I’ve spoken and written quite a bit about what makes an effective security awareness program and now, I’m going to introduce another facet that can help to significantly enhance all of your efforts in security awareness. That concept is culture carriers.
Within an organizational context, a culture carrier is: “Someone who has intimate knowledge of the company values and can have an intelligent discussion about why their company does what it does. They are ambassadors for their company and passionately work to promote the company values in their day to day dealings with clients and coworkers.” One way to increase the influence of security values is by leveraging culture carriers.
The concept of culture carriers is effective because they can scale, are low cost, consist of highly engaged individuals and you’re essentially creating your own communications network. Think about it – instead of just having one person delivering a message, you have many throughout the organization helping to amplify your message.
Also, financial cost is minimal to implement this type of program: the biggest cost of course is the time invested. These ambassadors understand both the challenges and the cultures of their groups, making their communication with them much more effective than communication coming from someone else.
In many ways, you create your own communications network when you develop culture carriers. Not only are you relaying vital information throughout the organization that you want to disseminate, but you are also gathering important information back from your carriers.
I liken culture carriers to that of a surround sound system. A stereo is relatively simple, it directs sound towards you from the front. A stereo is like working from the top-down in an organization. With a simple stereo, you can feel like the sound is just coming at you. However, if you add a few components of surround sound, you enhance the experience. Great surround sound systems make you feel as though you are immersed in the sound, as opposed to the sound just coming at you.
Think of your culture carriers as surround sound speakers. When you have surround sound, your messages, values and behaviors are being reinforced from multiple points, creating an immersive experience.
Think for a moment how the idea of a culture carrier might look within a security context. Imagine having groups of people across regions, departments, and at all levels of your organization who have intimate knowledge of your security values and who model positive security behaviors; they can discuss why these values and behaviors are relevant and important. Imagine the power and influence they would bring as they work to promote your values, interact with other people, support projects, mentor new hires and help other employees around them. This group of employees becomes a force multiplier for other employees and the larger organization.
By distributing culture in this manner, your program is building a critical framework for sustainability. The distributed nature of your culture carriers allows security content and values to reach various departments and regions of the company. How to engage your system of culture carriers, who you choose, and the methods used to acknowledge their value and support are all factors in their sustainability.
This group of culture carriers, ambassadors, or whatever you decide to call them, should come from all levels of the organization and across as many departments and regions as possible to help spread and diversify your security messages significantly. People can apply to become culture carriers, managers can nominate, other employees can nominate, or surveys can help reveal influential people.
Ideally, your security culture carriers should already be respected and influential individuals within their departments and peer groups. This concept is most effective when the individuals truly believe in your program.
It’s also important to link incentives to successes of the program. Think about what you can do to make your culture carriers feel special and valued. It doesn’t have to mean monetary rewards – it can be recognition, swag, the feeling of having ‘insider’ knowledge, etc.
The important thing is to recognize that your culture carriers are doing you a valuable service, and because of that you should return some value to them.
Overall, culture carriers are one of the most effective communications tactics for spreading the key messages of your security awareness program. They are an amplification of your message. Don’t overlook this crucial step when developing an effective security awareness program.
Want to get more detail about how to proactively shape your security culture and drive secure behavior? If so, check-out my upcoming book Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors (https://wiley.com/buy/9781119566342).