Cyber Culture Metrics: Actionable Tool from AUSCERT

Understanding and measuring cyber culture enables organisations to reduce human risk, improve security outcomes, and foster a culture of resilience.

The AUSCERT Cyber Leaders Network Cyber Culture Metrics Working Group have developed a practical tool for organisations to assess the maturity of their cyber security culture, benchmark performance, and prioritise improvements that reduce human cyber risk.

The Cyber Culture Maturity Model (CCMM) measurement instrument provides a:

1. Diagnostic Tool (6 dimensions aligned with NCSC Iceberg model, 5 questions each)
2. Linkage to Theoretical Foundation
3. Cyber Culture Measurement Score
4. CCMM Reference for Improvements

The tool is freely available for download:

AUSCERT – CLN – Cyber Culture Maturity Model Instrument Macro (Excel)

Tim Lane (CISO, TURSA) unveiled this tool in his presentation at the AUSCERT2026 Conference in May 2026. The presentation recording is available below.

Download a copy of Tim’s presentation slides here: AUSCERT – CLN – Cyber Culture Metrics

These resources were developed by the Cyber Leaders Network’s Cyber Culture Metrics working group.

The Cyber Leaders Network brings together cyber security professionals from across industries to collaborate, share best practices, and exchange insights on emerging challenges. Coordinated by AUSCERT, the Network provides a trusted forum for leaders to collectively strengthen Australia’s cyber resilience.

All resources are shared under a Creative Commons Attribution 4.0 International License (CC BY 4.0), allowing you to share and adapt the material with appropriate credit to the AUSCERT Cyber Leaders Network.