I’ve had so much success building security cultures and excitedly bring my full roadmap - a framework I've previously offered as a paid program maturity audit, to you for free.
This comprehensive list of security culture controls can help reduce risky behaviors among staff, leading to fewer security incidents, less potential brand damage, and an improved security focused operational culture.
Apply this roadmap to enhance your program, and if you need assistance in implementing these controls or advancing your security culture efforts, reach out for consulting support.
Find the key below the database for more.
https://cdn.ivoryware.com/CyberBrian/SecurityCultureMaturityRoadmapDemo.mp4
Chief Information Security Officers (CISO) May use this resource as a governance expectation and roadmap.
Security Awareness Managers May use this resource to better understand where to focus team efforts towards modernization and innovation.
Managed Security Service Providers May leverage this resource to evaluate their clients' security culture maturity and offer a tailored roadmap for improvement as a value-added service.
👉 Make a contribution to the Roadmap!
If you have something substantial to add to the roadmap, whether that is something new or simply to elaborate on an existing control, contact me and lets talk about it. If it gets added you’ll be noted in the control as a noteworthy contributor!
👉 Need some help? Contact me!
Email: [email protected] | LinkedIn: Brian Miller | LinkedIn
👉 Donate a coffee!
Building a strong security culture usually starts small and grows over time. It often begins as a basic awareness program before developing into something more comprehensive. Companies that try to rush into a full-scale security approach across the entire organization often fall short of their goals. Real change in an organization follows a natural progression: it starts with putting essential basics in place, then moves to creating a culture of accountability, and finally can grow into an environment where employees actively champion security on their own.
Basic Security Awareness Staffing Requirements: 0-2 FTEs | Executive Support: Low This program usually needs only 0-2 dedicated employees, depending on your organization's size and complexity. Often, one security manager can handle these controls part-time. The controls aren't labor-intensive and don't require specialized technical skills, so extra staff isn't typically needed. Most controls can be put in place with minimal direct involvement or sponsorship from executives.
Behavior Changing Program Staffing Requirements: 1-2 FTEs | Executive Support: High This program typically needs 1-2 dedicated employees, depending on your organization's size and complexity. The controls often demand consistent project management, custom design, and specialized knowledge. Many require executive approval and continued support. Buy-in from top management is necessary for the program's success.
Staff Security Culture Program Staffing Requirements: 2-5 FTEs | Executive Support: Required This program typically needs 2-4 dedicated employees, depending on your organization's size and complexity. The controls require consistent project management, custom design, and specialized knowledge. Additionally, many of these controls are labor and time intensive and best implemented with specialized experience. Executive approval and continued support is required for authentic results and to continuously evaluate operational risk appetite.
Comprehensive Security Culture Program Staffing Requirements: 3-? FTEs | Executive Support: Required This program typically needs at least 3 dedicated employees, depending on your organization's size and complexity, and can be vast when security is truly embedded into every layer of the enterprise. The controls require consistent project management, custom design, and specialized knowledge. Additionally, many of these controls are labor and time intensive and best implemented with specialized experience. Executive approval and continued support is required for authentic results and to continuously evaluate operational risk appetite.
To make the most of this resource, copy this Notion page into your own account. You'll then be able to use the Evaluation column to assess your current program. This will help you identify areas for improvement and prioritize your future efforts and innovation.
Excellent Above compliance requirement if any and is well above expectation.
Satisfactory Fulfills compliance expectations if any and is well executed.
Unsatisfactory Poor or lacking execution but existence and effort is apparent.
Not Present No evidence or effort to execute visible.
Don't build your program based solely on priority. It's better to develop your efforts according to maturity phase first, then consider priority within. Some critical programs might seem urgent, but they can be nearly impossible to implement well without the right foundations, enough staff, and support from leadership.
These elements are the building blocks of your security culture - the 'what we do' to create and maintain it. To learn more about each control, hover over its text in the database and click the “Open” button. This will reveal a detailed description and additional information.