SCRisk domain
Security culture
Security culture covers the health of the relationship between people and the security team: confidence measured against results, perceived friction, sentiment toward security, voluntary learning, retained knowledge, ambassadors and whether people ask security for help before they build. The domain is measured by pulse survey and by help-seeking behavior, and it excludes completion rates. Culture is scored as its own outcome because it decides whether every other domain improves.
Classification
- Dimensions Every signal answers one of 3 questions.
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- GV.RR-02
- GV.OC-02
- PR.AT-02
- GV.RM-07
- MITRE ATT&CK
-
- Cross-cutting: culture decides whether reporting and help-seeking happen in every tactic
Culture decides whether reporting and help-seeking happen in every other domain, which makes it the multiplier on every intervention. ENISA defines security culture as the knowledge, beliefs, attitudes and norms that show up in people's behavior with technology, and NIST CSF 2.0 GV.RR-01 makes leadership accountable for a risk-aware culture.
Three dimensions in security culture.
- Threat0 signals
- Threat is cross-cutting here: the domain defines no threat signal, because culture shapes how a person responds to the threats that arrive through every other domain.
- Access0 signals
- Access is cross-cutting here as well: the domain defines no access signal, and an ambassador or a frequent help-seeker can hold any level of privilege.
- Behavior9 signals
- Behavior is the measurable side of culture: overconfidence and reported friction on the risky side; voluntary training, retained knowledge, event participation, pulse responses, asking security for help before a project, serving as an ambassador and rating the security team positively on the vigilant side.
Signals
9 signalsScroll sideways to see every column.
| ID | Signal | Dimension | Polarity | Source |
|---|---|---|---|---|
| SC-B-01 | Overconfident: self-rated ability exceeds results | Behavior | Risky | SURVEY |
| SC-B-02 | Takes voluntary training | Behavior | Vigilant | SAT |
| SC-B-03 | Retains knowledge over time | Behavior | Vigilant | SAT |
| SC-B-04 | Joins awareness events and exercises | Behavior | Vigilant | SAT |
| SC-B-05 | Responds to the culture pulse | Behavior | Vigilant | SURVEY |
| SC-B-06 | Asks security for help before a project | Behavior | Vigilant | HELP |
| SC-B-07 | Serves as a security ambassador | Behavior | Vigilant | SAT |
| SC-B-08 | Rates the security team positively in the pulse | Behavior | Vigilant | SURVEY |
| SC-B-09 | Reports friction with security controls | Behavior | Risky | SURVEY |
Headline metrics and grade bands
5 metricsA to F bands for the numbers a program reports in this domain. Bands marked "framework benchmark" are authored targets until the HRM Benchmark publishes measured values.
Scroll sideways to see every band.
| Metric | Unit | A | B | C | D | Anchor |
|---|---|---|---|---|---|---|
| M-SC-1Culture pulse participation | % of workforce responding | ≥ 70 | ≥ 50 | ≥ 30 | ≥ 15 | Gartner security behavior and culture dashboard |
| M-SC-2Security NPS | net promoter score for the security team | ≥ 40 | ≥ 20 | ≥ 0 | ≥ -20 | Gartner |
| M-SC-3Perceived friction rate | % who say security controls get in the way of their work | ≤ 10 | ≤ 20 | ≤ 35 | ≤ 50 | Gartner; Forrester HRM metrics |
| M-SC-4Confidence-ability gap | points between self-rated ability and measured results | ≤ 5 | ≤ 10 | ≤ 20 | ≤ 30 | Forrester HRM metrics |
| M-SC-5Help-before-you-build requests | business requests to security per 100 people per quarter | ≥ 8 | ≥ 5 | ≥ 3 | ≥ 1 | Gartner business engagement requests |
Indicator library
12 indicators- I.0084Engages with optional trainings
- I.0086Completes collaborative trainings
- I.0087Completes collaborative trainings on time
- I.0088Fails to complete collaborative trainings
- I.0090Reports high confidence in security self assessments
- I.0091Reports low confidence in security self assessments
- I.0094Reports high confidence in organizational security readiness
- I.0095Reports low confidence in organizational security readiness
- I.0096Completes training consistently over multiple assigned trainings
- I.0098Reports increased confidence in security self assessments
- I.0177Regularly accesses security awareness resources
- I.0436Participates in cybersecurity culture initiatives
Cohorts in this domain
1"Security culture" (SC), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/domains/security-culture
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.