Does leadership actively communicate expectations for a secure and ethical culture, particularly leveraging current events as teaching opportunities?

Tone from the top is what's being assessed, namely whether leadership actively communicates expectations for a secure, ethical culture and uses current events as teaching moments. When leaders discuss security incidents in the news or highlight team members demonstrating good security practices, it reinforces that security is a priority and helps employees understand practical applications of security policies.

Evidence could include internal communications (emails, newsletters, town hall recordings) where leadership discusses security incidents or ethical dilemmas from current events, explaining how the organization's values and security practices relate to these situations.