Organisational culture develops over many years. It is more than the formal structure - many of its most powerful characteristics are informal and undocumented. The behaviours seen within an organisation are the result of multiple drivers. Some are plainly visible and formal, such as process manuals. Others are less visible and are informal, yet still form a huge part of the culture.
The culture change concept seeks to change organisational culture to improve security, not impose a security culture. It can help ensure that security itself is not the problem. For decades, CGI has helped clients embed cyber security into their business operations and facilitate change.
CGI‟s culture change service uses a range of tools to find the root causes of security incidents, risks and problems, especially if they are not immediately apparent. Events that can trigger a culture change programme include unexpected or unexplained incidents, ongoing compliance failure, or significant regulatory and legal change. The service can take input from many sources, but, most importantly, it engages directly with the people who are involved.
