The Commitment Curve

The security culture transformation challenge that the preceding sections of this publication have addressed requires not only the design of the right programme components but the governance of the human change journey that determines whether those components produce the cultural outcomes they are designed to achieve. Employees do not move from the absence of security awareness to the internalised security values that genuine culture represents in a single step, and the security culture programme that does not account for the staged progression through which commitment develops will consistently deploy the interventions appropriate to later stages on individuals still navigating earlier ones, producing the disengagement that mismatched communication creates when people receive messages they are not yet prepared to act on.

The Commitment Curve, developed by Conner and Patterson, provides the ISO with the change management model that maps this progression, identifying the seven stages through which individuals travel from initial contact with the security culture programme to the full internalisation of security values that the culture’s sustainable endpoint represents. The model’s governance value lies not in its theoretical description of how change happens but in the practical implication that each stage requires a different ISO action, a different communication approach, and a different success measure, and that the programme’s effectiveness depends on the ISO’s ability to assess where the workforce population sits on the curve and to deploy the right intervention for each stage rather than the uniform programme that serves the compliance requirement without the stage sensitivity that genuine commitment development demands.

Stage One: Contact #

The contact stage is the point at which employees first encounter the security culture programme through the initial communications that introduce its existence without yet conveying its significance, purpose, or relevance to the individual’s specific role. At this stage the employee has minimal understanding of what the programme is or why it matters, and the psychological state is one of neutral curiosity at best, indifference at worst.