Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Organisational Culture and Tone at the Top
Culture beats policy
Every organisation has two sets of rules: the written ones in policies, and the unwritten ones that people pick up by watching each other. That second set is the organisational culture: shared values, beliefs and habits. It decides what people actually do when nobody is checking.
A security program that ignores culture ends up with policies that everyone signs and nobody follows. A program that works with the culture, and slowly shifts it, gets controls that people actually use.
Example. A firm’s policy bans sharing passwords. But managers routinely ask assistants to log in as them to approve invoices, and nobody objects. The real rule, set by leaders’ behaviour, is that sharing is fine.
Where is the organisation today?
The security manager should understand the current culture before designing the strategy. Useful signals include:
- how often controls are bypassed or exceptions requested
- whether people report incidents and near misses, or hide them
- how security is talked about in leadership meetings
- staff surveys and interviews
- what happens to people who break rules, and to those who report problems
Tone at the top
Staff copy what leaders do, not what they say. When executives skip MFA, demand exemptions or ignore audit findings, everyone learns that security is optional. When leaders follow the rules visibly, ask about risk in meetings and fund the program, security becomes part of normal business.
This is why CISM keeps returning to senior management commitment as the most important success factor for any security program, culture initiative or policy.
Fit the strategy to the culture
There’s no single right culture, and the strategy has to fit the one that exists:
| Culture | What works | Watch out for |
|---|---|---|
| Risk-averse (bank, hospital) | Formal controls, approvals, documented procedures | Slow, bureaucratic security that the business resents |
| Risk-tolerant (start-up, fast-moving tech) | Security built into tools, automation, pipelines | Rules seen as blockers get bypassed |
| Decentralised | Champions in each unit, shared standards | Inconsistent controls across units |
| Command-driven | A strong executive sponsor | Program stalls if the sponsor leaves |
The organisation’s risk appetite is a direct expression of its culture, so the strategy must be built around it.
Levers that change culture
- Tone at the top: leaders follow the rules visibly and talk about security as a business issue.
- Built into processes: security steps sit inside normal workflows (procurement, hiring, project approval), so the secure way is the easy way.
- Awareness and training: relevant, frequent and tailored to roles.
- No-blame reporting: people who report mistakes or suspicious activity are thanked, not punished.
- Champions network: volunteers in each business unit who promote security locally.
- Incentives and consequences: security objectives in performance reviews, recognition for good behaviour, and fair, consistent consequences for deliberate violations.
Measure progress by behaviour: incident and phishing reporting rates, numbers of exceptions, repeat findings and survey results. Training completion alone says little about culture.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Most important factor for a strong security culture | Senior management commitment, visibly shown |
| Staff routinely bypass a control | Find out why; the control may not fit the process or culture |
| Best way to embed security in the organisation | Integrate it into business processes |
| The security strategy must reflect… | The organisation’s culture and risk appetite |
| Best measure of culture change | Behaviour: reporting, exceptions, incidents |
In short
- Organisational culture is the shared values and habits that decide how people actually behave, whatever the policy says.
- Tone at the top, the visible behaviour of senior leaders, is the strongest single influence on security culture.
- A security strategy must fit the organisation's culture and risk appetite; one that fights the culture will be worked around.
- A healthy security culture rewards reporting mistakes early instead of punishing them.
- Culture changes through many levers: leadership, processes, training, champions, incentives and fair consequences.
- Measure culture with behaviour (reporting rates, policy exceptions, surveys), not just training completion.
Exam traps
- The security manager can't create culture alone; senior management commitment is the key factor.
- More rules don't fix a weak culture; they usually create more workarounds.
- A risk-averse bank and a fast-moving start-up need different strategies; 'best practice' isn't one size fits all.
- Punishing people who report incidents drives problems underground.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Where is the organisation today?
Levers that change culture