Role of Cybersecurity Documentation: Beyond Compliance with Abhishek Sahoo

Today I see documentation not as a content creation, but I see it as basically a strategic business function that will definitely help us and the readers to go through a long way. What is that one business metric that shows documentation is truly adding value. I think good documentation doesn't just explain systems, it enables people, processes and business to perform better. Welcome to the Knowledge Based Ninjas podcast where Gauri Ram Kumar of document 360 finds the best SaaS self service knowledge bases in the world and then interviews their creators. Let's get started with today's episode. Good day everyone. Welcome to Knowledge Based Ninjas podcast, another episode and today with me I have Abhishek Sahu, cybersecurity documentation specialist at Tetrapack. Welcome Abhishek to the podcast. How are you doing today? Thank you so much Gauri for the invite. I'm doing good, how about you? All good? All good. Very busy as always, Abhishek. So I will try to do justice to your experience. You've got around 13 plus years of experience in the space, so let's see how much we can get in the next 15 to 20 minutes. We but before we start anything, as I mentioned, you've spent over a decade in the space, so you've seen lot of changes. But I want you to now help us understand how did you get into this technical documentation career and how has that journey shaped your expertise? Great Gauri, I think that's a very nice question to start off with. So yes, definitely, because no one gets a chance to come down to whichever subject or whichever domain they want to. Technical writing has never come down on my first space. I have done a lot of, you know, here and there. It has been a roller coaster till I ended up as a technical writer. But what initially drew me to technical writing was my interest specifically in simplifying, you know, like complex informations into breaking down them into more easier ways so that a layman or maybe a technical person will be able to understand. So during my early career I never noticed that any strong products if you go down so they always struggle to get the things in place. Why? Because, because the communication was unclear, the documentation was not perfect or some something or the other. So this is what exactly I figured out, these are the loopholes. So over the last 13 years, if you ask me, working across multiple domains because I have been into fintech, I have been into enterprise applications, into cybersecurity, which is recently I'm going through, so it has taught me a lot of expertise how exactly writing differs from domain to Domain and today I see documentation not as a content creation, but I see it as basically a strategic business function that will definitely help us and the readers to go through a long way. Absolutely. Very well said Abhishek. And first of all, many congratulations for choosing this area and people normally try to stick with one domain but you have been very courageous, I should say, and experimented with a lot of segments which again has its own advantage. Now you just very lightly touched upon the topic. We also started seeing that documentation is not just a support function anymore. Right. When do you think this transition is happening? Like documentation being a support function becoming a strategic asset. Okay, so I will try to make it more simpler for you and for the audience. See documentation, it becomes a strategic asset when it start influencing your business outcomes. So those are the main important agenda that we need to figure out. So when good documentation reduces most of the onboarding time, or maybe it improves your compliance readiness, decreases the support dependency, which is actually the foremost entry gate for any of the documentation part because the support plays a very important role out here and that will definitely speed up response and help team make very faster decisions. And it's no longer considered as a support material. So in my case I would say that it has become a very integral or maybe an operational strategy and boon to the business community. Understand? Understand. So the first noticeable, I would say metric or thing you do is support, is it? Yes. Okay. I make sure that the documentation reduces the onboarding time. So I make sure that the support should be in a very clear and they should be having all the proper documentation which is easier for them to get in touch with the client asking the like whatever questions and queries come dumbs down, it will be easier for them to break it down at that first level rather than, you know, taking it longer time and to create unwanted. Absolutely. Very well said. Now that also brings us to this concept of cost association. Right. So we all know fixing a bug in the initial stages of software is a lot cheaper. And again, addressing a customer query through a good documentation is lot easier and less expensive for a company. Now what is the real cost of bad documentation particularly in cyber security and compliance environment? Okay, that's. That's a very hypothetical question. But yes, I would not say as a bad documentation, but we can say it as, you know, like the documentation was not up to the mark. Let's not make it bad. So as I have been in this industry and I have seen multiple changes happening around and yes, documentation which is not up to the mark will definitely create a lot of issues in cyber security and compliance environment. Anything any documentation which is not up to the mark it can create a very serious operational and business risk which which actually matters to a lot of companies. So this is the formal, this is the like, what do you say? Like the priority that we should be looking out for. Documentation should be up to the mark. And second, if I have come down and if I can give you a little bit of a explanation on this, what exactly it will lead to if we are having as per the cost part. So it can lead to failed audits that goes around on cyber security. Any delayed incident response which is required inconsistency in the processes and the. And the. The biggest one is miscommunication. So these are the things that will definitely hit you in a longer longer way in any high risk environment. And unclear or outdated documentation can directly impact trust of your. What do you say like your partners or maybe your clients that you are into. And it will again trigger the compliance pro posture and your business continuity with the same company or with any of the mergers that you are planning to have in the future. Absolutely. So that again directly affects the company's credibility. It jeopardizes the company's reputation. Right. If not up to mark documentation exists. We all talk about AI and I can't resist without asking this question in many of my podcasts. So where people think AI can do everything and replace everything and everybody but in a high stake environment like cybersecurity which you're currently specializing in what's something that I still can't reliably handle in documentation? Okay, that's a very interesting question. As of now we are in the AI era so definitely everything revolves around us is AI and if we don't know how exactly do you use it then definitely that will cost us something or the other in near future. I completely understand on that. But as I have been here and I can see how exactly AI has been a boon at some point of time it also differs a little bit and where human intervention is required. So my answer to this would be it's an excellent AI is excellent for improving efficiency. Summarizing on content assistance like for example A if we don't know like we we get a topic and we are not clear about it. We can go to AI and and we can get informations like what we can extract what not or maybe to have a little bit of a research as what we can do it. So that's what exactly I think is the biggest thing like summarization and content assistance. But still it actually struggles with the judgment and business critical accuracy. Why? Because there are some point where AI cannot think because it, it takes all the informations from what is available on the web as of now. So in cyber security especially, documentation often requires understanding of an organization risk the compliance that we will go, we will go for some regulatory nuance, operational contents and the intent of how exactly we need to prepare a documentation. So AI can support, I don't disagree with that. It can support the process, but human expertise is still essential for validation. And you can see it as a decision making and mainly which I think because it has, like I have been through this, so I have a small idea about it. It actually impacts a lot on the accountability. So that's what I can see is that these are the things that AI cannot do. Maybe in near future it can, but. But as of now, I think these are the things which I think from my point of view. Absolutely. And we always keep insisting this, right? A human in the loop. So even though AI is a new organization, always remember to keep a human in the loop. So the final click is done by somebody who can be accountable. Absolutely. Now, can a well structured documentation become a real operational advantage for security teams? Just beyond being just a reference material? A well structured documentation improves the consistency. It actually speeds up the incident response, reduces a lot of dependencies on the team and helps the team, like through the team whom you are working and from other teams that are dependent on you, it actually gives you a more efficient during high pressure solutions and for security reasons for the teams, which I think is the foremost and the most important part that we need to go for is documentation can become an operational framework. But like providing some support in audits, governance or any of the kt, like knowledge transfers and all that. But in many ways it becomes a part of the organization's security maturity. Because unless and until we have that, what do you say, like thinking, like out of the box thinking, that will definitely be a situation. So in my case, yes, definitely it will provide you a very good operational framework. Absolutely. Very well said. And that's exactly what the team should feel about a good documentation as well. Now we spoke about how we measure when a good documentation is positioned strategically and just not a reference material or a source document. Right. Which is helping the support team handle the questions in the first go. Apart from that, what is that one business metric that shows documentation is truly adding value? The business metric that is adding value to documentation. Right, Gauri? Correct. Yeah. Okay. How do you measure the success of your documentation so one is already using the support tickets could be one KPI metric that you measure. You also spoke about onboarding, right? So yes, we've seen many companies measure onboarding time spent to onboard a new customer or new team members. So similarly, do you have any other business metric? Yes, absolutely. In this case what I would say is that as I have already provided you with some examples in my future conversation, so that for me the best metric that I can feel is that reduction in support tickets or any repetitive queries that we have that can be eliminated if you have a pretty good documentation on your shelf or in your repository. Why? Because if users may be internal or external from other teams and all that, they can solve it independently. Like for example, if you already have a documentation which is robust, like there is no flaws and all these documentations comes from the customer support. Why? Because issues are definitely being faced by the customers. So if you have a robust documentation of all the queries, FAQs, whatever you have, and we have prepared a very like, we have prepared the documents in a very segregated way that will definitely reduce a lot of support tickets and repetitive queries and, and which will be like, it shows like it can be more on an effective, accessible and adding a lot of business value to the company. Absolutely. Yeah. So we, I recently had a conversation with another customer and though you bring AI or any, any chatbot on top of your documentation, if your underlying knowledge is not very intact and if that is not in the right shape and size, then none of these outer layers are going to work as effectively as you would like to, isn't it? Absolutely Gauri. So as you informed about this, there was one particular situation where I just want to highlight this. No matter how exactly confident your chatbot or maybe your backend team for a chatbot may be, a human touch and a human sitting, just like human sitting just on a laptop and listening to a query and providing you answers is far more better than a chatbot. So that's my personal experience and I've been through this. Okay, that's great, thank you. Now I'm going to move on to the rapid fire round questions. Abhishek so I'm sure you will be referring to a lot of documentation, related resources, blogs and books, anything that you can point us to see initially if someone wants to come down to this field or if anyone, if someone is new and I have to give my expertise, I will definitely tell them that the platform, something like you know, writing the docs, like write the docs is one of the platform I have been into Microsoft Learn into Google Developer Documentation Style Guide and the Microsoft Style Guide as well. And these all communities focus a lot on the writing part as well as on the cyber security part, like for example NIST or maybe the ISO 27001. I will also encourage people to continuously learn about AI tools. Why? Because that will definitely give you an upper hand. So in this documentation journey. So yes, definitely you, you stay rooted to the grounds that you are. Along with that, keep yourself updated or upgraded to the current situations and the scenarios of the, you know, technical tools that are being emerged as of now. Absolutely. Thank you so much. And those are the two references we do often speak about in the podcasts. Thank you. And one word that comes to your mind when you hear documentation. Okay, I think it should be clarity. Why? Because if you are clear about what you are writing and your audiences are clear about what you want to, what you want to make them understand, I think you are doing a good job. Clarity. Okay, now a piece of advice you would give to your 20 year old self. It's already the, the time has already passed by for the 20, but still if given, I would say that focus less on like titles probably you know, what should be the what is your position stuff and all that rather than building or making yourself ready for the current environment where your skills and your expertise will definitely provide you importance. So I would say that you know, like learn as much as you can, improve on your communication skills, have continuous learning about what's new in the market, how exactly we need to go for it, how exactly this particular tool or this particular application will help you in your future endeavors. So always stay relevant is what I can say. Fantastic. The point I liked about the advice you spoke is it just not relates to documentation. It applies to any, anybody, any field, anywhere. Right. So very, very well said Abhishek. Very glad that you spoke about that. As I said in the beginning of the call, I can only do a certain extent of justice to your experience, but please help me with anything else that you would like to add to our audiences today. Okay. I don't know if you know like, because I have literally heard this and being in this organization I have heard a lot about, you know, like okay, being a technical writer, what, what you does. So I have to make myself explain a lot of people of what exactly the job that we do. And to be very honest, when I started off at that point of time I was also not in a frame of mind to understand and to know was okay, what a technical writer does. So you say that unless and until you put your feet on the on other shoes, you will not be able to understand how things are coming on to you. So when I went into this particular forum I came to understand and by collecting all such information and all that I have summarized like how so the point is that from my point of view, documentation has always been underestimated. Why? Because you know, no one thinks about how efficiently or how does trustworthy or how secure your customer should be or your organizations your experiences so they have no idea about it. So that needs to be little bit on the higher end. And a technical writer should definitely provide his or hers experience and expertise to let people know what exactly a technical writer does. And in my case I think we are the bridge who connects a layman to a technical person in between. So I feel that's what exactly is my job as of now. And I have been doing it pretty well. Why? Because unless and until you know what the context is all about, unless and until you know or you have made your research, you can never explain a person because explaining a person who has no idea about what a technical stuff is and making him understand is what a technical writer comes into picture. So I think good documentation doesn't just explain systems, it enables people, processes and business to perform better. So I think that's what I've done and that's which every technical writer is doing as of now. And I'm really proud of what I'm doing currently right now. So this domain has given me name, fame, I think I'm pretty much good on to it. Fantastic. Abhishek. Great, great. And all I all we can expect from you is more successful projects and please contribute to the community as much as you can in any form and shape as it appears to be to you. And yeah, all the very best for your future projects and you've got the right mindset and great, great way to go. Thanks for listening to today's episode of the Knowledge Based Ninjas podcast. Please head to iTunes Rate and provide honest feedback on the podcast. See you next week.