The philosophical foundations and psychological understanding that the preceding section established create the conceptual basis for the human-centric security approach. This section addresses the practical governance disciplines through which the ISO operationalises that philosophy, translating the understanding of human vulnerability into the specific programme actions, design changes, and environmental improvements that reduce human-factor security risk in the operational conditions that the organisation’s workforce actually experiences.
Human-centric security implementation requires the ISO to govern across three distinct but interdependent domains simultaneously. The security culture domain addresses the human beliefs, attitudes, and behaviours that determine how the workforce approaches security decisions. The security design domain addresses the controls, technologies, and processes whose usability either supports or undermines the secure behaviour that the culture is attempting to build. And the work environment domain addresses the organisational conditions whose effect on cognitive function, stress levels, and decision quality determines whether the culture and design investments can deliver the security outcomes they are designed to produce. Governing any one of these domains without the other two will consistently produce the partial improvement that addresses one dimension of human vulnerability while leaving the others to continue generating the security errors they create.
Assessing and Enhancing the Security Culture #
The governance starting point for human-centric security implementation is the honest assessment of the current security culture whose accurate diagnosis determines the specific interventions that the programme must prioritise. The ISO must govern this assessment with the rigour and independence that produces actionable intelligence rather than the self-serving evaluation that confirms the programme’s existing direction without the challenge that genuine assessment provides.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
