Many organizations operate in a distributed environment. Organizations are typically divided by lines of business, product, or geography. In a distributed environment, an organization is run by different individuals with different business objectives. Therefore, different parts of an organization can have different views of risk. This diverse set of leaders can delay security policy implementation.

The first challenge is to get senior leadership to agree on a common set of security policies. The second challenge is agreeing on an implementation timeline.

A diverse set of views is not just reflected by leaders. The organization’s general population also harbors a diverse set of views. The workplace has many types of users. Remember that you operate in an existing culture. That culture might not share the principles stated in the security policies. Even in the best of circumstances, it takes time for security policies to change the culture. In the meantime, you must recognize the type of culture and users that exist at the time the security policies are being implemented.

This sometimes means working in a culture that thinks of information security as an afterthought. Users in this environment may do the minimum to get by. You have to educate them on security policies and help them shed bad habits. Security awareness that targets specific habits can help. It’s important that these users and habits be identified early. Plan specific communication events that focus on policy value and awareness training to change existing habits.

Some users think information security is a technology problem, not their problem. They might not object to the rollout of new policies, but they might undermine the policies’ effectiveness by doing the bare minimum. This type of user attitude can best be managed through effective leadership. When a user knows that his or her job responsibilities include implementing security policies, such attitudes begin to change.

Organizational challenges depend on the culture and industry. For example, the financial services industry puts significant resources into implementing security policies. In these organizations, the focus is on how to implement security policies to meet compliance laws and regulations.

Other, less-regulated organizations may question whether they should implement security policies at all. Understanding and overcoming these objections is an important part of obtaining buy-in. The following is a list of organizational challenges you might face when implementing security policies:

• Unclear accountability
• Lack of budget
• Lack of priority
• Tight schedules

Management is ultimately accountable for protecting information. Thus, management has a key role to play in implementing the proper policies. Implementations require management to be accountable for their success. The challenge is when leaders perceive policy implementation as an IT function. Leaders must support the implementation and provide the right message to all their subordinate teams.

Another organizational challenge is a lack of budget. Implementing security policies across the enterprise requires resources and funding. It may be a challenge to obtain funding without management support. The implementation of policies is more than sending out emails and posting a policy on a server. It takes time and funding to create training programs, to brief departments, to train users, and to hold town hall meetings. A town hall meeting is a gathering of teams to make announcements and discuss topics. These types of efforts take time and funding on both the IT and business side. It’s even more challenging when the business is asked to allocate funds from its own budget. Competing for limited funds is always a challenge in an organization. Information security has to compete for organizational priority.

Implementing security policy is no different from any other activity. An organization faces many conflicting priorities. It may face business challenges that drive its priorities. For example, a priority may be to expand customer services. An organization may need to reduce defects in its product line. The key point is that organizations have limited resources. Often, there are more priorities than resources available. The challenge is to avoid security policies becoming low-priority items. Ideally, security policy should be seen as supporting or enabling the business’s highest priorities.

For the implementation of security policies to be effective, it must be taken as a serious organizational commitment. You accomplish this, in part, by avoiding direct conflicts with other priorities. You should time the implementation of security policies so it doesn’t conflict with other events. For example, assume you know over the next three months that a new product will be released. You may want to hold off implementing major security policies until after the product launch. Companies in this situation may not have the bandwidth to deal effectively with both efforts.

Yet you don’t always have the luxury of waiting to implement policies. You may be under a regulatory requirement to meet specific timelines. When you do have flexibility, plan the timing of the implementation to ensure the organization can properly focus on the effort. Even in the best of circumstances, you often face tight implementation schedules. Once an organization has agreed on the content of security policies, the tendency is to implement them quickly, so the organization can move on to other priorities. Tight schedules may also be a byproduct of how well you communicated the benefits. For example, an organization that is facing significant audit findings may view the implementation of security policies as an important step in controlling those risks. This results in significant pressure to implement quickly. It’s important that an implementation plan recognize the time and effort required to reach and train everyone involved in the changes.