For any organization, its employees are its biggest assets. But what happens when your biggest assets turn out to be your greatest threats or liabilities? That is how cybercrime can change the game. In a recent study, it came to light that employee actions account for about 70% of the data breaches that happen. This blog focuses on the first step you need to take as an organization to better prepare your employees to identify and mitigate cyber threats--adopting a top-down approach to IT security.

Being a victim of cyber-attack can prove disastrous for your business as it has the following repercussions.

• Affects your brand image negatively: Business disruption due to downtime or having your important business data including customer and vendor details stolen reflects poorly on your brand.
• It can cause you to lose customers: Your customers may take their business elsewhere as they may not feel safe sharing their Personally Identifiable Information (PII) with you.
• Can cost you quite a bit financially: Data breach makes you liable to follow certain disclosure requirements mandated by the law. These most likely require you to make announcements on popular media, which can prove expensive. Plus, you will also have to invest in positive PR to boost your brand value.
• It makes you vulnerable to lawsuits: You could be sued by customers whose PII has been compromised or stolen.

The organizational mindset needs to change and acknowledge the fact that IT security is not only your IT department, CTO or Managed Service Provider’s (MSP) responsibility. You need to truly believe that IT security is everyone’s business, and that includes everybody working in your company, from the C-level execs to the newly hired intern. Everybody needs to understand the gravity of a cyberattack and its impact. Only then will they take cybersecurity seriously.

Consider enrolling your company in on-going cybersecurity training. It's affordable, lessons are short and cover areas of vulnerability on a varied schedule so everyone is regularly reminded to be aware. Managers can readily identify those in need of more training and adjust their access to sensitive information as appropriate. As a bonus, security policy templates are provided so you can document your good-faith efforts.