Making security a routine

Security is not decided on the day of the incident, but in the weeks before it. Organisations that keep it under control do not have more rules than others. They have short routines, teams that understand why the rules exist, and a climate where people report a mistake instead of hiding it.

• Every month: review of the audit log, fifteen minutes, with a record kept.
• Every quarter: review of the assistants’ tools and restrictions, and of the members of each confidential project.
• Every year: review of the classification, the acceptable use policy and the impact assessments.
• With every new arrival: the Academy’s getting-started path and the acceptable use policy.

Schedule these reviews in “Automations”, so that a reminder arrives at the right moment with the list of points to check. A routine that depends on someone’s memory always ends up being skipped.

A mistake reported within the hour can be fixed in a few minutes. The same mistake discovered a month later may require a notification to the authority. The deciding factor is the psychological safety described by Amy Edmondson: people report their mistakes when they know they will not be blamed for doing so.

1. Thank people for every report, even a false alarm.
2. Tell the story of incidents and what they taught, without naming anyone to blame.
3. Fix the setting or the rule that allowed the mistake, rather than the person.