In today's rapidly evolving business landscape, boards of directors are more than just stewards of governance—they are the strategic compass guiding an organization toward enduring success. As the challenges facing companies grow increasingly complex, from disruptive technological trends to shifting societal expectations, the board's role has never been more critical.
This series is designed to empower board members with the insights and tools necessary to navigate change with confidence. Our experts, each a leader in their respective fields, will share real-world examples, practical frameworks, and actionable advice in a Q&A format, as well as lessons learned from their personal and professional journeys.
Embedding security awareness and risk into organizational culture
For the latest installment of our board leadership series, BerryDunn Financial Services Practice Group Senior Manager Lindsay Francis shares key insights on information security awareness and risk, including how to embed it in your organizational culture.
Q. What is the current risk landscape and how do employee behaviors (e.g., phishing clicks, weak passwords) contribute to organizational exposure?
A. Risks are part of everyday business and require an organizational culture of awareness and a commitment to staying up to date on changes—whether these are security risks directly affecting you or those that trickle down from your vendors. It’s important for every member of the organization to remain aware that their actions, or inactions, both help to protect and have the potential to undermine the security controls you or your vendors have put in place to protect your environment.
There are times when security controls can seem cumbersome and appear to slow down processes, but when designed properly—which requires a balance of protection and allowing business-critical objectives to continue in a reasonable manner—those security controls help to keep the day-to-day processes running as smoothly as possible. Security incidents slow down the ability to perform important responsibilities.
Both phishing clicks and weak passwords continue to contribute to a large proportion of security breaches. Although this is not a new concept, security fatigue has added another risk where employees are overwhelmed by the constant threats, the need to scrutinize every email, and the long list of passwords and multifactor authentication techniques required to perform everyday tasks. This can lead to employees looking for loopholes, ignoring important security measures, or failing to identify threats. Organizational culture should help employees embrace the mindset that investing time in prevention is crucial to helping avoid incidents.
Q. How do you differentiate information security awareness from general IT training or technical cybersecurity programs?
A. Information security awareness focuses on culture. The key is to help employees recognize risks and respond appropriately. IT training is more technical, with the purpose of teaching specific skills and procedures. Cybersecurity programs are broader, covering the technical aspects with security controls, incident response, and compliance, as well as education goals and training schedules to promote ongoing security awareness.
Q. How does an organization help ensure security awareness is part of a broader, ongoing effort to build a security-conscious culture and not a one-time initiative?
A. Security awareness needs to be included throughout the lifecycle of employees—from onboarding to regular training, as well as ongoing communications. Continuous learning cycles, including short learning modules and periodic phishing simulations, help reinforce secure behaviors. Leadership must champion security as a core value, and metrics should be used to measure progress.
Q. What cultural challenges are organizations facing in terms of encouraging secure behaviors and how can they be addressed?
A. Challenges can include resistance to change, security fatigue, a lack of understanding of the direct consequences to the employee’s day-to-day tasks in the event of a security incident, and insufficient leadership support. Addressing these requires leadership engagement, highlighting why it’s important, continuous training delivered in small exercises, and a focus on positive reinforcement. This last part is key—when employees feel punished for failing a training exercise, their attitudes can become another obstacle to overcome. When remediation training is required, it should be posed as a supportive measure to help create engagement and reeducation. Lastly, measuring and reporting on culture, not just compliance, is crucial to understanding where resistance and fatigue may linger.
Q. How do organizations stay current with emerging security threats and adjust awareness training to address these new risks (e.g., AI-driven attacks, deepfakes)?
A. Typically, the teams within IT, Risk, and/or Compliance are keeping up to date with new security trends and threats. It’s essential for organizations to use that knowledge to update awareness programs, communicate those to the organization, and coordinate with any training vendors on how to include new threats like AI-generated phishing and deepfakes into the ongoing training modules. Incident response exercises and real-world case studies can help employees recognize and respond to evolving risks.
Q. How do software vendors fit into the cybersecurity ecosystem and what should the Board know about vendor risks?
A. Gaining advantages in technology, operational efficiencies, and expertise does not come without a downside—vendor use comes with its own layer of risks. Although Software-as-a-Service (SaaS) providers are hosted in the cloud, which means they are not within your network, this does not prevent a breach of your vendor from reaching your network. Your security is only as strong as your weakest vendor’s security. Each vendor should be properly vetted from an information security perspective before a contract is signed. Functionality of the software cannot be the only driving factor.
The Board should review the organization's vendor management program and processes to look for gaps in both the initial scoping and onboarding steps, including whether a cross-functional approach is used to perform due diligence, as well as what the ongoing due diligence entails. For example, has research been performed on whether the vendor has experienced any security incidents prior to signing a contract, and how will your organization be informed if there is a future event, and is this stated in your contract? Does the organization require multifactor authentication for all vendor software to help prevent hackers from taking advantage of weak passwords?
Annual updates should be provided to the Board on the risk ratings for each vendor, the mitigation controls in place for high-risk vendors, and the organization’s actions in response to any vendor security incidents. In addition, the Board and management should consider vendor software availability during the annual review and update process when ranking the risks of each vendor. For example, do you have a plan if your vendor is suddenly unavailable? Have you tested a disaster recovery scenario with the vendor, or do you have a manual process to keep your daily tasks on schedule in the meantime while the vendor works to restore its service?
Q. What role should the Board play in driving security awareness throughout the organization?
A. The Board should set the tone for security, ensure regular training, and require reporting on the organization’s security posture. Board members must be cyber-literate and engage with security leaders to understand risks and mitigation strategies.
Q. How often should the Board receive updates on security awareness, and in what format?
A. Best practice is quarterly updates, at a minimum, with additional briefings after major incidents or regulatory changes. Formats can include dashboards, executive summaries, and presentations that highlight key metrics, trends, and action items. Another helpful tool can include Board-specific training to help brush up on cybersecurity knowledge to keep the Board up to date on trends and industry-specific risks.
Q. How do organizations ensure that security awareness is integrated into overall organizational governance, risk management, and business continuity planning?
A. Security awareness is an imperative part of the organization’s governance framework, which should include embedding awareness into operational policies as well as the risk management program, incident response plan, disaster recovery plan, and business continuity plan. Training should align with risk assessments, with higher attention given to higher-rated risks, and provide multiple reminders throughout the year of the key steps all employees should know about reporting suspicious activity or security events. Annual disaster recovery and business continuity exercises should include multiple departments to help ensure high collaboration during a real-life event. In addition, this context reinforces a security awareness mindset and may help provide a better understanding of the challenges and consequences of failing to prevent an incident.
About Lindsay
As a member of BerryDunn’s Financial Services Practice Group, Lindsay helps clients identify improvements in information security, operational efficiency, and IT service delivery. She has worked across multiple industries—including banking, healthcare, public gaming, and higher education—to help clients gain control of IT and financial operations. This, coupled with Lindsay’s experience working with complex organizations to meet regulatory and industry standards, provides clients with a unique and valued perspective. Learn more about Lindsay.
BerryDunn partners with organizations to create work environments where business success and personal growth coexist and where people are confident knowing their workplace positively contributes to their well-being. We take a comprehensive approach to our workforce and well-being work, considering how business needs, organizational capacity, and the employee experience work together to drive your business forward. Learn more about our financial institutions consulting services.
Skip to Main Content