Every single organization has a cultural attitude concerning security and risks with a plan or on an ad-hoc basis. A positive security culture is crucial to improving your organization’s staff security.
Some organizations encourage secure working, while others do not. It is not sufficient for an organization simply to state that it takes security seriously and has policies and procedures in place if the organization’s culture does not engender a positive approach to security.
All staff within the organization need to understand and demonstrate the organization’s security norms in how they go about their activities on a day-to-day basis.