Security culture is the way people (colleagues) think, behave, and work. When seeking to develop a culture of security, it traditionally means integrating individual responsibility for protecting systems and information into the expected course of behavior. In addition to the challenge of figuring out how to transform the culture to include security is the slightly-easier need to measure it. It not only serves to form the baseline, but done properly, reveals the pathway to systematically introduce the elements people are ready for (or need) that produce the best value for individuals and the organization.”]