Creating a security culture
Everyone in the organisation contributes to its security culture. Organisational culture has a direct impact on security. Even with the best security processes and tools your organisation will still be at risk if people have a poor attitude toward security.
The following steps will help to create a positive and sustainable security culture and reduce the personnel security risks facing your organisation.
Get commitment from the top
The chief executive and senior team must be committed to effective security practices and procedures. They also need to model best practice throughout the organisation.
Build security awareness
People are much more likely to engage in your security culture if they understand the credible security risks that face your organisation. Increased awareness will help people understand that they have important security responsibilities and know what those responsibilities are.
Publish clear communications about security
Everyone needs access to clear policies and procedures that:
- explain the reasons for your organisation’s security instructions
- outline legal, regulatory and compliance requirements
- ensure people understand their responsibilities.
Support staff wellbeing
Provide people with access to support, such as a confidential employee assistance programme. Encourage them to report and deal with personal issues before they become a serious problem.
Manage concerning behaviour
Managers need tools and policies to identify, support, and manage people who display concerning behaviour to do with security, poor performance, or unacceptable conduct.
Avoid a blame culture
People who raise legitimate security concerns should be encouraged and seen as good corporate citizens rather than troublemakers.
Reporting emerging concerns or near misses should be treated as a way of helping colleagues who might be at risk, rather than getting them into trouble.
Page last modified: 2/10/2018