Security Awareness to Measurable Security Outcomes

The security culture programme that this publication has built through its preceding sections represents the most comprehensive investment in the human dimension of information security that the organisation can make. Its design reflects the behavioural science, the psychological understanding, the cultural development disciplines, and the programme architecture that the evidence base supports as most likely to produce the genuine and sustained behaviour change that the security challenge demands. This section addresses the governance question that the programme’s completion must ultimately answer: how does the ISO demonstrate to the board, to executive management, and to the regulatory and stakeholder audiences whose confidence the programme must maintain that the investment is producing the tangible security behaviour improvements that the investment’s justification requires?

The transition from measuring security awareness to measuring security behaviour is the most significant governance maturity shift that the security culture programme must achieve, and it is the shift that most directly determines whether the programme maintains the executive and board support that its continued resource allocation requires. The awareness measurement that records training completion rates and knowledge quiz scores provides the evidence that the programme is operating and that the workforce has been exposed to security content. It does not provide the evidence that the programme is producing the security behaviours whose consistent practice reduces the human-factor incident rate that the security challenge’s actual consequence dimension reflects. The board that asks how well the organisation is securing the human element and receives the answer that ninety-three percent of employees have completed this year’s security awareness training has received the activity evidence without the outcome evidence that the question requires.

The Governance Landscape Demanding Behavioural Evidence #

Several converging forces in the current governance environment are creating the specific pressure for the behavioural evidence that moves the security culture programme’s measurement beyond the activity metrics that the compliance-oriented approach has historically provided.