Security Culture and Insider Risk Assessment

A good security culture makes it easier to prevent mistakes, detect concerns early and manage risk without creating unnecessary distrust. We assess how people, management, work processes and access rights affect the organisation's insider risk.

A complete picture of the organisation's insider risk

Insider risk arises when a person, a supplier or an authorised system with legitimate access can cause harm. This may be due to deliberate acts, but also to mistakes, lack of knowledge, unclear expectations, pressure, weak routines or access rights that are more extensive than the need dictates.

Our assessment therefore does not look only for individuals or non-conformities. We examine how culture, organisation, management, technology and work processes interact, and where the organisation can reduce risk before an incident occurs.

The assessment can include

interviews and workshops with management and relevant specialist teams
review of roles, responsibilities, routines and governing documents
assessment of security awareness, speak-up climate and reporting culture
mapping of critical assets and who or what has trusted access
assessment of the personnel lifecycle, from recruitment to change of role and departure
analysis of the interaction between HR, IT, security, the legal function and management
identification of human, organisational, technical and cultural vulnerabilities

What does the organisation get?

The organisation gets a clear situational picture with prioritised findings and practical recommendations. The measures are tailored to the organisation's size, risk picture and maturity, and can include improvements in governance, training, access control, reporting, follow-up and cross-functional collaboration.

The assessment can be carried out as a stand-alone assignment or as the first phase of a long-term programme for security culture and the management of insider risk.

Submit the form below and we will get in touch with you.