23Competence, Awareness and Security Culture

“Training tells people the rule; culture makes them follow it when no one is watching.”

Clause 7 of both standards requires the organisation to define the competence needed for each role, ensure it is held through education, training or experience, and keep evidence of it. It requires everyone to be aware of the policy, their contribution to the system’s effectiveness, and the consequences of non-compliance. But real awareness goes far beyond attending an annual course.

Text in this figure

Knowledge · I know the policy · Understanding · I know why · Skill · I know how · Behaviour · I do it unprompted · Culture · I remind others · Training lifts the team a step; practice and measurement keep it there · Figure 29

An Awareness Programme That Changes Behaviour

• Short and frequent: A few minutes every month beats a full day once a year.
• Tied to the work: Examples from the team’s own projects: a client file, a share link, a prompt in an AI tool.
• Practical: Regular phishing simulations with platforms such as KnowBe4 or Cofense, with instant learning rather than punishment.
• Measured: Simulation click rate, reporting rate and time to report.

Security Champions

A small security team cannot be in every meeting. A security champions network places an enthusiastic person inside every team, a designer, developer or producer, who receives extra training and becomes the first person asked and the first to raise a flag. They are not a police officer but a bridge between security and the work.

Text in this figure

Team · Security · Development · Code review · Design · Client assets · Production · Footage and drives · Marketing · Social accounts · Operations · Devices and access · Data and AI · Models and prompts · Diamond: a volunteer security champion inside each team · Figure 30

• Selection: Volunteers, not appointees, respected by their colleagues.
• Time: A declared share of their time, say 10%, recognised in performance reviews.
• Empowerment: Training, a direct channel to the security team, and authority to stop an insecure delivery.
• Recognition: Public thanks and professional development opportunities.

Building a Culture of Security Innovation

To meet the dynamic nature of threats, the creative industries need a culture in which security innovation is valued as highly as creative innovation. This is achieved in two ways:

• Encouraging experimentation: A culture that encourages trying new security solutions and sees failures as learning opportunities.
• Cross-disciplinary collaboration: Collaboration between security professionals and creative teams, so security solutions enhance the creative process rather than hinder it.

Lessons Learned

1. 1Competence is defined for each role and its evidence kept.
2. 2Effective awareness is short, frequent, tied to the work and measured.
3. 3Security champions are a bridge between security and teams.
4. 4Security innovation is valued as highly as creative innovation.