Today’s cyber threat landscape is fast-moving. Companies face daily risks from hackers, malware, or phishing attacks—attacks that are only becoming more targeted and sophisticated.

At ITS, we see security as a moral obligation and a responsibility to our partners and customers, as well as our internal teams. As security risks evolve, so do our responses to those risks. We are poised to make changes to practices and infrastructure as threats are discovered, but we also recognize that staying ahead means taking a proactive approach to data security.

Juggling the latest risks and recommendations is an essential, albeit big, task. In the testing industry, the key to effectively managing this task is building a strong security culture. A security culture built incrementally on intentional security policies will protect your data and your partners.

The Importance of a Security Culture

Responsibility for data security now rests with every single member of a company—it’s no longer up to the IT department alone.

But for many companies, data security as a company-wide culture is new territory. In a security culture, team members, partners, and vendors—essentially everyone, internal and external, who interacts with your company—are aware of your data security policies and their responsibilities within those policies.

And as the saying goes, “A chain is only as strong as its weakest link.”

Strong security policies and infrastructure fall apart if you don’t have buy-in from your teams or if you are relying on a third-party with weak security.

When you develop a security culture, teams, internal and external, are aware of the latest best practices and threats so they can identify and respond to issues as they encounter them.

Create (and Maintain) a Security Culture

Begin with a Security Program

A strong security culture starts with a strong security program. Creating a successful security program requires a regular feedback loop of two steps:

1. Implement and maintain a security program.
2. Audit and report on the security program.

By implementing and maintaining a security program, you ensure that your company is being responsible with the data it is entrusted to protect. By auditing and reporting on the program, you show your partners that you are serious about data protection, which will lead to more trusted relationships and more secure systems.

At ITS, we’ve found that straightforward policies, paired with on-going education, resonate with our teams.

People feel more engaged with a security framework when they can see a direct impact on their work. They are also more comfortable following intentional policies that are implemented using their actual work processes—as opposed to policies that are designed to check a box in an audit.

Encourage Security Awareness

It’s no longer enough just to have the security program in place. Companies also have to make sure their team members know that the program exists, and that they understand and are prepared to react to security risks.

You can establish a security culture over time by taking small steps to integrate an awareness of data security in your current practices.

ITS has found the following tips useful in building a security-conscious company:

• Be proactive: Monitor the threat landscape, evaluate risk, and ensure designs are forward-looking.

• Keep security at the forefront: Share security information with all employees and invest in training and awareness.

• Make security natural: Emphasize its importance to the business and provide open channels to report potential issues or concerns.

• Share information with partners: Encourage transparency in reporting current capabilities and future goals.

• Be realistic: Keep in mind what you can do, and more importantly, what you cannot.

We want people to focus on the advantages of data security practices, rather than seeing them as an impediment to the work they need to do.

If you tailor security messaging and processes to your teams, keep them updated on new information, and align your policies and processes with both your workflow and your security goals, you will see increased engagement from your teams.

Share Your Hard Work with Partners

So, you’ve created a security program and you’ve begun the process of establishing a security culture within your company. Now let everyone know through auditing and reporting.

ITS has spent years focusing on security and building security awareness into all of our processes (which never stop evolving). We wanted to share these processes with our partners, but we also wanted to make sure we were sending the most meaningful information available.

After searching for a good way to report everything, we settled on the SOC 2 – Type II.

SOC 2 is an independent audit that verifies management of data based on five trust principles. SOC 2 is unique to each organization and checks actual procedures and processes against the trust principle guidelines. The output of the audit is a report that contains a system description and results of reviews against each criterion of the trust principles.

ITS has found the SOC 2 report to be a very effective way of communicating our security position with partners.

We find the following three features particularly notable:

• The system description allows us to explain the ways we use policies and systems to address all of the major concerns and best practices around data security.

• The criteria ratings and confirmation of systems allow us to easily show how we are meeting the guidelines and the ways we are protecting data.

• The fact that the audit is conducted by an independent third-party allows our partners to feel confident that we’re doing the things we say we’re doing, and that our policies and procedures match up to our security goals.

Audits often have a negative connotation, but that shouldn’t be the case. If you align your policies and procedures with audit standards, follow through on plans laid out in policies, and get buy-in from your teams to make them feel like they’re a part of the process, audits can result in stronger systems, reports that are easy to share, and greater trust in partnerships.

 

A company culture that promotes security consciousness and preparedness may take years to fully establish. Take a few small steps today to promote preventative security measures and a proactive security approach.