Shared values and behaviours that make security a natural part of how an organisation operates.
Security culture describes the shared attitudes, values, and behaviours regarding security throughout an organisation. Strong security culture means employees naturally consider security in their work, report concerns, and support security initiatives. Culture goes beyond awareness training—it's embedded in how people think and act. Building security culture requires visible leadership commitment, positive reinforcement, and making security part of organisational identity rather than an obstacle.
Why It Matters
The DSC Perspective:
Culture determines whether security policies are followed in practice. Strong security culture means people do the right thing even when no one is watching. Invest in culture alongside technical controls.