Human-Centered Security

Security-Awareness

People and processes are the foundation of cybersecurity. While technology provides tools, it's your team and policies that determine whether your organization can defend against evolving threats.

Explore the 7 Pillars Implementation Guide

Why People & Process Matter

90% of cyberattacks start with human error. No firewall or antivirus can protect against an employee who clicks a phishing link, uses weak passwords, or mishandles sensitive data.

People & Process focuses on building security awareness, establishing clear policies, ensuring regulatory compliance, and creating a culture where security is everyone's responsibility.

Key Principle: Security is a shared responsibility.

The 7 Pillars of People & Process Security

Training, policies, and continuous improvement

1. Security Awareness Training

Continuous education programs that teach employees to recognize and respond to cybersecurity threats.

Phishing simulations
Social engineering awareness
Password security best practices
Quarterly refresher courses

2. Security Policies & Procedures

Documented standards that define acceptable use, data handling, and security responsibilities.

Acceptable Use Policy (AUP)
Data classification policy
Incident response procedures
Remote work security policy

3. Access Control & Identity Management

Processes ensuring only authorized individuals can access sensitive systems and data.

Role-based access control (RBAC)
Principle of least privilege
Regular access reviews
Offboarding procedures

4. Incident Response & Management

Structured approach to detecting, responding to, and recovering from security incidents.

Incident response team (IRT)
Incident classification procedures
Communication protocols
Post-incident reviews

5. Compliance & Regulatory Requirements

Meeting legal and industry standards for data protection, privacy, and security.

GDPR compliance
HIPAA requirements
PCI DSS standards
SOC 2 certification

6. Third-Party & Vendor Management

Evaluating and monitoring external partners to ensure they meet your security standards.

Vendor risk assessments
Security questionnaires
Data processing agreements
Ongoing monitoring

7. Security Culture & Leadership

Top-down commitment to security that makes it part of organizational DNA.

Executive sponsorship
Security champions program
Recognition and rewards
Open reporting culture

Implementation Roadmap

A practical, phased approach to building a security-aware organization

Phase 1: Foundation (First 30 Days)

Security Awareness Kickoff

Launch mandatory security training for all employees covering phishing, passwords, and data handling
Policy Documentation

Create or update core security policies: AUP, data classification, and password policy
Incident Response Plan

Establish basic incident response procedures and designate response team members
Access Control Review

Audit current access permissions and implement principle of least privilege

Phase 2: Building Momentum (First 90 Days)

Phishing Simulation Program

Deploy monthly simulated phishing campaigns to test and improve awareness
Compliance Gap Assessment

Evaluate current state against GDPR, HIPAA, or other applicable regulations
Vendor Security Reviews

Assess security practices of critical third-party vendors and partners
Security Champions Network

Identify and train security advocates across different departments

Ongoing: Continuous Improvement

Quarterly Activities

• Security awareness training refreshers
• Policy review and updates
• Access permission audits
• Incident response drills

Metrics & Reporting

• Training completion rates
• Phishing simulation click rates
• Incident response times
• Policy acknowledgment tracking

Recognition Programs

• Security awareness awards
• Reporting recognition
• Department security scores
• Gamification leaderboards

Key Compliance Frameworks

Understanding people and process requirements across major regulations

GDPR (EU Data Protection)

Comprehensive data protection regulation requiring appropriate technical and organizational measures

People & Process Requirements:

✓ Data Protection Officer (DPO) appointment
✓ Staff awareness and training programs
✓ Data breach notification procedures (72 hours)
✓ Privacy by Design principles
✓ Data Processing Impact Assessments (DPIAs)
✓ Records of Processing Activities (RoPA)

Penalties: Up to €20 million or 4% of annual global turnover

HIPAA (Healthcare)

Security Rule establishing standards for protecting electronic protected health information (ePHI)

Administrative Safeguards:

✓ Security management process
✓ Assigned security responsibility
✓ Workforce security training
✓ Information access management
✓ Security incident procedures
✓ Contingency planning
✓ Business associate agreements

Requires documented policies and 6-year retention

PCI DSS (Payment Cards)

Security standards for organizations handling credit card data

People & Process Requirements:

✓ Security awareness training program
✓ Acceptable use policies
✓ Incident response plan
✓ Vendor management program
✓ Annual security training
✓ Security testing procedures

ISO 27001 (ISMS)

International standard for information security management systems

Core Human Elements:

✓ Information security policies
✓ Organization of security roles
✓ HR security (hiring to termination)
✓ Asset management procedures
✓ Access control policies
✓ Compliance management