Managing Information Security Risk: Organization, Mission, and Information System View
Appendix G describes several trust models that can be applied in an organizational context, and > 2.7 ORGANIZATIONAL CULTURE

2.7 ORGANIZATIONAL CULTURE

Organizational culture refers to the values, beliefs, and norms that influence the behaviors and
actions of the senior leaders/executives and individual members of organizations. Culture
describes the way things are done in organizations and can explain why certain things occur.
There is a direct relationship between organizational culture and how organizations respond to
uncertainties and the potential for near-term benefits to be the source for longer-term losses. The
organization's culture informs and even, to perhaps a large degree, defines that organization's
risk management strategy. At a minimum, when an expressed risk management strategy is not
consistent with that organization's culture, then it is likely that the strategy will be difficult if not
impossible to implement. Recognizing and addressing the significant influence culture has on
risk-related decisions of senior leaders/executives within organizations can therefore, be key to
achieving effective management of risk.
Recognizing the impact from organizational culture on the implementation of an organization-
wide risk management program is important as this can reflect a major organizational change.
This change must be effectively managed and understanding the culture of an organization plays
an important part in achieving such organization-wide change. Implementing an effective risk
management program may well represent a significant organization-wide change aligning the
people, processes, and culture within the organization with the new or revised organizational
goals and objectives, the risk management strategy, and communication mechanisms for sharing
risk-related information among entities. To effectively manage such change, organizations
include cultural considerations as a fundamental component in their strategic-level thinking and
decision-making processes (e.g., developing the risk management strategy). If the senior
leaders/executives understand the importance of culture, they have a better chance of achieving
the organization's strategic goals and objectives by successfully managing risk.
Culture also impacts the degree of risk being incurred. Culture is reflected in an organization's
willingness to adopt new and leading edge information technologies. For example, organizations
that are engaged in research and development activities may be more likely to push technological
boundaries. Such organizations are more prone to be early adopters of new technologies and
therefore, more likely to view the new technologies from the standpoint of the potential benefits
achieved versus potential harm from use. In contrast, organizations that are engaged in security-
related activities may be more conservative by nature and less likely to push technological
boundaries-being more suspicious of the new technologies, especially if provided by some
entity with which the organization lacks familiarity and trust. These types of organizations are
also less likely to be early adopters of new technologies and would be more inclined to look at the
potential harm caused by the adoption of the new technologies. Another example is that some
organizations have a history of developing proprietary software applications and services, or
procuring software applications and services solely for their use. These organizations may be
reluctant to use externally-provided software applications and services and this reluctance may
result in lower risk being incurred. Other organizations may, on the other hand, seek to maximize
advantages achieved by modern net-centric architectures (e.g., service-oriented architectures,
cloud computing), where hardware, software, and services are typically provided by external
organizations. Since organizations typically do not have direct control over assessment, auditing,
and oversight activities of external providers, a greater risk might be incurred.
In addition to the cultural impacts on organizational risk management perspectives, there can also
be cultural issues between organizations. Where two or more organizations are operating together
toward a common purpose, there is a possibility that cultural differences in each of the respective
organizations may result in different risk management strategies, propensity to incur risk, and
willingness to accept risk.58 For example, assume two organizations are working together to
create a common security service intended to address the advanced persistent threat. The culture
of one of the organizations may result in a focus on preventing unauthorized disclosure of
information, while the nature of the other organization may result in an emphasis on mission
continuity. The differences in focus and emphasis resulting from organizational culture can
generate different priorities and expectations regarding what security services to procure, because
the organizations perceive the nature of the threat differently. Such culture-related disconnects do
not occur solely between organizations but can also occur within organizations, where different
organizational components (e.g., information technology components, operational components)
have different values and perhaps risk tolerances. An example of an internal disconnect can be
observed in a hospital that emphasizes different cultures between protecting the personal privacy
of patients and the availability of medical information to medical professionals for treatment
purposes.
Culture both shapes and is shaped by the people within organizations. Cultural influences and
impacts can be felt across all three tiers in the multitiered risk management approach. Senior
leaders/executives both directly and indirectly in Tier 1 governance structures set the stage for
how organizations respond to various approaches to managing risk. Senior leaders/executives
establish the risk tolerance for organizations both formally (e.g., through publication of strategy
and guidance documents) and informally (e.g., through actions that get rewarded and penalized,
the degree of consistency in actions, and the degree of accountability enforced). The direction set
by senior leaders/executives and the understanding of existing organizational values and priorities
are major factors determining how risk is managed within organizations.