Driving a culture of security from the top down

CULTIVATING a culture of security begins from the top down, with leadership serving as an example for all employees. Effective cybersecurity requires more than just technology and well-trained IT staff; it requires a culture of security that permeates the entire organization. However, such a culture can only be established and sustained through strong leadership. Without the active involvement of senior management, cybersecurity initiatives can falter, leaving the organization vulnerable to attacks.

Previously, we tackled having a people-centric approach in tackling digital threats as well as building a culture of awareness by empowering employees as your first line of defense. While being aware of how we can help our IT departments and effectively train our employees to be cyber-aware is important, it ultimately falls on our leaders to champion and drive cybersecurity initiatives.

In this final part of this three-part series, let’s address the role an organization’s leadership plays in cybersecurity.

Cybersecurity is a business issue that extends beyond the IT department. When chief executive officers (CEOs), board directors and senior executives take a hands-off approach to cybersecurity and delegate full responsibility to IT, it sends a message that security is not a priority. This can lead to a culture of complacency where employees do not see the importance of adhering to cybersecurity policies.

Common symptoms of a lack of leadership in cybersecurity include:

– Hands-off approach. When senior leaders are not actively involved in cybersecurity, it becomes challenging to drive change and ensure compliance across the organization.

– Demand for exceptions. Employees may frequently request exceptions to cybersecurity policies, and if leaders do the same, it undermines the organization’s security posture.

– Revenue over security. In some cases, employees prioritize client work over cybersecurity compliance, particularly when leadership emphasizes revenue over security.

For cybersecurity to be effective, governance and accountability must be clearly defined and distributed across the organization and not just owned by the IT department. This means setting clear roles and responsibilities for each team, from the executive level down to the individual employee.

Here are some key players in your organization’s cybersecurity governance:

– Executive leadership: Responsible for setting the tone and example for the rest of the organization. Leaders must be actively involved in cybersecurity initiatives and demonstrate their commitment by following the same policies and procedures expected of all employees.

– IT department: Focuses on implementation, compliance, monitoring and innovation in cybersecurity practices. IT is responsible for ensuring that the technical infrastructure is secure and that security policies are operational and enforced.

– Knowledge management: Develops and delivers security awareness programs that are relatable and engaging, ensuring that all employees understand their role in cybersecurity.

– HR/people and culture: Handles the human resources aspect of cybersecurity, including addressing noncompliance and managing disputes.

– Marketing and communications: Creates and disseminates cybersecurity messaging that is clear, engaging and easy to understand, ensuring that cybersecurity remains a top-of-mind issue for all employees.

– Employees: Every individual in the organization has a responsibility to adhere to cybersecurity policies and practices, understanding that their actions can have a significant impact on the company’s security.

Effective leadership in cybersecurity is not just about setting policies; it’s about leading by example. When senior leaders adhere to cybersecurity policies, it reinforces their importance and encourages others to follow suit. Conversely, when leaders bypass security protocols, it sends a message that these rules are flexible and can be ignored.

For instance, if a CEO insists on using unsecured personal devices for work purposes, it becomes challenging to enforce a bring-your-own device policy across the company. Leaders must recognize that their actions set the standard for the entire organization.

Leadership must be actively involved in every aspect of cybersecurity, from governance to employee training and incident response. By taking a proactive approach and making cybersecurity a boardroom priority, leaders can ensure that their organization is well-prepared to face current and emerging threats.

In any industry, especially those that store and process data, leadership involvement is crucial to ensuring a robust cybersecurity framework. Consider outsourcing for cybersecurity experts to assist your leadership team in developing and implementing a comprehensive cybersecurity strategy based on industry standards and framework that aligns with your business goals and helps safeguard your organization’s data and reputation.

As we conclude this series, remember that cybersecurity may be an IT initiative on the surface, but the core principles for success rely more on people: the capacity to have cyber-compliance done continuously; the awareness to do what is right; and the drive to keep compliance on track. It’s time to start building a people-focused cybersecurity strategy that protects your data and your business.

Leonard Duque is the director and chief information officer for the Technology Solutions Group at P&A Grant Thornton. One of the leading audit, tax, advisory and outsourcing firms in the Philippines, P&A Grant Thornton is composed of 29 partners and 1,500 staff members. We’d like to hear from you! Connect with us on LinkedIn, like us on Facebook at P&A Grant Thornton and email your comments to [email protected]. For more information, visit our website at www.grantthornton.com.ph.