Security Security Culture

---
name: security-security-culture
description: Design a security culture program — awareness maturity, a security champions program, gamification and incentives, and behavior metrics such as phishing click and reporting rates. Use when security is seen as a blocker, staff rarely report problems, or the user wants security champions in teams. Not for the training curriculum itself; see /security-security-training.
metadata:
  argument-hint: "[project] [--skip-checks]"
  workflow: security
  phase: 0
  artifact: 00-govern.md
---

# Security Culture

Design a security awareness program and culture-building initiatives for "$ARGUMENTS". Build a human-centric security program that goes beyond compliance checkboxes to create lasting behavioral change.

**Arguments.** `$ARGUMENTS` may contain the project name and optional flags. Take the first token as `<project>` and treat `--skip-checks` as a flag; never include flags in file paths. All paths below use `<project>`. If `--skip-checks` is present, skip the prerequisite check and, **before writing any artifact**, append one line to `.singularskills/log.jsonl`: `{"ts":"<ISO timestamp>","skill":"security-security-culture","workflow":"security","phase":0,"project":"<project>","event":"skipped","artifact":"00-govern.md","note":"<reason or \"none given\">"}`.

## Prerequisites

**Part of a workflow.** This skill is phase 0 (Govern) of the NIST CSF workflow (`security`); cross-domain workflows run it too. First check `.singularskills/log.jsonl` for an open run for this project: a `run-started` line with `"project":"<project>"` and no later `run-finished` line for the same `workflow` and `project`. If one exists, the conductor is running you: continue here. Otherwise, if the user asked to start, run, continue or resume a process or workflow rather than this one step, do not continue here: invoke the `workflow` skill with the workflow the user asked for, or `security` when they named none, followed by `<project>`; it runs this phase in order, asks before it writes and records the run. Otherwise, unless the user named this skill, ask one question, since this is the first phase of its workflow: "Just this step, or the whole NIST CSF workflow?" End your turn and wait; on the whole workflow, hand off the same way; on just this step, continue here.

**Recall.** Before you ask the user anything, look for what this repository already holds about `<project>`: if a tool is available whose description says it searches or maps this repository (a memory or repo-map server such as `repo_map` or `entities`), query it for `<project>` and this phase's subject and read what it returns, keeping only results from this repository; in every case also list `.singularskills/*/<project>/` and read the **Decisions** and **Open questions** of any artifact there, and the lines of `.singularskills/log.jsonl` whose `project` is `<project>`. After your section's italic line, add a `### Recalled` subsection of at most ten lines naming what you found and where (path or tool), or the single line `Nothing recalled: no earlier artifacts, log lines or memory results for <project>.` Ask the user only what this did not answer. The trail's shape is described in `references/memory/trail.md`, bundled with this skill.

Before you start work, append this line to `.singularskills/log.jsonl` (create the folder and file if missing): `{"ts":"<ISO timestamp>","skill":"security-security-culture","workflow":"security","phase":0,"project":"<project>","event":"started","artifact":"00-govern.md","note":""}`.

None — this is a Phase 0 Govern skill.

## Process

1. **Assess current security awareness level:**
   - Evaluate existing training programs, completion rates, and effectiveness
   - Review recent security incident data for human-factor trends (phishing clicks, credential sharing, data mishandling)
   - Identify the organization's security maturity stage: reactive, compliant, proactive, or embedded
   - Note cultural factors: is security seen as a blocker or an enabler?

2. **Outline the training approach (themes per audience):**
   - **All staff** — phishing awareness, password hygiene, social engineering recognition, clean desk policy, reporting procedures
   - **Developers** — secure coding practices (OWASP Top 10), dependency management, secrets handling, code review for security
   - **IT / Operations** — secure configuration, patch management, access provisioning, logging and monitoring
   - **Leadership** — risk governance, security investment decisions, regulatory obligations, incident communication
   - **New hires** — security onboarding module covering policies, tools, and expectations
   - Define delivery methods: interactive e-learning, live workshops, lunch-and-learns, hands-on labs
   - Keep this to the culture-level outline — hand off the full module catalog, cadence, completion tracking and assessments to `/security-security-training`

3. **Plan security champions program:**
   - Define champion selection criteria (interest, influence, technical aptitude)
   - Establish champion-to-team ratio (recommend 1 champion per 8-10 developers)
   - Define champion responsibilities: security review participation, team coaching, vulnerability triage, threat model facilitation
   - Create champion development path: training curriculum, certification support, community of practice
   - Plan regular champion meetups for knowledge sharing and escalation

4. **Define gamification and incentives:**
   - **Recognition programs** — security hero of the month, bug bounty leaderboard, responsible disclosure acknowledgments
   - **Competitions** — capture-the-flag events, phishing simulation contests, secure coding challenges
   - **Career incentives** — security certifications as professional development, champion role on performance reviews
   - **Team metrics** — security scorecard per team (vulnerability fix rate, training completion, incident response time)
   - Ensure incentives reward reporting, not just prevention (avoid blame culture)

5. **Set measurement criteria:**
   - **Phishing simulation results** — click rate trend over time (target: <5% click rate)
   - **Training completion rates** — percentage of staff completing required modules on time (target: >95%)
   - **Incident reporting rates** — number of security concerns reported by staff (higher is better; indicates trust)
   - **Time to report** — average time between suspicious activity and report submission
   - **Security champion engagement** — champion activity metrics (reviews conducted, issues raised, training delivered)
   - Define reporting cadence and dashboard requirements

6. **Write the artifact** — append to `.singularskills/security/<project>/00-govern.md` under a `## Security Culture` section. Create the file with a `# Govern — <project>` heading if it does not exist; if a `## Security Culture` section already exists, replace only that section. The section contains:

   ### Security Culture Program

   Include sections:
   - **Current State Assessment** — awareness maturity and key gaps
   - **Training Approach** — themes, cadence and audiences; the role-based curriculum is produced by `/security-security-training`
   - **Security Champions Program** — structure, responsibilities, and development path
   - **Gamification & Incentives** — recognition, competitions, and career incentives
   - **Measurement Framework** — KPIs, targets, and reporting cadence

## Output

The security culture program appended to `.singularskills/security/<project>/00-govern.md`. Present a summary to the user highlighting:
- Current awareness maturity assessment
- Training approach — themes, cadence and audiences (curriculum via `/security-security-training`)
- Security champions program structure
- Key metrics and measurement targets

**Record the run.** After you have written your section, append this line to `.singularskills/log.jsonl` (the `started` line of Prerequisites, with `"event":"finished"`): `{"ts":"<ISO timestamp>","skill":"security-security-culture","workflow":"security","phase":0,"project":"<project>","event":"finished","artifact":"00-govern.md","note":""}`.

This artifact is shared by every skill of phase 0 (Govern). The frontmatter is written once, by whoever creates the file: if you create it, open it with the block below (`skill` is the phase title, `started` the time of that first write; `gate` is `none`, as this phase has no gate); if it already exists, leave the block alone except to update `finished`.

```yaml
---
skill: Govern
workflow: security
phase: 0
project: <project>
started: <ISO timestamp>
finished: <ISO timestamp>
agent: <the agent you run in, or "unknown">
gate: none
---
```

Open your `## Security Culture` section with one italic line, `*<skill name> · <ISO timestamp> · gate: none*` (your skill name is `security-security-culture`).

End your section with `### Decisions` and `### Open questions` (one level under your `## Security Culture` heading, so the section stays one block), in this shape:

```markdown
### Decisions
- <what was chosen> — <why> — <what was rejected>

### Open questions
- <what the next phase or a reviewer must settle>
```

End the artifact with this paragraph, verbatim:

> **Not a penetration test or audit.** This artifact is generated analysis; validate findings against the live system and have material controls reviewed by a qualified security professional.