Cybersecurity in the early days of corporate IT was a tech problem. If, say, a system crashed or a password got leaked, the company targeted IT to solve it. Security still belonged to server rooms, firewalls and software patches.
That model is completely busted today.
The corporate perimeter has virtually disappeared — thanks to hybrid work, cloud computing, and increasingly complex AI-powered phishing attacks. Hackers can easily access every worker’s laptop, cellphone and home router.The security in this decentralized environment can no longer be mandated by IT to the company.
The moment has come to move from a culture of cyber compliance towards that of cyber accountability.
What is Cyber Accountability?
According to cyber accountability, every individual in your organization, whether he or she is an intern or the CEO, knows that they are responsible for the safety of your company’s information assets. It moves the issue of security from being something that must be ticked off each year when you go through annual training to something that becomes a part of your everyday life.
In cases where there is a breach, it is never the case where the firewall has let you down. It is always the case that some human factor has been exploited.
The Three Pillars of a Culture of Accountability
Building an accountable workplace requires clear ownership across three distinct tiers of the organization:
1. Executive Leadership: Setting the Tone
It begins with the executives. When they consider cybersecurity as a costly burden, the entire firm will do the same.
- The Role: Executives should approach cybersecurity risk as business risk. It implies having a proper budget allocation, engaging in the incident response drill, and monitoring security performance metrics.
- The IQC Perspective: The executives must set an example for others to follow. If they ignore MFA and access systems based on convenience, they open an enormous security hole for themselves and their organization.
2. IT and Security Teams: Enabling, Not Just Enforcing
The role of IT security teams is changing. They are no longer just the “Department of No.”
- The Role: The security department’s job is to provide the tools, processes, and guidelines that will enable the employees to operate within a secure environment. The security department should always try to justify the rules to the employees rather than blindly enforce them.
- The IQC Perspective: Accountability needs to go hand-in-hand with seamless security. The policies regarding security are supposed to be flexible enough for employees to carry out their jobs; otherwise, employees would end up using workarounds called “Shadow IT.”
- 3. The Modern Employee: The First Line of Defense
Every employee must realize that their digital hygiene directly impacts the company’s survival.
- The Role: They should have control over their entry points by ensuring that they use very strong passwords, check on suspicious emails before clicking on any link provided, and report on any possible mistakes in security without being punished immediately.
How to Foster Cyber Accountability in Your Organization
The process of changing workplace culture is not going to happen overnight. These are some of the ways your organization can start developing an accountability framework:
• Develop a “No Blame” Report Policy: In case one of the employees has clicked on a suspicious link, he/she will be rewarded, and not punished. Fearing being scolded will only cause them to hide it, which will cost you way too much money to fix.
• Security Awareness Training: Do not give general boring slides. Financial employees will have to learn about BEC and Invoice fraud, and HR employees will need to learn how to identify malicious email attachments pretending to be a resume.
• Document Policies: Your employee handbook should contain all the policies concerning how your devices should be used, remote work rules, and what to do in case of loss or theft of any device.
• Incentives and Metrics: Collect statistics on click rates during the phishing simulations and reward departments that manage to achieve 100% completion rate or 0% clicks.
The Cyber Accountability Maturity Model
Creating such a culture takes time. Usually, businesses develop their capabilities through four unique levels of maturity. Where are you right now?
Level 1: Reactive (Passive)
- Indicators: Security is mentioned only when there is some incident or failed audit.
- Psychology: “It won’t happen to us.”
- Learning and Accountability Level: There is no learning at all. IT takes responsibility for everything.
Level 2: Compliant (Check-the-Box)
- Indicators: All employees have mandatory, general, 30-minutes security video training every year. Passwords are updated because they are forced by the system.
- Psychology: “I did my training, I am protected.”
- Learning and Accountability Level: There is very low learning. People comply to rules without even knowing what risks it helps to mitigate.
Level 3: Proactive (Engaged)
- Indicators: All departments receive different briefings on threats. Phishing drills are held regularly and metrics are openly reported. Management actively discusses security risks during quarterly meetings.
- Psychology: “Security is the part of our business every day.”
- Learning and Accountability Level: Very high. Employees proactively look for anomalies.
Level 4: Continuous Ownership (Autonomous)
- Indicators: Security is integrated in all new processes, software purchases, vendors onboarding. Peers report any unsafe behavior (for instance, when a colleague leaves unlocked screen in open area).
- Psychology: “We are defenders.”
- Learning and Accountability Level: Integrated.
Conclusion: Security is a Shared Responsibility
In today’s business environment, the security of your business depends on the accountability of each individual member of your team. Leaving all of your data and your IT assets under the protection of just your IT people is something that was done in the past. You need to create an environment of accountability so that your employees become your best security barrier.
Accountability does not mean finding someone to blame in case something happens. It means giving your team the power to prevent such incidents.
