All posts

1 min read

Security Culture, Policies, and Procedures

Policies, procedures, and ISO 27001 ISMS: building a security culture where early incident reporting is encouraged and rewarded.

Translated from Turkish with AI.

Why it matters

Even the best technology fails within a team that doesn't understand the rules and operates under an "it won't happen to us" mindset. A strong security culture is an environment where doing the right thing is effortless, and making a mistake is difficult.

Core concepts

  • Policy: The rule defining what must be done (e.g., "Every employee must use MFA").
  • Procedure: A step-by-step guide explaining how to do it (e.g., "How to configure MFA on your phone").
  • Information Security Management System (ISMS): A management framework through which an organization systematically oversees its information assets, risks, and safeguards. The most recognized standard is ISO/IEC 27001. Its core cycle: identify assets → assess risks → apply controls → measure → improve.
  • Essential policies: Acceptable use, passwords and access, remote work, backups, incident reporting, onboarding and offboarding.
  • Signs of a healthy culture: Leadership following the rules themselves; employees being commended rather than penalized for reporting mistakes; security awareness delivered through short, frequent sessions rather than once a year.

A realistic example

An employee realizes they clicked a phishing link but keeps quiet, fearing reprimand. Two days later, the attacker has spread across the entire email infrastructure. In an organization where reporting a mistake immediately is met with gratitude, the incident would have been resolved within the first hour.

Action items

  • Keep policies simple enough to fit on a single page; nobody reads a 40-page policy document.
  • Maintain a clear checklist for onboarding and offboarding (accounts, hardware, permissions).
  • Thank any employee who comes forward to say, "I accidentally clicked a link."

Key takeaway: An employee who reports an error early is an organization's most valuable security asset.

*This post is part 12 of the 14-part Cybersecurity Awareness series.* Next up: When a security incident occurs: detecting, reporting, and responding