WaterISAC’s latest Tip of the Week offers a straightforward reminder with significant operational implications: cybersecurity is a shared responsibility across the organization. WaterISAC emphasizes that every employee, executive, and board member has accountability for an organization’s cybersecurity posture, and that leadership support and staff engagement are essential to building a cyber-secure culture and reducing insider risk. WaterISAC points organizations to additional guidance from the UK National Cyber Security Centre on creating the right organizational culture for cybersecurity and CISA’s Insider Threat Mitigation Guide. (WaterISAC)
That matters because cybersecurity culture is not created by an annual awareness course or delegated entirely to the security team. Culture is reflected in what leaders prioritize, what employees understand is expected of them, whether personnel are comfortable reporting suspicious activity or mistakes, and whether security is incorporated into routine organizational decisions. A strong cyber-secure culture creates another layer of defense by helping personnel recognize risk, communicate concerns, and act before a problem becomes an incident.
This guidance directly reinforces Gate 15’s 15 from 15 fundamentals of People and Organizational Culture. Cybersecurity depends on people understanding both the threats facing the organization and their individual responsibilities for reducing risk, while leadership must establish an environment where secure behavior is expected, supported, and reinforced. The strongest technical controls cannot compensate for an organization where cybersecurity is viewed as somebody else’s job. Gate 15’s 15 from 15: Blocking and Tackling Cybersecurity & Resilience.
Action: Ask employees, executives, and board members the same question: “What is your role in our organization’s cybersecurity?” If the answers are unclear, inconsistent, or amount to “that’s IT’s job,” you have identified a resilience gap worth addressing.
Cyber and all-hazards risk and resilience. At Gate 15 we apply a threat-informed & risk-based approach to analysis, resilience, & operations, helping to secure America’s People, Places, Data, & Dollars. Learn more at www.gate15.global. Join Gate 15’s Resilience and Intelligence Portal (GRIP) and connect to our homeland security community. Join the GRIP!
Additional Info
- WaterISAC: WaterISAC’s Tip of the Week – September 17, 2026
- UK National Cyber Security Centre: Creating the right organisational culture for cyber security
- CISA’s Insider Threat Mitigation Guide
- Gate 15: 15 from 15: Blocking and Tackling Cybersecurity & Resilience (link to white paper)
Understand the Threats.
Assess the Risks.
Take Action.
