9 in 10 Enterprises Report Gaps Between the Cybersecurity Culture They Have and the One They Want

New research from ISACA and the CMMI Institute finds that few
employees understand their role in protecting information

LAS VEGAS–(BUSINESS WIRE)–#ISACA–With cybersecurity threats continuing to escalate worldwide, the
ISACA/CMMI Institute Cybersecurity
Culture Report found that just 5 percent of employees think their
organization’s cybersecurity culture is as advanced as it needs to be to
protect their business from internal and external threats. More than
4,800 business and technology professionals shared their insights in the
global research study, conducted via online polling in June 2018.
Results were released today at ISACA’s CSX North America cybersecurity
conference in Las Vegas.

Cybersecurity culture is a workplace culture in which security awareness
and behaviors are integrated into everyone’s daily operations, as well
as an executive leadership priority. In a threat-ripe environment, an
effective cybersecurity culture can help employees understand their
roles and responsibilities in keeping their organizations safe and
customer data secure. However, just 34 percent of respondents say they
understand their role in their organizations’ cyber culture.

Companies must take an all-hands-on-deck approach to counter cyberattack
threats, the report summarizes.

“Enlisting the entire workforce to mitigate an enterprise’s cyber risk
is an emerging practice,” says Doug Grindstaff II, SVP of Cybersecurity
Solutions at CMMI
Institute. “We are hearing a lot of feedback about how organizations
can move the needle on employee involvement. It’s challenging, but
organizations are rightly concerned by the growing sophistication of
cyberattacks.”

Widespread employee involvement correlates strongly with the minority of
organizations that have achieved strong satisfaction with their
cybersecurity culture. Nine in ten employees (92 percent) at these
organizations say that their C-level executives share an excellent
understanding of the underlying issues, which may be why they loop-in
their employees so well; 84 percent of employees at these organizations
say they understand their role in cybersecurity.

Other critical findings include:

• Many organizations lack the first—and all-important—step toward a
  cybersecurity culture: 42 percent of organizations do not have an
  outlined cybersecurity culture management plan or policy.
• Aligning the entire workforce with the organization’s cybersecurity
  policies requires significant capital: Organizations that report a
  significant gap between their current and desired cybersecurity
  culture are spending just 19 percent of their annual cybersecurity
  budget on training and tools; organizations that believe their
  cybersecurity culture is where it is supposed to be are spending more
  than twice as much (43 percent).

“A key motivator for organizations delaying investing in their
cybersecurity cultures is a lack of awareness about the attempted
threats and ongoing risks, as well as a lack of awareness about the
assets at risk to cybersecurity threats,” said Rob Clyde, NACD Board
Leadership Fellow and ISACA Board Chair. “However, individuals tend to
underestimate the potential damage and overestimate technology’s ability
to limit such incidents. Doing so puts their organizations at serious
risk.”

To view the research, visit www.isaca.org/cybersecurity-culture-study.

About ISACA

Nearing its 50th year, ISACA^® (isaca.org)
is a global association helping individuals and enterprises achieve the
positive potential of technology. ISACA equips professionals with the
knowledge, credentials, education and community to advance their careers
and transform their organizations.

Twitter: www.twitter.com/ISACANews

About CMMI^® Institute

A subsidiary of ISACA Enterprises, CMMI Institute (cmmiinstitute.com)
is the global leader in the advancement of best practices in people,
process and technology. The Institute provides the tools and support for
organizations to benchmark their capabilities and maturity by comparing
their operations to best practices and identifying performance gaps.

Twitter: https://twitter.com/CMMI_Institute

Contacts

ISACA
Emily Van Camp, +1.847.385.7223
evcamp@isaca.org
or
Kristen
Kessinger, +1.847.660.5512
kkessinger@isaca.org