How Do You Gain Top Management Commitment?

The attitude of your leaders has a big impact upon the success or failure of your information security efforts, as their behaviour directly affects the culture of your organisation.  Those organisations with members of the leadership team that visibly demonstrate a lack of support for the information security management system will find it very difficult to convince others within the organisation to behave differently.  This can lead to a negative security culture within the organisation.

So, we know that gaining management commitment is vital, but exactly how do we demonstrate this?

There are several different ways in which your leadership team can demonstrate support and commitment to the cause.  The first is with direct involvement in information security governance.  Governance is primarily about effective communication.  This starts from the leadership team down through development, approval and implementation of effective policy and continues from the rest of the business upwards, through effective reporting.  Your leadership team should be directly involved in the decision-making process regarding appropriate policy to be implemented, and approve those policies once drafted.  Similarly, leadership should demonstrate that it is taking any reporting seriously and should be involved in decisions made in response to such reports.

There are other areas which leadership should get involved with including:

• Communicating directly with the business regarding the importance of information security, e.g., through the use of newsletters, chat sessions, video broadcasts etc
• Signing off residual risk and agreeing on the risk appetite
• Supporting other management roles throughout the organisation to ensure that policy and processes are embedded
• Chairing risk and audit committee meetings and information security forum sessions
• Ensuring that appropriate and adequate resources are provided for the implementation, operation and continual improvement of your information security efforts.

Of course, there is a critical driver for the leadership team to get involved in order to ensure that your information security efforts are performing as expected – that driver is accountability.  Depending upon their position within the organisation, members of the leadership team could be held personally liable if your information security efforts fail to such a degree that legislative or regulatory requirements are not met.