The security culture programme whose phased design the preceding section established requires more than governance rigour and programme management discipline to achieve the workforce engagement that cultural transformation demands. It requires the marketing intelligence that understands how human attention, motivation, and behaviour change are most effectively influenced through the communication and campaign strategies that the marketing discipline has developed through sustained empirical learning about what actually causes people to think and behave differently. The ISO who designs the world’s most technically sophisticated security awareness programme and then communicates it through the information security function’s conventional channels without the marketing discipline that reaches and engages the workforce population will consistently under-deliver against the programme’s potential, not because the content is inadequate but because the communication that would make it accessible, relevant, and motivating has not been applied with the sophistication the workforce engagement challenge demands.
The application of marketing principles to the security culture programme is not the trivialisation of a serious governance discipline. It is the recognition that the security programme is fundamentally a behaviour change programme whose success depends on the same human engagement dynamics that marketing has developed the most sophisticated understanding of, and that the governance programme whose communication ignores this understanding will be less effective than its content quality warrants.
Understanding the Security Culture Programme as a Product #
The marketing orientation requires the ISO to govern the security culture programme from the audience’s perspective rather than the programme’s own perspective, asking not what the programme needs to communicate but what the audience needs to receive to engage with the programme’s content and act on its messages. This perspective shift is the foundational reorientation that the marketing discipline demands and that the compliance training model consistently resists, because the compliance model’s primary question is what the regulation requires to be communicated rather than what the audience requires to be genuinely influenced.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
