The cyber security culture of an organization influences everything, from insider threat activities to configuration of technical controls. We analyze the cyber security culture of your organization, based on a unique framework, so that you can continue to follow and improve your culture. This scan forms a basis for the maturity of your security culture, whereby it is determined where your security awareness program succeeds, where the success of your program is blocked and what the main causes of those blockers are. We provide recommendations and propose tailor-made statistics to enable the development and monitoring of cultural changes in the future.

Research

objectives The survey objectives simply indicate what you want to know and from whom do you want to know that information. If you have answered these two questions, you will be directed to the questions: “Is survey the correct method to use?” And “What type of survey should be conducted?” In other words, the objectives of the survey are your guide to creating the right questions to use the right distribution technique or survey method and the right people to take as respondents.

Sampling

Usually the number of people who are part of the target population exceeds your ability to include them all in the survey. For this reason, the sampling process is performed before a survey is conducted. A sample is a group that is taken as respondents to represent a larger target population.

Survey method

There are different types of surveys that are categorized based on the duration, the instrumentation (paper and digital or interview) and the specific method (online, telephone, e-mail, etc.). When choosing a survey method, go back to your survey goals and ask yourself which method can achieve your goals.

Design questionnaire

The survey or questionnaire contains a series of questions that you want to ask the respondents. The design of the questionnaire depends on the medium that corresponds to the type of survey you have selected. For example, it is inappropriate to interview people aged 65 and over via the Internet. Photos cannot be displayed during telephone interviews. In addition, the questionnaire must follow the KISS principle, which stands for “Keep It Short and Simple”.

Pilot Survey 

Testing the questionnaire is a good practice because it will facilitate the correction of any errors in the questions or even in the layout. A pilot survey usually comprises a smaller group of respondents than your sample size.

Review of the survey

The results of the pilot survey are crucial to know whether the questionnaire is already complete and appropriate, or whether there are questions that need to be edited, revised or deleted. This step can also include reviewing the layout of the questionnaire to improve the response.

Perform

survey This step includes the actual administration of the survey to all respondents in the sample. As far as possible, ensure that all respondents answer the questionnaire in the same environment to prevent bias.

Analyzing data

Before you can analyze the data you must ask yourself whether the number of respondents is sufficient to draw a conclusion. If that is not the case, it usually helps to send a reminder. 

Communicate the results

Now that all data has been analyzed and conclusions can be made you can communicate the results. Remember that transparent communication of the results to employees can help with the will to conduct surveys and it will help with security awareness immediately.