Your team is resisting cybersecurity policies. How can you address their concerns effectively?

Often people resist cybersecurity policies because they get in the way of work. These could be great employees who want to go the extra mile and just don’t see the risk they’re introducing in the organization. Working with local small businesses. I’ve heard of people sending all their work mail to their personal Gmail so they can work on it later. That’s a giant risk, but it also probably means that the company needs to set up an enterprise quality file sharing system that’s more secure, and do the right training to make sure that people get comfortable with it. I’ve also heard from people who resist MFA for email because they think they have to enter a six digit code every time they send or receive an email. Listen first to understand.

Just like LinkedIn's collaborative articles bring no value, infosec policies alone bring no security. If your users are whining about policies, it means that you are implementing cybersecurity wrong. Stop policing, start buildiing a security-aware culture. That, by the way, is not solely CISO's job. Security culture begins with executive management promoting and practicing it.

understanding the specific reasons why the team is resistant. Are they worried about productivity impacts, complexity, or the perceived need for the policies? Gather feedback through meetings, or group discussions. in a straightforward manner explain the reasons behind the cybersecurity policies and risks of non-compliance, such as data breaches or legal consequences, and how these policies protect us. Show how adhering to the policies can protect employees’ personal information and improve their cybersecurity practices. Share positive outcomes and success stories where strong cybersecurity practices are prevented from breaches. Leaders must be supported for policy success.

Listening to your team and understanding their concerns is crucial for building a culture of security. Collaboratively, we can foster this culture by addressing issues and reinforcing the significance of cybersecurity policies. Sometimes, it may be necessary to modify or simplify policies based on team feedback. Creating an environment where team members feel comfortable sharing their thoughts and concerns is essential. Recognize and appreciate their contributions, and conduct department-specific security awareness and training sessions. Ensure that everyone understands their accountability in maintaining security, emphasizing that it is a shared responsibility starting from senior management and supported throughout the organization.

Starting with the “why” conversation is key to building a culture of cyber security and compliance. That starts with hearing and listening to your team and understanding their concerns. Many times Security is seen as an inconvenience, addressing that in the beginning and helping to educate them around why certain things should be done

Here are concise strategies to address team concerns: Educate Clearly: Explain policies in simple terms, emphasizing benefits and risks.

Educate your team on the importance and benefits of cybersecurity policies. Use clear, concise language and avoid technical jargon that might be confusing. Explain how these policies protect not only the company but also their personal information and work environment. Providing real-life examples of cybersecurity incidents can help illustrate the potential risks and consequences of not adhering to policies. Education sessions, workshops, and informative materials can reinforce this knowledge.

Policies tend to be written for technical audiences and auditors who have come to expect certain language. Instead, policies should be written to be clear - both in spirit and in letter - to your staff. And, they should be written with risk management as the primary consideration. Not every company needs the same security posture or policies. By limiting your focus to the things your company needs, you can make the policies more accessible. Finally, many companies opt for a comprehensive Written Information Security Policy (WISP). This document tends to be so lengthy that most readers find it unapproachable. By breaking up your WISP into shorter, more focused documents, your staff will have an easier time digesting the information

Review and simplify the cybersecurity policies to make them more user-friendly. Complex and lengthy policies can be overwhelming and difficult to follow. Break down the policies into manageable steps and ensure they are written in plain language. Providing summaries or quick reference guides can also help. By making the policies more accessible, you reduce the perceived burden on the team, making compliance easier and more likely.

Políticas claras e simples tendem a ser mais fáceis de serem seguidas. Lembrar que a política de seguran?a cibernética deve iniciar aos poucos, e a medida que a maturidade da empresa é alcan?ada, mais controles e restri??es poder?o ser adicionados. é um erro tentar criar a política "perfeita" e "ultra segura" logo na primeira vers?o, tende a criar resistência da maioria.

Ensure your team has the necessary tools and resources to comply with cybersecurity policies. This includes software, training, and support systems that make it easier to follow the guidelines. Tools such as password managers, multi-factor authentication apps, and secure communication platforms can help them adhere to the policies effectively. Providing these tools demonstrates that you are committed to supporting them in maintaining security.

Here are concise strategies to address team concerns: Offer Support: Provide resources, training, and assistance for compliance.

Offer continuous support to help your team comply with cybersecurity policies. Establish a helpdesk or a support team that can address any issues or questions they might have. Regular check-ins and follow-up sessions can ensure that they are not facing any obstacles in adhering to the policies. Providing a support system reassures the team that they are not alone in this effort and can rely on assistance whenever needed.

Here are concise strategies to address team concerns: Educate Clearly: Explain policies in simple terms, emphasizing benefits and risks. Offer Support: Provide resources, training, and assistance for compliance. Recognize Effort: Acknowledge adherence and celebrate progress.

Recognize and reward the efforts of team members who actively comply with cybersecurity policies. Positive reinforcement can encourage others to follow suit. Acknowledgements can be in the form of public recognition, incentives, or simple appreciation notes. By celebrating their efforts, you create a culture where cybersecurity is valued and seen as a collective responsibility. This also boosts morale and encourages continued adherence to the policies.