Building a culture of cybersecurity

The CEO needs to lead in promoting a culture that reinforces the idea that cybersecurity is an organizational capability rather than just a problem for IT to solve.

A strong cybersecurity culture drives the members of the organization to behave in unison when faced with security challenges. An established, well-thought-out cybersecurity plan approved by the board of directors is only helpful if every staff member understands their role and responsibilities before, during, and after an event, appreciates the significance of cyber threats, complies with security measures and guidelines, and understands what it means to remain cyber-vigilant.

A cybersecurity plan needs to be approached holistically to be successful. Every part of the organization must understand that processes and technology play a critical role in developing and maintaining a robust cybersecurity culture. Cyber risk must be taken as seriously as risks such as natural disasters...