Chapter 7 — Human factors and cyber policy: organizational integration
Lesson map
Lesson 07 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Cross-department links"]
N2["7.2 Framework alignment"]
N3["7.3 Managing change"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Cross-department links"]
N2["7.2 Framework alignment"]
N3["7.3 Managing change"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]
[Learning outcomes]
|
v
[7.1 Cross-department links]
|
v
[7.2 Framework alignment]
|
v
[7.3 Managing change]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) integrate the programme with HR, finance and incident response; (2) align with governance frameworks; (3) manage change across departments.
7.1 Cross-department links
Daniel integrates the programme with other functions at Calloway. HR adds security expectations to induction and agrees that simulation data stay out of performance processes. Finance adopts the payment verification control, with holds on bank detail changes and callbacks using known numbers. Incident response receives reports automatically and credits first reporters in its summaries. Each link turns the programme from a security team project into part of how Calloway works, which makes it more durable and less dependent on a few enthusiasts.
7.2 Framework alignment
Daniel maps the programme to the Govern function of NIST CSF 2.0, which covers roles, responsibilities, policy and oversight, and to ISO/IEC 27001:2022 requirements for awareness and competence. He shows the risk committee how each element supplies evidence for audits. He is careful not to let frameworks define success; they describe structures, while outcomes such as faster reporting and fewer frauds show whether the programme works. Alignment reduces duplicated effort when auditors and regulators request evidence. Auditors welcome the mapping. The committee agrees.
7.3 Managing change
Daniel uses a simple change plan for each department: explain why, involve local champions, pilot with one team, adjust and then extend. Finance initially resists the verification control because it slows payments at month-end. He works with them to schedule a second officer at month-end and to pre-verify regular suppliers. Resistance often signals a real cost, and addressing that cost wins support more effectively than insisting on compliance. By month nine, all three departments have adopted their parts of the programme.
Worked example
Daniel links the programme to HR, finance and incident response, maps it to CSF 2.0 Govern and ISO/IEC 27001 and manages finance resistance by addressing month-end costs.
Synthetic case. Integration is synthetic; NIST CSF 2.0 and ISO/IEC 27001:2022 are real.
Errors and limits
Integration takes time. Framework mapping can become paperwork.
Exercises
- EX031 — HR agreement. What did HR agree about simulation data? Rubric: 3 = it stays out of performance processes;; 2 = separation;; 1 = vague;; 0 = none.
- EX032 — Govern scope. What does the CSF 2.0 Govern function cover? Rubric: 3 = roles, responsibilities, policy and oversight;; 2 = governance;; 1 = detection;; 0 = none.
- EX033 — Framework role. What role should frameworks play? Rubric: 3 = describe structures, not define success;; 2 = structure;; 1 = outcomes;; 0 = none.
- EX034 — Finance resistance. Why did finance resist the verification control? Rubric: 3 = it slowed month-end payments;; 2 = month-end;; 1 = vague;; 0 = none.
- EX035 — Resistance lesson. What does resistance often signal? Rubric: 3 = a real cost;; 2 = cost;; 1 = stubbornness;; 0 = none.
Synthesis
Integration embeds the programme in other functions and treats resistance as information.
Continue studying — chapter 07 of 12
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →