Introduction
More often than not, clients expect cybersecurity professionals to provide impartial and professional guidance, and advice during consulting engagements. One tool to meet this expectation is written communication.
In this blog, I provide a brief introduction to technical writing focusing on style and its importance in consulting.
Understanding Your Audience
The technical writing style is the de facto writing technique in technical and occupational fields, including cybersecurity. It is an essential tool that allows professionals to communicate concepts surrounding a particular subject in a clear, logical, and concise way.
The first critical step in technical writing is to understand your audience. An audit report for executive management will greatly differ in focus and granularity compared to a technical root cause analysis report intended for a security engineering manager. The following paragraphs outline two necessary components of understand your audience.
Identify Your Audience
Establish the target audience for your writing. Understanding your target audience can help determine what information you present, how you present it, and what level of detail you include in your writing. In my experience, consultants typically address the following audience types:
● Practitioner (aka Expert)
● Lower-level management
● Middle-management
● Executive management
● Corporate stakeholders, such as Human Resources or Legal Counsel
Perform Audience Analysis
Audience analysis is necessary to effectively cater your writing style to the target audience, which in turn can help meet the reader’s expectations. Generally, I consider the following criteria before producing a written document:
● Objectives, requirements, and the purpose of the message I intend to deliver
● Reader’s background, knowledge, and experience
● Culture and communication preferences
● Industry Sector
Audience analysis does not have to be a formal process. I often briefly assess the aforementioned points to ensure I understand my target audience.
Ensure Proper Style
During countless peer reviews of reports and other written communication, I observed that consultants often find style one of the most challenging technical writing aspects. The following paragraphs denote three technical writing style guidelines, that can greatly enhance the quality of your reports.
Formal Style
The formal style is the de facto style for reports and other documents that cybersecurity consultants produce. The style prescribes the use of direct and impersonal language. For example, writing in the third person and focusing on a specific subject while presenting information and findings would align with the formal style of writing.
Focus on Facts
Normally, a consulting engagement concludes with a report that contains an objective and impartial outcome. This outcome can be audit findings, incident investigation findings, or feasibility analysis of a proposed solution. Consequently, report authors must focus on facts and avoid speculation or assumptions. Where hypothesizing is unavoidable, you should clearly convey a certain degree of confidence as it relates to certain events or findings. Furthermore, the author must justify their hypothesis through the correlation and corroboration of relevant observations and information.
Active Voice
Employing active voice can help engage the audience and improve the clarity of thoughts, while being concise and actionable. Moreover, active voice helps move the narrative, improve flow, and generally improve readability.
Action verbs, especially when combined with active voice, add clarity, bring a confident tone to your reports, and make them sound more authoritative. Action verbs emphasize the actions that the subject performs.
7 C’s of Professional Writing
In her book entitled Technical Writing Essentials, Suzan Last spells out the seven characteristics of a robust professional writing style. She refers to those characteristics as The 7 C’s of Professional Writing. I consider those characteristics an excellent quality checklist when producing executive summary statements, reports of findings, or briefing a specific audience on a client engagement status. The following list briefly describes each characteristic:
Clear - clarity refers to expressing a message precisely and providing the necessary information in an organized and easy to follow way.
Coherent - coherence is closely related to clarity and helps ensure that the reader can easily follow your ideas. Coherence creates a logical flow between sentences and paragraphs and ensures that one idea logically leads to another.
Concise - conciseness refers to expressing a message clearly and succinctly without unnecessary and redundant words while maintaining clarity and logical flow.
Concrete - concreteness means that your communication is specific and definite, and you precisely and accurately convey your message.
Correct - correctness means you use the right words and terms to describe your ideas and concepts and ensure that the presented information is accurate and your sentences are grammatically correct.
Complete - completeness means that the reader has all the information they require to understand the message and make decisions.
Courteous - courteous writing focuses on the reader and means that your tone and language are appropriate and respectful.
Peer Review
Finally, peer review is critical for ensuring quality and maintaining a high standard for consulting reports. Even seasoned cybersecurity professionals write imperfect reports and find it invaluable when their peers critically evaluate their writing and provide constructive feedback and suggestions for improvement. I also find peer reviews to be one of the most valuable tools for improving writing skills.
Conclusion
Technical writing is an essential consulting skill that cybersecurity professionals can leverage to provide impartial and professional guidance, and advice during client engagements. The first step in professional writing is to identify and analyze the audience to tailor your writing effectively. Style is another critical element that directly influences the quality of your written communication. Finally, peer reviews can help consultants grow their writing skills and ensure their reports and other forms of written communication conform to the 7 C’s of Professional Writing.