GV.RR-01.034
Does leadership actively communicate expectations for a secure and ethical culture, particularly leveraging current events as teaching opportunities?
Explanation
This question assesses whether organizational leaders visibly promote security values by connecting them to real-world examples. When leaders discuss security incidents in the news or highlight team members demonstrating good security practices, it reinforces that security is a priority and helps employees understand practical applications of security policies. Evidence could include internal communications (emails, newsletters, town hall recordings) where leadership discusses security incidents or ethical dilemmas from current events, explaining how the organization's values and security practices relate to these situations.
Implementation Example
Share leaders' expectations regarding a secure and ethical culture, especially when current events present the opportunity to highlight positive or negative examples of cybersecurity risk management
ID: GV.RR-01.034
Context
- Function
- GV: GOVERN
- Category
- GV.RR: Roles, Responsibilities, and Authorities
- Sub-Category
- Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

