Lars S.

Hi Andrew R., I think you raise a very important point about how Information Security is perceived within an organization. In my opinion, it's one of the biggest challenges for anyone working in or leading security. My own approach revolves around what I would call integrity. Not the integrity of information, but the integrity of decisions, attitudes, guidelines, and processes. If i stay true to the own build security and hold on to a higher Standard, People start to trust me and my decisions. To me, it feels like we're talking about very similar things. I call it "integrity", while you call it "trust". Regarding metrics, this is actually one of the biggest gaps in our ISMS. Measuring trust is extremely difficult. Personally, I see it more through day-to-day interactions with colleagues than through KPIs or dashboards. You can often feel whether people trust Security long before you can measure it. As for your second question, the biggest impact came from being transparent about our decision-making. We always try to explain why we are introducing new measures or changing existing processes. Combined with being approachable and available for security discussions, this helped create trust over time. Best regards Lars

Andrew R. Hope I can dodge that fist for a few more rounds 😅

Andrew R. The maturity of our ISMS actually lets me point the auditor towards certain controls I want to see listed in the audit report. In fact, I got the budget for SoSafe because of an audit report (and partly because of NIS2). We have a really strict auditor, and every finding will end up in the report — but if I want the auditor to put their finger on a specific problem, it's always been possible to "boost" the focus on that control to get that management attention. Edit: Maybe during my first audit i felt some kind of "fear" but with experience it shifts towards "yet another challenge".

In my experience, it's important to "make security easy," be present, create opportunities for dialogue, and keep colleagues involved in security measures. At the same time, we need to utilize technology to "make insecure behavior hard." "Trust but verify" never worked for me because if you know your organization and culture, you don't need to verify. You already know the security gaps, and the struggle is more about how to close them. Edit: Some thoughts: Trust ist important, but it has a time limit and requires to be regular renewed. Trust is subjective and cant really be measured and therefore cant be a base for decision makings.

Melissa G. In my opinion, it is all about linking the security processes. If incident management, risk management and implementing measures are not linked, the reaction becomes slow and then the result will be the mentioned 19days. If the root cause is a human risk, then awareness measures should follow immediately if the risk evaluation is high or very high for the organisation. The key point is how urgent and concrete the risk is. For an high and immediate risk, 19 days is far too long. For a more abstract or long‑term risk, 19 days sounds "fair". For me the reaction time needs to defined and evaluted by the inherent risk (incl. the orginal threat)

Dr. G. -- mainly policies and training. We are currently rolling out purview to restrict the use of certain labeled documents by AI Services/DLP. In regards to OpenClaw it wont help a lot. 🤔

Melissa G. Dr. G. -- to be honest, currently I am focused not on attackers using AI, its more about colleagues early adopting AI without clear guidelines. In particular colleagues experimenting and maybe even granting Openclaw access and rights to systems and services keeps me up at night. OpenClaw led to a high dynamic with missing awareness to the security implications.