To manage the information security culture, five steps should be taken: pre-evaluation, strategic planning, operative planning, implementation, and post-evaluation.
- Pre-evaluation: To identify the awareness of information security within employees and to analyze the current security policies.
- Strategic planning: To come up with a better awareness program, clear targets need to be set. Assembling a team of skilled professionals is helpful to achieve it.
- Operative planning: A good security culture can be established based on internal communication, management buy-in, security awareness and a training program.
- Implementation: Four stages should be used to implement the information security culture.
- Commitment from the management
- Communication within organizational members
- Training for all organizational members
- Commitment from the employees
- Post-evaluation: To assess the success of the planning and implementation, and to identify unresolved areas of concern.
