviors, then what you find is people are very reasonable. If they understand the why, they’re much more likely to adopt it than if it’s just a mandate of “Do this or else.”

Jeff Manhardt: Think about yourself. If someone tells you you’ve got to have a 19-character password, you just think, “Why bother? I don’t see the value.” But if you walk through what cybercriminals can do when you have a four or five character password and how they can access your entire digital footprint, then people start to think differently about why security is important.

Manoj Tandon: That’s a great example. And stepping out of one’s paradigm—I see this a lot—if you believe you know everything, then you’ve given up all possibilities.

Jeff Manhardt: Right. I learn every day. I learn from the folks that work for me, the folks I work for, and from my family. I try to have a mantra of “Learn something new every day.”

Manoj Tandon: I hope you’re successful with that. If you are, then you’re a much wiser man than I am. Tell me, this whole past year—you’re in healthcare—it’s been insane. We’ve heard the horror stories and seen the tragedies unfold as a result of the pandemic. But when you look at a major health system and running projects for it, how has that impacted you folks on the back end?

Jeff Manhardt: A year ago at this time, on a Friday, my boss said, “I think we’re going to need to send people home, and we’re going to need to figure out how to get them the opportunity to work from home.” Most of the folks were working from the office. We didn’t really have a work-from-home policy, so we had to change policy and technology within 48 hours, and that included thousands of people being moved to that remote space. A tremendous amount of time and effort went into making that happen, but that was just the start. We had to look at telehealth, which was a technology that existed but wasn’t widely used for a variety of reasons, whether reimbursement or adoption. It went from an “also-ran” product to a lifeblood of the organization. That was the start of the challenges that occurred over the next few months and even today. We’ve had to be agile—big “A” and small “a”—and nimble about what needed to occur at a moment’s notice. That still happens today. You look at testing and vaccines coming out, and hospital systems are at the forefront of those as well.

Manoj Tandon: I’ve got to imagine that when you’re implementing a remote workforce, work-from-home, and telehealth, and we think of healthcare cybersecurity, we think a lot about compliance issues like HITRUST, SOC, and HIPAA. Did you guys get any reprieve on some of these regulatory mandates from the federal government as the pandemic escalated?

Jeff Manhardt: The short answer is no. Those things are paramount. Whether the government requires it or our patients require it, it’s important and imperative to have a system that is trusted by patients and physicians alike. We had to go in with that as a starting point: do we have the security in place at a core level, and can we build upon that? That’s how we addressed it. We addressed it quickly, within hours in some cases, and it took calls to a lot of vendors to work through things. But you can’t shortchange that.

Manoj Tandon: From a regulatory and compliance perspective, were there things that emerged that might not have emerged if not for the environment everyone was thinking about?

Jeff Manhardt: I’d say there are things that hastened because of COVID. There were conversations over time around telehealth and some of its components. There were conversations around working from home, but there were always roadblocks that had to be thought through. A lot of times we let those string out because there wasn’t a sense of urgency prior to the pandemic. COVID forced our hand and hastened things that had been in the works for a while.

Manoj Tandon: Telehealth, at least personally, has been great. It’s such an efficient means. It surprises me that people were resistant to it prior to the pandemic because it’s safe and convenient. You don’t have to go into the hospital or doctor’s office or sit in a waiting room. The process I experienced with the Cleveland Clinic was seamless.

Jeff Manhardt: I’ll take a page out of change management and recognize that people don’t like change. If going to the doctor works, people ask, “How can the doctor do the same things over the phone?” How can they check my hearing or use a stethoscope? Those were conversations we had to work through. But once people experienced telehealth and saw that it worked seamlessly, it changed a lot of hearts and minds.

Manoj Tandon: Is there any advice you can offer, either as a professor or a project management professional, on implementing a program that involves cultural change? How do you make that shift happen among the general population in a company?

Jeff Manhardt: The buy-in and the power of why are really important. I leverage change management principles around awareness. First, you have to create awareness of what the change is. Then you build desire for the change, which is where the why comes in. Why do I want this change? What is it going to do to help me? Then people need knowledge about the change and the ability to be part of it, whether through training or communication. Finally, there’s reinforcement. You can’t just say something is changing on Saturday and never talk about it again. You have to continue reinforcing why the change is valuable. That reinforcement completes the loop.

Manoj Tandon: That’s a tough order to follow, especially at an enterprise level where thousands of people are involved. I imagine there’s a lot of resistance when you get to execution.

Jeff Manhardt: Sure, but luckily there’s a framework around change management that works well for enterprise-wide organizations. No matter what framework you use, though, you have to start with the power of why. If people don’t buy in, it becomes very difficult for change to occur.

Manoj Tandon: How do you measure success now? Have the metrics changed with the new work environment and the conditions by which you measure a project or milestones?

Jeff Manhardt: Some of the change was already happening. If you work on agile teams, you’re already used to metrics occurring rapidly. You stand up, talk about yesterday’s work, today’s roadblocks, and successes. Those practices were helpful during the pandemic. From a metrics perspective, we changed the grandiosity of some of our dreams. Instead of asking, “How do we get 20 miles away?” we focused on “How do we get from here to there?” That helped crystallize and focus people differently than before the pandemic.

Manoj Tandon: Where do you see project management methodologies evolving in this brave new world, especially when people may no longer all be co-located?

Jeff Manhardt: I’ve heard people say this is going to be permanent, but I think things are cyclical. I’ve seen ebbs and flows over my career. People recognize the value of focused time and alone time. Some folks are more productive remotely than in a busy office. There’s definitely value there. But I also think collisions matter. It’s harder to have those spontaneous hallway conversations remotely. In person, you can solve something in five minutes just by bumping into someone. That kind of collision is still valuable and will continue to be valuable in the future.

Manoj Tandon: We’ve seen the same thing in sales. Gone are the handshakes, lunches, and relationship-building in person. We’ve gained efficiency, but we haven’t solved the puzzle of how to bring those collisions back because they’re critical to building relationships.

Jeff Manhardt: I agree. It builds trust. Seeing people in person and having small talk builds understanding that’s hard to replicate remotely. At the same time, we’ve become more efficient because we’re not spending 20 minutes talking around a two-minute topic anymore. There’s a balance.

Manoj Tandon: Let me ask you a cybersecurity question. How do you think cybersecurity should be incorporated into project execution?

Jeff Manhardt: It starts at the beginning. At Kaleida Health, we built into our methodology the recognition that security needs to be addressed at project initiation. Whether it’s a questionnaire or a person involved, you have to ask questions upfront. Are we connecting outside the firewall? Are we transporting video streams to doctors worldwide? Is it secure and encrypted? Those questions need to be asked at the beginning because they impact everything at the end. “Upfront” is my motto.

Manoj Tandon: Do you think there’s recognition now that cybersecurity is more of a business problem than an IT problem?

Jeff Manhardt: Sure. When you look at headlines around hacking or ransomware, they don’t talk about a failed router or encryption algorithm. They talk about business impact. So yes, there’s absolutely recognition that cybersecurity is a business problem.

Manoj Tandon: In my experience with larger health systems, there’s often a finite budget, and equipment and facility needs traditionally got higher priority than IT or cybersecurity initiatives. Is that changing?

Jeff Manhardt: I’d say no matter the industry, unless you’re specifically in technology development, it’s easy to think of IT as the plumbing of the organization. Who thinks about the sewers when building a house? But over time, I’ve seen business folks learn technology and technology folks learn the business. When those two sides combine, they can have balanced conversations. And with ransomware and cyberattacks constantly in the media, no one wants to be on the front page as the next victim. That’s definitely impacted the mindset of business leaders.

Manoj Tandon: It would be great if you could put together a class on getting business people and technology people to work together. I think that would be worth the price of admission.

Jeff Manhardt: You and I can work on that. We’ll make a fortune.

Manoj Tandon: That brings us to PMI Buffalo. Where do you see PMI as an organization going in the future, especially with competition increasing?

Jeff Manhardt: I’ve been involved with PMI since 2005 and on the PMI Buffalo board since 2007. What’s truly unique about PMI is the community. They built a global community of chapters and volunteers over decades. That local capability to understand and manage local markets is a huge asset. Then you add the strength of volunteers worldwide. PMI has also adapted by acquiring organizations like Brightline and Disciplined Agile to move into new spaces and future ways of working. They’ve also expanded offerings from beginner project management education to program and portfolio management for massive projects. I hope they continue to innovate into the future.

Manoj Tandon: Any advice for chapter presidents or boards that might be struggling to provide value to their members right now?

Jeff Manhardt: I think all associations lost membership over the last year, whether because people lost jobs, organizations stopped paying memberships, or life got in the way. We focused on a few things. First, we know the number one reason people attend events is for PDUs. Most of our members have certifications that require continuing education, so we focused on virtual events that still delivered value. Second was networking. We had to rethink what networking looked like virtually through gamification, breakout rooms, and technology. Attendance at our events actually went up in 2020. One reason was that events were free since we didn’t have food or venue costs. People who normally couldn’t travel to events could now attend virtually.

Manoj Tandon: I would not have guessed that. That’s wonderful if you’re getting greater participation. Have you been able to pick up sponsors in the process?

Jeff Manhardt: Everything had to be reimagined. We were fortunate to have sponsors maintain agreements through the pandemic. We also attracted sponsors with broader national footprints because virtual events allowed participation from multiple regions and chapters. That changed the conversation.

Manoj Tandon: Let me ask a controversial question. PMI changed the way PMP certifications could happen last year and changed the criteria. I imagine that had an impact on chapters. What are your thoughts?

Jeff Manhardt: PMI has been upfront with chapters and educators. They recognized that the PMP certification is one of their strongest brands, but there was unevenness around the world in training quality. Like any organization protecting and advancing its brand, they focused on how to improve that. Did it impact chapters like PMI Buffalo? Yes, especially in the short term. Revenue streams and costs are different now. It will take time to work through, but PMI is aware of the challenges and continues listening to chapters.

Manoj Tandon: That’s probably the most powerful statement—if they’re listening to people like you, hopefully whatever direction it goes will involve partnership with the chapters. Speaking of partnerships, Dark Rhino Security’s core business is cybersecurity, but we also have a large hosting business. We’re fortunate to have PMI Buffalo and many chapters worldwide as clients. Jeff, what are your expectations of us as a hosting provider?

Jeff Manhardt: I would start with security. We want to make sure the hosting platform is secure. We provide member-authenticated content and documentation, so keeping that secure is paramount. I also appreciate that Dark Rhino provides an environment that is easy to use for new administrators. We’re all volunteers, and volunteers come in and out every couple of years. Often someone inherits responsibility for the website with only a few minutes of training. Dark Rhino does a good job making the interface intuitive and providing training options that previous providers didn’t have. I’d love to see more integrations with technologies like Slack, Trello, Instagram, Facebook, and social media. A native mobile app would also be valuable, especially for in-person events with QR codes and attendee interactions. So far, Dark Rhino has been a fabulous partner.

Manoj Tandon: That’s very kind of you to say. Is there anything you’d critique us on?

Jeff Manhardt: I always look at where we can go from here. Integration with other technologies and a mobile app are areas I’d love to see expanded. There’s already some functionality there, but there’s more that can be done.

Manoj Tandon: I can guarantee everyone responsible for this will listen to your feedback. As we come to the end, are there any events, books, appearances, or anything you’d like to plug?

Jeff Manhardt: I appreciate the platform. It’s been great having this conversation. Our premier events are our Professional Development Day events, and we have one coming up in April with two half-day training sessions on building an effective multi-generational remote workforce and sprinting in the new agile world. It’s going to be an exciting event.

Manoj Tandon: This episode will be live on March 22nd, so hopefully you’ll get some attendees from it. Anything else you’d like to add?

Jeff Manhardt: This has been a great honor for me. I appreciate the conversation today, and I’m glad you’re doing this. I think it’s helpful for people to hear from others with real-world experiences and practical knowledge they can apply in their own routines.

Manoj Tandon: We appreciate that, and that’s our aim. We want to educate people on what their fellow colleagues are doing with real-world experiences and practical knowledge they can put to use in their daily routines. With that, everyone, we thank Jeff for joining us. Jeff, it’s been an honor.

Jeff Manhardt: My pleasure. Thanks for staying up so late to do this.