There are many change models to choose from. You may be able to adapt some when implementing security policies. This section focuses on Kotter’s Eight-Step Change Model. John Kotter, a professor at Harvard Business School, developed the model and introduced it in 1995 in a book titled Leading Change. The model has been widely adapted for a number of purposes. It addresses the need to create executive support for implementing change. This is a critical success factor in implementing security policies.

Professor Kotter states that to be successful in implementing change in a company, at least 75 percent of management needs to “buy into” it. The early stages of creating vision and urgency around the need for security policies will be critical later to build the coalition of executives needed to make change happen.

Let’s examine the model in relation to implementing security policies. The model divides an effective change process into eight steps:

1. Create urgency—For change to happen, there must be an urgent need. Helping people understand information security threats and risk to the business can help build this sense of urgency.
2. Form a powerful coalition—For change to happen, leadership must back you. Establish early a tone at the top for the need for the security policy.
3. Create a vision for change—Change needs to be understandable. It must be clear what you are asking of people and what measurable benefit the security policy will bring.
4. Communicate the vision—Once you have support, you need to communicate your intent widely. Communicate the security message through as many channels as possible.
5. Remove obstacles—There will be barriers to your success. Empower individuals to be change agents. A change agent is someone tasked with challenging current thinking.
6. Create short-term wins—Success, no matter how small, breeds more success. Focus on small, well-defined goals that collectively build toward larger long-term goals.
7. Build on the change—Real change takes time and continued effort. Build a process of continuous improvement of the security policies.
8. Anchor the changes in corporate culture—To make anything stick, it must become habit and part of the culture. Find opportunities to integrate security controls into day-to-day routines.

FIGURE 5-6 shows how this model can be adapted to implementing security policies. You would cycle through this model each time you add a new security policy or make a major change to an existing policy. This model ensures that before you start a formal implementation, you have the leadership support needed to succeed. It also highlights the separation between informal and formal tasks. When we adapted Kotter’s model for the purposes of this chapter, we created a separation between informal and formal implementation tasks. This is to emphasize the importance of preparing for policy implementation through informal discussions versus starting a formal project approach right away. There are two major benefits to having these informal tasks. First, you gain executive support. Having a formal project before you have executive support is presumptuous and will create unnecessary resistance. Second, it establishes a collaborative setup that allows you to change and modify your approach. It also builds ownership into the process for the executive giving you advice.

Implementing security policies is easier if you manage it from a change model perspective. It helps you establish a collaborative style that allows business leaders to understand and buy into what you are trying to accomplish. The process starts with an informal set of steps that builds awareness and understanding. With a clear purpose beyond your security policies, you can build the executive support needed to succeed.

Using the steps in Kotter’s Eight-Step Change Model, the following sections explain the roles and responsibilities involved in the change process.

The organization is ultimately accountable for information security. When something catastrophic occurs, with lawyers and regulators engaged, the organization’s leaders have to explain what happened. In fact, officers of the organization may be held personally liable. They may pull the top technology executive (the CIO) along for the ride. But executives are the ones who fund technology and determine how much risk they are willing to pay to reduce.

Setting expectations for leaders quickly becomes a matter of budget. If there aren’t dollars to spend to implement controls, then it’s hard to hold executives accountable. IT spending varies greatly by industry. Deloitte found that on average, companies spend 3.28 percent of their revenue on IT. This percentage changes if you focus on specific industries. Banks tend to spend around 7.16 percent and construction 1.51 percent. Of those companies that consistently outperform the S&P 500, 57 percent increased their IT budget from 2016 to 2017.¹ Companies that spend more on IT have more resources to deploy for information security. Thus, the expectations for information security in a financial services company may be different from those in a manufacturing company.

Although business leaders may be ultimately responsible, they rely on key technology roles to keep them out of trouble. These roles are accountable for implementing security policies, monitoring their adherence, and managing day-to-day activities. Although their titles may vary within an organization, typically you find different individuals accountable for each of the following roles:

• Information security officer (ISO)—The individual accountable for identifying, developing, and implementing security policies. The ISO is also accountable for ensuring that corresponding security controls are designed and implemented.
• Executive—A senior business leader accountable for approving security policy implementation. An executive is also responsible for driving the security message within an organization and ensuring the security policy implementation is given appropriate priority.
• Compliance officer—An individual accountable for monitoring adherence to laws and regulations. A compliance officer often uses adherence to security policies as a measure of regulatory compliance.
• Data owner—Typically someone in the business who approves access rights to information. Data owners are accountable for ensuring only the access that is needed to perform day-to-day operations is granted. They would also be responsible for ensuring there is a separation of duties to reduce risk of errors or fraud.
• Data manager—An individual typically responsible for establishing procedures on how data should be handled. Data managers also ensure data is properly classified.
• Data custodian—An individual responsible for the day-to-day maintenance of data. Data custodians back up and recover data as needed. They grant access based on approval from the data owner. You can view their accountability as generally maintaining the data center and keeping applications running.
• Data user—The end user of an application. Data users are accountable for handling data appropriately. They are accountable for understanding security policies and following approved processes and procedures. Data users have an obligation to understand their security responsibilities and not to violate policies.
• Auditor—An individual accountable for assessing the design and effectiveness of security policies. An auditor can be internal or external to the organization. They offer formal opinions in writing. These opinions review the completeness of the policy design and how well it conforms to leading industry practices. Auditors also offer opinions on how well the policies are followed and how effective they are. Auditors do not report to the leaders they are auditing. This allows them to provide a valuable independent second opinion. For example, internal auditors in publicly traded companies typically report findings to the audit committee and line management. External auditors may issue findings to executive management and the audit committee. The audit committee is a subcommittee of the board of directors.

ISOs need to make sure they build security policies collaboratively. The key is to create an open and candid conversation on risk. If the discussions on risk are perceived as valuable, executives are more willing to commit their time. This means the ISO needs to hold stakeholders accountable to participate. No one should be able to opt out. Accountability changes once the security policies are implemented. End users are accountable for following policies. The ISO’s central role is to coordinate these activities.