SeCuRE 4: Assessing Security Culture
Getting security culture right is a vital aspect of an organisation’s protective security regime. There are a number of reasons why organisations might need to assess their security culture; to see what is going well and where improvements could be made, to direct and shape future initiatives or understand the source of problems they are already aware of. To support national infrastructure organisations in doing this, CPNI has created the SeCuRE 4 security culture assessment tool.
SeCuRE 4 is a suite of self-assessment survey tools developed by CPNI over years of research and development, conducted in collaboration with our academic partners to ensure a theoretically driven approach to assessing security culture. Secure 4 has been designed to provide new capability for assessing different aspects of security culture. The outputs from the surveys can now be used to:
- Shed light on current and desired strategic approaches to security present in your organisation
- Measure employees’ perceptions of how well security is working, and highlight where improvements in security culture are required
- Assess employees understanding of the relevant threats, their security responsibilities and their motivations to be security conscious
- Understand how frequently employees are performing specific security behaviours and what might encourage them to do them more often
TIP: SeCuRE 4 is designed to help organisations in the UK critical national infrastructure direct and shape their security culture, but this is best done once you are clear on what the key security risks are that currently face your organisation. Without an understanding of risk, it is challenging to develop a culture that is truly fit for purpose.
More information on SeCuRE 4
To learn more about SeCuRE, first refer to the Introductory Guide available to download in the guidance section below. The guide is designed to give an overview of what each of the four surveys does, and will help you to understand how SeCuRE 4 can be useful for your organisation and how to get further information.