Leading cybersecurity organizations: how they can help you drive change and security awareness at work

Cybersecurity is a strategic issue for every company. Beyond deploying technical solutions, the success of a security program depends largely on the buy-in and awareness of all employees. To get there, it is essential to rely on recognized bodies, professional associations and solution providers able to support cybersecurity managers, not only on the technology side but also in change management.

In this article, we introduce the main reference organizations in cybersecurity, and we focus on how they can help you build a security culture within your organization.

Government and institutional bodies

ANSSI (Agence Nationale de la Sécurité des Systèmes d'Information, France's national cybersecurity agency)

• Overview:
  ANSSI is France's national authority for the protection of information systems. It produces guides, frameworks and best practices to help organizations stay secure.
• Contribution to change management:
  • Educational resources: ANSSI's guides and bulletins often include educational sections that explain cyber issues to employees in simple terms.
  • Official frameworks and labels: By relying on ANSSI's recommendations (for example the RGS, France's general security framework, and requirements frameworks), you give your awareness actions legitimacy with management and employees.
  • Public outreach: ANSSI's official communication campaigns are an effective support for organizing internal training and awareness sessions.

ENISA (European Union Agency for Cybersecurity)

• Overview:
  ENISA is the European Union agency dedicated to cybersecurity. It coordinates the efforts of member states, notably to harmonize best practices and raise awareness among organizations.
• Contribution to change management:
  • Accessible reports and studies: ENISA's publications help people become aware of emerging threats, a valuable argument to show teams why adopting good reflexes matters.
  • European-level awareness tools: ENISA takes part in awareness campaigns (for example European Cybersecurity Month) that you can relay to mobilize your employees.
  • Regulatory support: The European directives (NIS, GDPR) promoted by ENISA reinforce the need to comply and to change habits when it comes to data protection.

NIST (National Institute of Standards and Technology)

• Overview:
  NIST is a US body renowned for its cybersecurity standards and frameworks. Its NIST Cybersecurity Framework is adopted worldwide to structure security governance.
• Contribution to change management:
  • A clear reference framework: The NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover) provides simple goals to communicate to teams.
  • Rich documentation: NIST's guides (Special Publications) often include awareness sections and practical advice for building a security culture.
  • International recognition: Using a globally recognized framework makes internal awareness easier and justifies investment in training programs.

Professional organizations and associations

(ISC)²

• Overview:
  (ISC)² is an international association of cybersecurity professionals. It offers the CISSP certification, one of the most recognized in the field.
• Contribution to change management:
  • Training and certifications: By encouraging your employees to train or earn the CISSP, you strengthen their engagement and their understanding of cyber issues.
  • An active community: (ISC)² regularly organizes webinars and events to exchange on best practices for raising employee awareness.
  • Credibility with stakeholders: Relying on a recognized competence standard reassures management and motivates teams to follow a continuing education path.

ISACA

• Overview:
  ISACA is an organization focused on information systems governance and audit, known for its CISM and CISA certifications and its COBIT framework.
• Contribution to change management:
  • Governance tools: ISACA's frameworks and guidelines (COBIT, Risk IT...) provide a structure to frame transformation and involve management.
  • Management and audit focus: Certifications such as CISM or CISA put strong emphasis on management and accountability, essential aspects for raising awareness among every stakeholder.
  • A governance-based approach: A clear governance approach makes it easier to turn cyber objectives into concrete action plans accepted by all employees.

SANS Institute

• Overview:
  The SANS Institute is a world-renowned training and research organization in the field of cybersecurity.
• Contribution to change management:
  • Hands-on training: SANS courses are known for being technical and practical, helping IT teams adopt good security reflexes day to day.
  • Targeted awareness: SANS also offers programs dedicated to raising awareness among all employees (for example phishing simulation, micro-learning).
  • Free resources: The "SANS Top 20 Controls" and other guides can serve as a basis for your internal awareness and self-assessment sessions.

Leading companies and vendors

Antivirus / Endpoint Detection and Response (EDR) vendors

• Examples: Kaspersky, Trend Micro, Symantec, CrowdStrike, etc.
• Contribution to change management:
  • Concrete demonstration of threats: Antivirus and EDR solutions regularly detect attack attempts, which can be used as a practical case to raise team awareness.
  • Continuing education: Some vendors offer educational material (webinars, newsletters) to help companies communicate on best practices.
  • Dashboards and reports: Central administration consoles can produce incident reports to share, creating awareness of how often threats occur.

Security integrators and consulting firms

• Examples: Accenture Security, Deloitte, Wavestone, etc.
• Contribution to change management:
  • An external, objective view: The audits and advice provided by these firms highlight organizational gaps and help prioritize awareness actions.
  • Steering support: They often build roadmaps that include "communication" and "training" components to anchor security in company culture.
  • Industry benchmark: Thanks to their multi-client experience, they identify best practices for awareness and change management suited to your industry.

Conclusion

As a cybersecurity manager, your mission is not limited to deploying technical solutions: you must also involve and raise awareness among all employees to build a real security culture. Government bodies (ANSSI, ENISA, NIST), professional associations ((ISC)², ISACA, SANS Institute) and specialized companies (solution providers, consulting firms) play complementary roles in supporting you through this change management.

• Frameworks and official guides (ANSSI, NIST, ENISA): give legitimacy to your decisions and make it easier to communicate on best practices.
• Training and certifications ((ISC)², ISACA, SANS): strengthen the skills and engagement of your employees, while adding credibility within the company.
• Professional solutions and services (antivirus, EDR, consulting firms): provide concrete tools and strategic support to change mindsets for the long term.

To succeed, bet on a gradual and educational approach, highlighting achievements and showing the positive impact of each step forward in cybersecurity. In short, getting your teams to buy into your cyber approach relies on knowledge, compliance and culture, elements at the heart of the concerns of all these reference organizations.

Key takeaways

• ANSSI, ENISA, NIST: frameworks and awareness resources.
• (ISC)², ISACA, SANS: training and certifications to anchor a cyber culture.
• Solution providers and consulting firms: tools and support to sustain buy-in over time.

By mobilizing these different organizations, you have a complete toolbox to support change in your company and build a work environment where security is everyone's business.