One of the most consequential and frequently underestimated decisions an organisation makes in developing its information security strategy is how seriously it treats the human dimension of security risk. Technical controls, governance frameworks, and policy hierarchies are essential components of a mature security programme, but their effectiveness is ultimately determined by the behaviour of the people who operate within them. An organisation whose workforce does not understand, value, or engage with its security requirements is structurally vulnerable regardless of the sophistication of its technical architecture, and no investment in technology or process can fully compensate for a culture in which security is perceived as an imposition rather than a shared responsibility.
Security awareness and culture must therefore be treated as integral strategic priorities during the development of the information security strategy, not as supporting activities to be addressed after the programme’s technical and governance dimensions have been defined. The failure of information security initiatives is consistently and disproportionately attributed to inadequate awareness and cultural engagement rather than to deficiencies in technical control design. When security measures are experienced by employees as obstacles to productive work rather than as protections that serve both the organisation and the individual, resistance and circumvention follow. That resistance is rarely the product of malicious intent; it is the predictable consequence of a strategy that has not adequately invested in helping the workforce understand why security matters, how it benefits them personally, and what their specific role in maintaining it requires.
Why Culture Must Inform Strategy from the Outset #
The most effective security strategies treat cultural development not as a communication exercise that follows strategic decisions but as a design consideration that shapes them. Security strategies developed without reference to the organisation’s existing culture, the workforce’s current awareness levels, and the specific human behaviours most likely to introduce or amplify risk, consistently produce programmes that are technically coherent but operationally fragile. The following considerations illustrate why cultural thinking must be present at the strategy development stage rather than appended to it.
Reducing Human Error #
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
