I recently had the opportunity to sit down with Lori Kevin, VP of Security and Compliance at IMO Health, for another installment of the Strategic CISOs conversations series. 

We covered a topic that many security leaders care about right now: how to build a security culture where people understand, engage with, and apply security principles in their own departments to improve business performance. 

We talked about the core values of a strong security culture, lessons of leadership, and team development. She described her experience and success in developing a cross-functional security champions program, as well as her growth in communicating risk to executive leadership. 

Here are five key lessons you can apply to how your security team operates. 

1. Start with trust

One of the strongest themes in the conversation was that security culture has to start with trust. Lori described her core values for a strong security culture: trust, accessibility, clarity, transparency, and intentional communication. I think that framing is important. Usually, security culture is reduced to training programs or policy enforcement. But if people only experience security as rules and reminders, culture never really takes hold.