Your initiative to protect your organization begins with defining your policies in a document, but you also need your employees to learn and retain your recommendations. Focus on building your culture to increase the effectiveness of your security program.

While not everyone may be as passionate about information security as you are, there is a common mission most employees share: protecting the organization. An economical and effective way to reduce a huge amount of your organization’s risk is to promote your security policies as part of your organization’s culture.

Security culture is built through the behaviors of your organization’s employees.

Culture is a set of beliefs. Policies define the culture’s beliefs and lay out a structure to keep those beliefs alive.

Security culture is a set of beliefs that employees honor to support the protection of an organization. Security policy is a guide for employees to use as they make decisions for the company in their everyday work.

Emphasize building an informed security culture at your organization to efficiently reduce its long-term risk.

Incorporate security culture into your organization’s overall identity.

Cultural identity is a strong force. Having pride in a culture is a strong motivator. Think about the behaviors that you want the employees to have, then weave them into your organization’s cultural identity.

Make beneficial behaviors a point of pride at your organization.

A powerful way to create pride and a feeling of membership in your organization is to give people a set of ideals and a way to live up to them. A virtuous cycle is created when you weave the behaviors you desire into the stories that make up your organization’s cultural identity.

How you choose your stories and heroes as management reinforces that culture, that cultural identity that allows employees to feel proud for having lived up to those ideals. Share examples that exemplify the behaviors you’d like people to follow.

An informed security culture is beneficial to your organization.

Distributing the responsibility of protecting your organization effectively reduces risk.

Your employees present information security risks to your organization. Their job duties require them to make decisions about who and what is interacting with your organization’s systems.

Proactively provide your employees with clear security policies and training that shows them how to make decisions that keep the organization safe as they work.

Providing clear policy and training is economical and efficient.

The value saved by your employees’ smart security decisions adds up in value over time as your organization avoids threats that otherwise may have impacted its financial, operational, and reputational standings.

Not having to pay to mitigate these impacts likely means more open resources available for investing in your security program. Woo!

Find the synergy between policy and culture.

You’ll notice your security culture is working for you when employees start to naturally participate in the process and help others learn about it. Here are some real-life examples of an effective security culture:

• An organization has a security policy in place that requires employees to report any suspicious emails they When a spear phisher begins emailing employees impersonating c-suite leaders, the employees go beyond just reporting it to IT. They also spread the word of the attack throughout the organization by making a game of posting suspicious emails in the organization’s chat.
• The security team gets a help desk ticket in the middle of the night from an employee who had their laptop stolen. The employee understands the risk that the theft poses to the organization after reading your security policy. The issue is reported immediately with a request for the laptop to be wiped to protect the
• A new employee is looking for more information on security expectations at the Instead of shrugging the question off, teammates can provide answers and share the right documents and information.

Culture brings your security policy to life.

Keep your employees updated and engaged on changes to outside threats and the structure of your policies as they evolve. When your security policy is interesting and applicable to employees in their day-to-day life, it unlocks their curiosity about the part of the organization they represent. It’s this curiosity that opens the discussions needed to support and grow an informed security culture.