Page 82 - Cyber Defense eMagazine Annual RSA Edition for 2024

Beyond the individuals

Leaders are critical champions, but accountability for cybersecurity must extend beyond individual
performance to include team and departmental outcomes. Security should be a standing agenda item in
team meetings with regular reviews of security metrics, incident reports and improvement plans. Teams
should be encouraged to share successes and lessons learned from security incidents, fostering a culture
of continuous learning and improvement. By documenting these practices and making them a part of the
operational rhythm of the organization, security becomes a shared, lived value rather than an abstract
principle.

Think about the cybersecurity posture of an organization where each team’s operational scorecard
included patch status, open exceptions and a compliance control score compared to an organization that
consumes pen test results once per year and checks off the boxes marked “critical.” The former is
positioned to win while the latter is likely to end up on the news.

Accountability is not synonymous with blame

In a healthy security culture, accountability means providing the support, tools and resources necessary
for individuals and teams to achieve their security goals. Cyber incidents will happen. It’s inevitable. A
healthy cyber culture creates an environment where incidents are seen as opportunities for learning and
growth, not just moments for criticism and punishment. This supportive approach to accountability
ensures that employees are more likely to engage with security practices actively and proactively, rather
than avoiding them out of fear of repercussions.

Conclusion

Cybersecurity is indeed a team sport and winning depends on everyone playing an active part. By taking
cues from successful teams and legendary coaches, organizations can foster a sense of ownership and
responsibility for cybersecurity across their entire workforce. When positive cybersecurity outcomes
become a tangible part of performance evaluations, project milestones and daily routines, the abstract
becomes concrete, and the invisible shield of cybersecurity begins to harden. Through these measures,
organizations can ensure that their security efforts are not just a shared responsibility but a shared
commitment to excellence and resilience.

82