Creating the right organisational culture for cyber security

People are vital to cyber security. Every day they make decisions that impact cyber, from reporting a phishing email to choosing strong passwords to ensuring their software is up to date. NCSC research has shown that people’s ability to support security is closely linked to the health of their organisation’s culture around cyber. 

Creating this culture is not a one-off exercise and doesn’t happen quickly, but needs focused and sustained effort from the following key roles across the organisation:

Cyber security professionals

Cyber security professionals have a central role to play in transforming the organisation’s security culture. Reflect on the following questions to assess your current approach and identify areas for improvement:

• Does the way you work help create a healthy cyber security culture? 
• Do people in your organisation feel you are there to support them? 
• Do they trust you to help when things go wrong? 
• Do you consider cyber security as a business enabler? 
  • If yes, how is this reflected in your language and behaviour towards people?

Although we’re still learning how to systemically transform cyber security culture, there are some immediate steps you can take to support these changes. There are 2 excellent resources to help you get started:

• The Government Security Guidance on Improving security culture.
• The National Protective Security Authority's (NPSA)  Security Culture Tool

Innovators and culture specialists

The cyber security profession’s appreciation of how to approach culture is still developing. And that's where we need innovators and culture specialists. We want you to use these principles to help fill the gaps in the cyber security profession's capabilities and reflect on the following questions:

• How can we bring into the profession the expertise to assess and change culture?
• How can we go beyond our focus on the visible cyber security behaviours towards identifying the more fundamental factors and addressing them?
• What tools or services can help bring this approach to every organisation, without accidentally creating more problems than we are solving?

Leaders in organisations

Leaders have a key role to play in building and sustaining culture both through their own behaviours, and what they choose to acknowledge and reward. 

You may already be involved in other culture change initiatives in your organisation – and these principles are consistent with the latest research on cultures that support high performance, safety, inclusion and employee retention. As leaders, reflect on the following questions to assess your level of participation:

• How can you ensure cyber security is part of the wider culture change effort? 
• How can you use your influence to shape culture?

Collaborate for a secure future

We invite cyber professionals, leaders and culture specialists to take a collaborative approach to drive progress in this area. By working together to apply the principles and focusing effort on addressing the cultural aspects, you will positively enhance the UK’s cyber security, helping to make ours the safest place to live and work online.

Kate R
Sociotechnical Lead