The security culture disciplines that the preceding sections of this publication have established provide the conceptual and operational foundation that the security culture programme requires. This section addresses the governance of the programme’s construction and delivery through the phased approach that converts the foundation’s principles into the structured, accountable, and continuously improving programme that the organisation can plan, resource, and execute with the governance clarity that sustained commitment demands.
The failure of security culture programmes is rarely the failure of the concept. It is the failure of the programme design and execution discipline that allows the worthy ambition of security culture transformation to dissolve into the series of disconnected initiatives, unclear objectives, and unmeasured outcomes that the absence of structured programme governance consistently produces. The programme that begins with enthusiastic leadership endorsement and ends in the annual phishing simulation and compliance training completion that the compliance requirement sustains after the transformation ambition has faded is the most common security culture programme outcome in organisations that have not governed the programme’s construction with the rigour that genuine culture change demands.
The phased governance approach provides the structured framework that prevents this failure pattern, creating the programme architecture whose phases build on each other with the logical discipline that ensures each phase’s output provides the foundation that the next phase requires rather than the parallel activity that produces the programme complexity without the developmental coherence that sustained culture transformation needs.
Phase One: Defining Objectives and Boundaries #
The foundational governance discipline of the security culture programme is the clarity of objectives that distinguishes the specific outcomes the programme is designed to achieve from the general aspiration of improved security culture that is universally agreed upon and operationally useless as a programme direction. The ISO must govern Phase One with the rigour that produces the specific, measurable, achievable, and time-bound programme objectives whose clarity enables every subsequent phase’s activities to be evaluated against the standard they must meet.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
