Practice 06 of 6Scored 1 to 53 questions in the assessment
Culture
Do people report, ask for help, and tell you the truth about friction?
Culture is the practice of measuring and shaping how people relate to security: whether they report, whether they ask before they build, how much friction they feel, how confident they are against how they perform, and whether leaders model the behaviors.
Why it matters
Culture, in practice.
Controls and campaigns run through people. Where reporting is normal, the SOC hears about the real phish in minutes; where friction is high, people route around controls and the signals go dark. Culture measures tell the program when its actions cost more trust than they earn.
Risk domains it touches
The five levels
The five levels of Culture.
Each level with its criteria, the evidence to ask for and what moves the practice to the next one.
-
Level 1
Comply
Culture unmeasured; attendance is the only engagement number.
- Culture is unmeasured; event attendance is the only engagement number.
- Reports of suspicious activity are rare and uncounted.
- There is no channel to ask security for help before building something.
- Friction complaints reach security by chance.
Evidence to ask for
The engagement numbers in the last report · The intake channel, where one exists
What moves you to level 2
- Count reports of suspicious activity each month.
- Open a help channel and log requests.
- Run a three-question pulse on NPS, friction and confidence.
-
Level 2
Observe
An annual survey; reports counted; a help channel; recognition for reporters.
- An annual survey measures attitudes to security.
- Reports of suspicious activity are counted per month, and the report rate is below the click rate.
- A help channel exists and each request is logged.
- People who report are recognized.
Evidence to ask for
The last survey results · The monthly report count · The help channel log
What moves you to level 3
- Run a quarterly pulse on security NPS, perceived friction and confidence with a participation target.
- Name a security champion in each business unit.
- Set the target: report rate above click rate.
-
Level 3
Prioritize
Quarterly pulse; champions in each unit; report rate above click rate; help requests counted.
- A quarterly pulse measures security NPS, perceived friction and confidence, with a participation target.
- Report rate exceeds click rate across the workforce.
- Each business unit has a named security champion with a monthly brief.
- Requests to security before a team builds something are counted per quarter.
Evidence to ask for
The pulse results by team · The champion roster · The request count by quarter
What moves you to level 4
- Join pulse results to behavior results per team.
- Measure the gap between self-rated ability and simulation results.
- Co-create the next policy with employee feedback.
- Publish role-based AI guidance for developers, finance and customer-facing teams.
-
Level 4
Orchestrate
Sentiment joined to behavior per team; policies co-created; AI guidance by role.
- Pulse results are joined to behavior results per team, so teams with high friction and low reporting are visible.
- Policies are co-created with employee feedback, and the count is tracked.
- Role-based guidance for AI use exists for developers, finance and customer-facing teams, with output checking measured in the pulse.
- Targeted people report real phishing inside the time target the program set.
Evidence to ask for
The friction-by-team view next to reporting · The co-created policy list · The role-based AI guidance pages · Median time to first report of real phishing
What moves you to level 5
- Add security NPS, friction and time to report as board KRIs with thresholds.
- Report executives their own security behaviors each quarter.
- Measure AI agent owners on agent hygiene like any other behavior.
-
Level 5
Preempt
Culture KRIs inside appetite; executives measured; agent owners accountable.
- Security NPS, perceived friction and time to report are board KRIs with thresholds.
- Each executive sees their own MFA, reporting and simulation results each quarter.
- The gap between self-rated ability and results sits inside the target the program set.
- People who own AI agents are measured on agent hygiene (owner current, scopes reviewed, logging on) like any other behavior.
Evidence to ask for
The board pack culture KRIs · The executive behavior report · The agent-owner scorecard
How to hold level 5
- Keep the pulse questions unchanged so trends stay comparable, and review the wording every two years.
- Rotate champions and re-brief them each year.
Playbooks
Playbooks for Culture (11).
The assessment picks from these for your 90-day roadmap, by your current level. Each playbook is Easy, Medium or Hard; a quick win is an Easy playbook.
Scroll sideways to see every column.
| From level | Playbook | Owner | Weeks | Difficulty | Measure |
|---|---|---|---|---|---|
| 1 | Count reports of suspicious activity each month Count every report from the button, the help desk and email, and publish the number. What gets counted gets noticed. | Security awareness lead | 1–2 | Easy | Reports per 100 people per month |
| 1 | Open a help-before-you-build channel Give people one place to ask security a question and log each request. Requests are the first culture signal a program can count. | Security awareness lead | 5–8 | Medium | Requests to security per 100 people per quarter |
| 2 | Run a three-question culture pulse Ask security NPS, perceived friction and confidence each quarter. Three questions get answered every quarter. | Security awareness lead | 1–4 | Easy | Pulse participation |
| 2 | Stand up security champions in each business unit Name a champion per unit, give them a monthly brief and a channel to security. Champions carry the program where email cannot. | Security awareness lead | 5–10 | Medium | Business units with an active champion |
| 2 | Recognize people who report real phishing Thank reporters the same day and name the top reporting teams each month. Recognition raises the report rate faster than reminders do. | Security awareness lead | 5–8 | Medium | Report rate above click rate |
| 3 | Measure the confidence-ability gap Compare self-rated ability from the pulse with simulation results per team. Overconfident teams are the coaching target. | Security awareness lead | 1–3 | Easy | Confidence-ability gap in points |
| 3 | Join pulse results to behavior per team Put friction and NPS next to reporting and click rates for each team. Teams with high friction and low reporting are where culture work goes first. | Security awareness lead | 5–9 | Medium | Teams with high friction and low reporting |
| 4 | Publish role-based AI guidance for three teams Write one page each for developers, finance and customer-facing teams on which AI use is sanctioned and how to check an output. Role guidance gets read; a generic policy gets filed. | Security awareness lead | 1–4 | Easy | Share who check AI output before use |
| 4 | Co-create the next policy with employee feedback Draft the policy with champions, run it past the teams it affects and record the changes. People follow policies they helped shape. | GRC lead | 5–10 | Medium | Policies co-created with feedback |
| 5 | Report executives their own security behaviors Show each executive their MFA, reporting and simulation results each quarter. Leaders change what they can see. | CISO | 1–4 | Easy | Executives above target on their own behaviors |
| 5 | Report culture KRIs to the board inside appetite Add security NPS, perceived friction and time to report as board KRIs with thresholds. Culture becomes a risk measure the board reviews. | CISO | 5–9 | Medium | Culture KRIs inside their thresholds |
"Culture: the practice", Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/maturity-model/culture
HRM Maturity Assessment
Where does your program stand?
An initial assessment: 18 questions, about 4 minutes. Your level, six practice scores and a 90-day roadmap, shown immediately.
- Questions
- 18
- Minutes, about
- 4