The preceding sections of this publication have addressed the design of the security awareness programme, the maturity model that maps the culture’s progression, and the transformation agenda that makes the organisational commitment visible. This section addresses the most challenging governance dimension of security culture development: the gap between what the awareness programme communicates and what the workforce actually does.
Security awareness is necessary but demonstrably insufficient for security culture transformation. The research on human behaviour in security contexts is unambiguous on this point. Employees who can correctly identify phishing emails in awareness assessments click on phishing simulation links at significant rates in operational conditions. Employees who understand password security requirements choose weak and reused passwords when the authentication system does not enforce stronger ones. Employees who have completed data handling training send sensitive information through unsecured channels when the secure alternative creates friction that the insecure one avoids. The gap between knowing and doing is not a knowledge problem that more training can close. It is a behavioural and environmental problem that requires the governance response the ISO must understand and deploy.
Understanding Why Awareness Fails to Drive Behaviour #
The ISO must govern the security culture programme with an honest understanding of the psychological and organisational factors that prevent awareness from translating into sustained behaviour change, because a programme designed without this understanding will consistently invest in the communications and training that fail to address the actual barriers to the security behaviours it requires.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
