As a Security Risk Management Services (SRMS) provider, we understand that most security programs will be underleveraged or undervalued if there is not an assessment of the organization’s culture.
The bottom line: Culture is another way of saying “This is how we do things around here.” In most cases, what is written down or hung on the wall does not align with “how we do things around here.” People will perform their roles, work within their processes and utilize technology to get things done; but the values that undergird their behavior and the ability to understand them and leverage them is one of the keys to unlocking the value of security.