Briefing

How GE Uses Six Sigma to Drive Security ROI

Francis X. Taylor, General Electric's chief security officer, explains how to apply process improvement methods to manage security risks.

June 06, 2007 — CSO — What gets measured gets done. And when you analyze what you’re doing in a quantitative way, you identify opportunities you didn’t know you had.

That may be a simplistic way of defining Six Sigma and other methodologies designed to improve business processes. But as Francis X. Taylor, CSO of General Electric , emphasized to an audience of security executives at the CSO Perspectives conference in March, you don’t need to be a Six Sigma Black Belt to use its principles and benefit from the results.

“What makes a great security leader is the ability to develop insightful strategies that support the company’s goals,” Taylor said. “Most of you have professional skills, market knowledge, you are results-oriented. [You need to] combine that with process thinking” and use data to drive decisions from an outside-in perspective, he added.

A methodology like Six Sigma “requires a change in how you think about your organization and how it works,” Taylor said. It requires shifting loyalties from how your organization operates to how those operations affect customers—the people and organizations who determine the value of what you produce. Performing well in this task adds value to your organization, can help security executives anticipate risks and identify resources to mitigate them, and it enables your leadership to pursue new opportunities for growth, he added.

To show what he meant, Taylor shared anecdotes from his career, which has included stints as assistant secretary of state for diplomatic security and U.S. ambassador-at-large for counterterrorism for the State Department under Colin Powell.

Taylor said that process changes often run into resistance from employees who feel threatened by changes to processes they own. It’s important to make process owners part of the effort to reexamine how a process works and to identify ways to improve it. Taylor recounted the efforts of employees at a locomotive engine plant in Erie, Pa., who looked at their manufacturing processes and moved from what he called working in an iterative fashion to a more combined process, where some prework was done with parts earlier than in past processes. The result has been cutting the time to make an engine from 58 days to 29 days.

Among the examples of process gains Taylor cited in his presentation:

Policy violations. When Taylor worked at the State Department, Congress demanded reports on employees’ security violations. The department initially included those reports in employees’ HR files. But the department needed to reduce security violations, not punish employees, Taylor said. He ordered an analysis, which found that 80 percent of violations involved inattention to detail or ignorance of department security policies. Making employees aware drove violations down by 55 percent in one quarter, he said.