I recently attended a two-day workshop on how to build effective cyber security awareness programmes. It brought together an array of similarities: a classroom of cyber security professionals all fervently sharing their stories and illustrations, much like the ‘show and tell’ sessions from my nursery days. It quickly became apparent that, for the majority of professionals in the room, they severely lacked senior management support for their awareness campaigns. Whilst some lacked support from their execs getting personally involved in their campaign, others were faced with a far more difficult problem, in that their senior leaders were blocking the execution of the campaign entirely. I was shocked. We see a new data breach case almost every day and countless headlines of organisations paying hundreds of thousands in monetary fines, masses of sensitive and personal data being lost or sold. Surely this in itself would be enough to not only facilitate an awareness programme, but to encourage one?
If in a room of 27 professionals 90% of these were suffering this board level barricade, to what extent does this ring true in the real world? It got me thinking about why is this buy-in so essential? Why should we exert so much effort into getting executive buy in, even for the cases whereby the lack of support is not directly preventing the campaign? The easiest way I can explain it is to liken it to trying to assemble one of those colossal 3-door wardrobes with no instructions: a complete nightmare! It’s complicated, frustrating, will probably cause you a great deal of anxiety, take you twice as long to build, and you’re bound to put something together wrong. As a result, you’re left with no wardrobe, an abundance of Allen Keys (they always seem to be lurking around), and quite frankly, feeling irritated that you are now going to have to start it all over again, however this time doing it properly.
Well the same goes for an awareness campaign without senior leadership buy-in. Empowering and motivating your employees is noticeably more difficult without the support from your leadership. Plus, they usually bring about critical finances which, let’s face it, are always welcome.
So while it may take some innovative thinking on your behalf, it is an effort that is worthwhile. Gaining senior leadership support will really improve your chances of changing corporate culture. You might have to train them first in order to make them aware of the importance of the awareness campaign. Do this and the rest will follow.