Robert K.

Andrew R. You have already pointed out the problem. The management is responsible for the audit, but often has different interests than the employees working in the operational process. In our audits, the employees in the operational line are responsible for both the process and the audit. Before the audit, we give them three clear guidelines.

We also ask them not to prepare for the audit. We want them to provide honest and unfiltered feedback to the auditor. If we are aware of certain issues or possible shortcomings, we state these at the beginning of the audit. We also inform the auditor that we are particularly interested in these topics and would like to hear their findings and perspective on them.

You have to take risks to grow the business. By making people in the organisation responsible for risks and processes, they can detect at an early stage when security measures are too tight. It is a continuous interaction between the business and operations. At the end of the day, everyone has to do their job. This means that someone who drives a forklift has fewer rights and restrictions on their account than someone with global admin rights. With that said, when risks need to be taken, a strict zero trust approach is not always viable.

Andrew R. we drip feeding the content over the year. They can complete the training with 5-10 minutes effort per week. You are totally right that we want to have a higher completion rate. Let's hope next years stats are better!

Melissa G. Lars S. It depends on the incident. You could say that the human line of defence is the third line of defence. In some cases, an incident is detected by a person before technical measures are triggered. There are a few things that I consider important in this regard. I would rather have 100 reports and 10 incidents than 10 reports and 1 incident. In addition, it is about creating a consistent and integrated process. Employees need to feel responsible. The only way to achieve this is by giving them that responsibility, instead of assigning it solely to management. Think of roles such as risk owners or process owners. As Lars mentioned, the connection between the different lines of defence is very important, and I agree with that. Unfortunately, this does not always mean incidents will follow the same route, as mentioned earlier. Repetition is key. Especially with the new “policy to lesson” functionality, it becomes easy to offer organisation-specific measures and policies to employees within SoSafe.

Melissa G. Here are te answers on your questions:

I have and will share the detailed outcome with Thijmen K.. Or send me an e-mail. This is for SoSafe-employees only, because of the DPA.

Lars S. 2 years.