{"text_format":"1","workbook":"xlsx","n_sheets":7,"sheets":["Diagnostic Tool","Macro1","Chart1","Results","CCMM","Likert Scale","Calculations"],"not_rendered":{"charts":3,"images":0,"macros":1,"external_links":0,"defined_names":3,"comments":0,"pivot_tables":0},"unopened":[{"sheet":"Chart1","index":2,"reason":"not_a_worksheet"}],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Diagnostic Tool","index":0,"n_rows":35,"n_cols":11,"rows_kept":35,"cut":false,"hidden":false,"merged":[[0,0,0,3],[3,9,5,9],[6,9,7,9],[9,9,12,9],[3,1,7,1],[3,7,32,7],[28,9,30,9],[31,9,32,9],[18,9,19,9],[28,1,32,1],[23,1,27,1],[18,1,22,1],[13,1,17,1],[8,1,12,1],[3,10,7,10],[8,10,12,10],[13,10,17,10],[18,10,22,10],[23,10,27,10],[28,10,32,10],[16,9,17,9],[13,9,15,9],[23,9,24,9],[20,9,22,9],[25,9,27,9]]}
["Diagnostic Tool for Measurement of Cyber Culture"]
[]
["#","Topic",null,"Question","Rating","Weighting","Value",null,"KAB/AMO Foundation","Theoretical Foundation","Justification"]
[1,"Leadership","Resource Commitment","Leadership allocates sufficient resources (time, budget, people) to manage cybersecurity risks effectively","1 = Strongly Disagree",100,{"$f":"VALUE(LEFT(E4,1))*F4/100","v":1},null,"KAB (Behavior) (Organisational) - Leadership's physical actions in funding security. AMO (Opportunity) - Allocation of budget, time, and people directly provides the resources (opportunity) employees need to act securely.","Schein’s Model of Organizational Culture (Edgar Schein)","Culture is dictated by what leaders fund, measure, and personally model."]
[2,null,"Communication","Leaders regularly communicate about cyber security risks and practices and clearly show it is a priority for achieving our business goals.","1 = Strongly Disagree",100,{"$f":"VALUE(LEFT(E5,1))*F5/100","v":1},null,"KAB (Knowledge) (Attitude) - Regular messaging builds threat awareness and reinforces that cyber safety is an organisational priority.  AMO (Motivation) (Extrinsic) - Transparent communication from leadership creates top-down accountability and a compliance mindset."]
[3,null,"Prioritisation","Senior leaders consistently demonstrate that cybersecurity is a business Board level priority, not just an IT issue","1 = Strongly Disagree",100,1,null,"KAB (Attitude) - Shifting the perception of cyber risk from an isolated IT issue to a core business priority. AMO (Motivation) - Board-level prioritisation establishes institutional urgency and strategic buy-in."]
[4,null,"Role Modelling","Senior leaders visibly demonstrate secure behaviours and follow the same cyber security rules as everyone else.","1 = Strongly Disagree",100,1,null,"KAB (Attitude) (Behavior) - Personnel mirror executive actions, where visible compliance by leaders fosters a positive cultural attitude. AMO (Motivation) - Eliminates double standards, increasing the willingness of staff to follow established rules.","Transformational Leadership Theory (Bass & Avolio)"]
[5,null,"Cyber Risk","Leaders actively challenge and escalate cybersecurity concerns when risks are identified","1 = Strongly Disagree",100,1,null,"KAB (Behavior) - Active escalation and management of security concerns by leaders as a visible governance practice. AMO (Ability) (Opportunity) - Management actively challenging risk provides a structured pathway and support for staff to flag issues."]
[6,"Security as an Enabler","Strategic Enabler"," Overall, cyber security is treated as a strategic enabler that supports the organisation’s mission rather than a separate technical constraint","1 = Strongly Disagree",100,1,null,"KAB (Attitude) - Reframing cybersecurity as a collaborative business partner rather than a technical constraint. AMO (Motivation) - Aligning security with the organisational mission gives staff a reason to protect operations rather than bypass controls.","Socio-Technical Systems (STS) Theory","Compliance requires high perceived usefulness, ease of use, and alignment with business velocity."]
[7,null,"Behaviour","Most staff clearly understand how the cyber security practices followed contribute to the organisation’s overall goals and shared purpose (e.g. supports our core business objectives and success).","1 = Strongly Disagree",100,1,null,"KAB (Knowledge) (Behavior) - Linking day-to-day individual actions directly to broader business objectives and a shared purpose. AMO (Motivation) (Intrinsic) - Staff are internally driven when they comprehend the underlying rationale and value of a control.","Technology Acceptance Model (TAM) ,(Fred Davis)"]
[8,null,"Work Practice Impact ","There is reasonable consideration of how the design and implemention of cyber security controls impact on people’s ways of working and an effort to reduce any negative impact","1 = Strongly Disagree",100,1,null,"KAB (Behavior) - Badly designed workflows trigger negative behaviors, whereas user-centric design promotes compliant habits. AMO (Opportunity) - Constructing controls that respect existing work practices removes systemic friction and provides a seamless path to compliance."]
[9,null,"Safe Adoption","When Staff propose a new digital tool or a more efficient way of working, there is an effective effort from Cyber leadership towards \"safe adoption\" rather than a default \"No\"","1 = Strongly Disagree",100,1,null,"KAB (Attitude) (Behavior) - Shifting IT-business relations from adversarial to collaborative through proactive engagement. AMO (Opportunity) (Motivation) - Actively facilitating safe tech adoption provides secure tools while keeping staff motivated to consult security teams early."]
[10,null,"Cyber Alignment ","Cybersecurity considerations are embedded into business process design from the outset, rather than added as an afterthought or barrier","1 = Strongly Disagree",100,1,null,"KAB (Behavior) - Designing secure processes from inception rather than treating security as an afterthought. AMO (Opportunity) - Embedding security directly into business architecture ensures that executing tasks securely becomes the default operating environment."]
[11,"Psychological Safety","Incident Reporting ","Staff understand how and when to to report a cyber security concern or incident, and are expected to do so","1 = Strongly Disagree",100,1,null,"KAB (Knowledge) (Behavior) - Understanding how and when to report an incident, and executing that report when a threat is spotted. AMO (Ability) (Opportunity) - Clear procedural understanding builds individual capability, while accessible reporting channels provide the physical means to act.","Edmondson’s Psychological Safety (Amy Edmondson)","Mistake disclosure and proactive reporting cannot exist in a punitive or controlling environment."]
[12,null,"Security Response","When security concerns are raised, they are taken seriously and acted upon appropriately","1 = Strongly Disagree",100,1,null,"KAB (Attitude) - Building trust across the workforce that raising a concern is valued and taken seriously. AMO (Motivation) - Responsive feedback loops validate employee actions, sustaining the motivation to keep reporting threats."]
[13,null,"Incident Disclosure","Staff feel safe admitting a cyber security mistake or near miss without fear of negative consequences (mistakes related to cyber security are treated as learning opportunities rather than something to punish).","1 = Strongly Disagree",100,1,null,"KAB (Attitude) (Behavior) - Fostering an environment where feeling safe to admit a mistake dictates whether a breach is reported immediately. AMO (Motivation) - Eliminating punitive consequences removes the fear of retribution, maintaining an open motivation to disclose errors."]
[14,null,"Trust in Intent","Employees are viewed as a \"the human firewall\" to be supported rather then a \"vulnerable link\" to be controlled.","1 = Strongly Disagree",100,1,null,"KAB (Attitude) - Moving from a defensive view of staff as a weak link to an empowered view of staff as a human firewall. AMO (Ability) - Reframing employees as an asset prompts the organisation to invest heavily in training and elevating user capabilities.","\"Just Culture\" Theory"]
[15,null,"Work Impacts ","Staff feel comfortable advising when a specific security policy or configuration impacts their work to such an extent that a \"workaround\" or Shadow IT is considered to get the job done","1 = Strongly Disagree",100,1,null,"KAB (Behavior) - Empowering staff to flag broken policies openly instead of quietly resorting to Shadow IT or dangerous workarounds. AMO (Opportunity) - Open feedback loops allow the organisation to adapt impractical rules, giving staff a functional environment to do their jobs safely."]
[16,"Cyber Rules & Guidelines","Accessibility ","Staff know where to find the organisation’s cyber security policies, standards, and guidelines when needed.","1 = Strongly Disagree",100,1,null,"KAB (Knowledge) - Ensuring all personnel know the exact institutional repositories where security policies reside. AMO (Opportunity) - Providing unhindered, immediate access to documentation gives staff the practical means to verify requirements.","Cognitive Load Theory (Sweller)","Policies must minimise mental friction and establish systemic legitimacy to win a user's cost benefit calculation."]
[17,null,"Ease of Understanding","Cyber security policies and guidelines are written in a way that is easy to understand, and Staff are confident they understand what is required to comply with cyber security policies.","1 = Strongly Disagree",100,1,null,"KAB (Knowledge) - Achieving clear comprehension of policy requirements by stripping away ambiguous jargon. AMO (Ability) - Plain-language guidelines directly improve an individual's intellectual capability to comply with expectations."]
[18,null,"Relevance and Currency","Cyber security rules and guidelines are kept updated to reflect current risks and technologies, and align well and are relevant to the way Staff actually work. ","1 = Strongly Disagree",100,1,null,"KAB (Attitude) - Outdated rules breed cynicism, whereas keeping guidelines aligned with current tech builds professional respect. AMO (Ability) - Ensuring rules mirror modern workflows guarantees that staff possess the literal capability to meet compliance targets.","Rational Choice Theory"]
[19,null,"Balance","Cyber security is appropriately balanced with business objectives, innovation and risk acceptance","1 = Strongly Disagree",100,1,null,"KAB (Attitude) - Gaining employee buy-in by demonstrating that risk management is balanced with innovation and productivity. AMO (Motivation) - Pragmatic, reasonable guidelines maintain high compliance motivation, preventing policy fatigue."]
[20,null,"Consistency","Cyber security rules and expectations are applied consistently across the organisation.","1 = Strongly Disagree",100,1,null,"KAB (Attitude) - Enhancing systemic legitimacy by applying security rules uniformly across all corporate hierarchies. AMO (Motivation) - Standardised enforcement across the organisation prevents resentment and maintains a shared motivation to comply."]
[21,"Social Cyber Norms","Positive Reinforcement","Secure behaviours are recognised or positively reinforced within the organisation.","1 = Strongly Disagree",100,1,null,"KAB (Attitude) - Celebrating secure choices to reinforce a proactive, positive security mindset. AMO (Motivation) - Formal and informal recognition boosts morale and drives the repetition of secure habits.","Cialdini’s Social Proof & Positive Reinforcement (Robert Cialdini)","Peer expectations, regular reinforcement, and visible social proof shape authentic everyday habits."]
[22,null,"Cultural Embedding ","Cyber security guidance and learning (e.g. any  Awareness, Training, Simulated Phishing or Guidance) are integrated into the entire employee lifecycle, beginning at onboarding and reinforced through regular, relevant updates","1 = Strongly Disagree",100,1,null,"KAB (Knowledge) - Utilizing continuous onboarding and regular updates to ensure baseline security awareness is always topped up. AMO (Ability) - Sustained, repeated training programs structurally maintain and scale workforce defense capabilities."]
[23,null,"Social Expectation","There is a clear expectation that cyber security is part of everyone’s responsibility","1 = Strongly Disagree",100,1,null,"KAB (Attitude) - Internalising the collective mindset that cyber safety is a shared responsibility rather than just an IT department task. AMO (Motivation) (Social) - Peer expectations and shared cultural accountability act as a powerful social driver for compliance.","Theory of Planned Behavior (Ajzen)"]
[24,null,"Behaviour Modelling","It is expected and shown by example that cyber security is embedded within work practices. ","1 = Strongly Disagree",100,1,null,"KAB (Behavior) - Demonstrating secure habits through peer example so that protection becomes an organic part of daily routines. AMO (Opportunity) - Observing colleagues model secure behaviors provides an immediate blueprint and social opportunity to replicate those actions."]
[25,null,"Decision Integration","Cyber security is actively considered and discussed in business processes and leadership decision making.","1 = Strongly Disagree",100,1,null,"KAB (Behavior) - Normalising security considerations by making them a standard agenda item in regular business planning and leadership meetings. AMO (Opportunity) - Intertwining security checkpoints with existing business gates provides a structural opportunity to manage risk seamlessly."]
[26,"Embrace Cyber Change","Continuous Improvement","Cyber security in the organisation is continuously improving based on lessons learned and emerging threats.","1 = Strongly Disagree",100,1,null,"KAB (Behavior) - Systematically upgrading security parameters and organisational responses based on post-incident reviews and threat intelligence. AMO (Ability) - Evolving practices based on real-world lessons dynamically enhances the collective capability of the workforce.","Lewin’s Change Model (Unfreeze-Change-Refreeze) (Lewin)","Adapting to new threats requires building user self-efficacy, providing transparent context, and supporting transitions."]
[27,null,"Change Adaptation ","The organisation adopts new cyber technologies and/or work practices in a timely manner, securely and effectively without the need to cling to the old ways.","1 = Strongly Disagree",100,1,null,"KAB (Behavior) - Transitioning away from legacy habits to adopt modern security technologies and agile work practices. AMO (Opportunity) - Implementing modern security tools provides staff with the necessary infrastructure to defend against contemporary threats."]
[28,null,"Agility ","When security changes are introduced, the organisation provides enough support to assist Staff in transitioning to new ways of working ","1 = Strongly Disagree",100,1,null,"KAB (Behavior) - Moving smoothly to new operational frameworks with direct hands-on support. AMO (Ability) (Opportunity) - Active transition support builds technical capability while providing the structural safety buffer needed to adapt safely."]
[29,null,"Rationale","When security changes are introduced, the reasons behind them are clearly explained so Staff understand the benefit to the organization","1 = Strongly Disagree",100,1,null,"KAB (Knowledge) (Attitude) - Articulating the clear business reasons behind upgrades to build operational understanding and defuse resistance. AMO (Motivation) - Transparently explaining benefits gives staff the validation required to stay motivated through a disruptive transition.","Protection Motivation Theory (PMT) (Rogers)"]
[30,null,"Empowerment"," Staff feel empowered to suggest or adopt new ways of working that improve cyber security.","1 = Strongly Disagree",100,1,null,"KAB (Attitude) (Behavior) - Staff feeling personally invested and autonomous enough to suggest or implement safer workflows. AMO (Motivation) (Intrinsic) (Ability) - Autonomous empowerment drives internal motivation, while the confidence to suggest improvements reflects high personal security capability."]
[null,null,null,null,"Total Score",{"$f":"SUM(F4:F33)","v":3000},{"$f":"SUM(G4:G33)","v":30}]
[null,null,null,null,{"$f":"IF(F34=3000, \"Percentages in Row F are Correct\", \"Ensure Row F = 3000\")","v":"Percentages in Row F are Correct"}]

{"sheet":"Macro1","index":1,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":true,"merged":[]}

{"sheet":"Results","index":3,"n_rows":6,"n_cols":12,"rows_kept":6,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Total Score",{"$f":"SUM('Diagnostic Tool'!G34)","v":30}]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,"Cyber Culture Maturity Score"]

{"sheet":"CCMM","index":4,"n_rows":9,"n_cols":6,"rows_kept":9,"cut":false,"hidden":false,"merged":[]}
["Cyber Culture Maturity Model Reference "]
["Category ","Level 1 Ad-Hoc","Level 2 Compliance Focused","Level 3 Promoting Awareness & Behavioural Change","Level 4 Long Term Cultural Change","Level 5 Optimised Culture and Resilience "]
["Label","Basic awareness foundation","Meeting minimum obligations","Reduced human risk","Security embedded into operations","Organisational resilience and measurable value"]
["Description","No formal security awareness program exists. Employees are largely unaware of cyber risks, expectations, or reporting responsibilities. Security communication and leadership support are largely absent.","Program exists primarily to meet audit or compliance requirements; training is often ad hoc or once a year with minimal expectations.  ","The program actively targets behavioural change by focusing on high risk behaviours and ongoing reinforcement. Security messaging becomes continuous and intentional.","Security awareness becomes embedded into organisational culture. Shared beliefs and expectations around security emerge, and cyber security becomes part of everyday decision making. focusing on shared beliefs and attitudes rather than just individual behaviours.","The most advanced level where the program is fully integrated into organisational strategy and shows clear, measurable impact. Security awareness and culture are fully integrated into business strategy. Leadership receives measurable insights linking culture, behaviour, and organisational resilience."]
["Value","Very limited value as the absence of a program creates significant risk and vulnerability to social engineering. High exposure to human related incidents and likely non-compliance with standards. The key potential value is in recognising the gap and creating a starting point for improvement.","Meets minimum compliance requirements and establishes basic program structure. Ensures regulatory obligations are met and establishes a basic structure for future strategic growth, and creating an opportunity to transition toward strategic risk reduction.","Demonstrable reduction in human related risk. Improved employee engagement, increased reporting, and early evidence of safer behaviour. Noticeable improvements in secure daily practices. Establishes foundations for culture change.","Security becomes proactive rather than reactive. Staff seek guidance early, secure behaviours become normalised, and trust between teams improves significantly. Security is integrated into daily decision making, technical controls become more effective.","Security culture becomes a strategic organisational asset. Awareness supports resilience, business priorities, and long term adaptability to evolving threats and regulatory changes. Leadership sees the direct connection between culture and risk reduction; the organisation adapts confidently to new threats."]
["Program Indicators","No formal program in place; security is not discussed or supported by leadership. No structured communications or training.","No strategic plan, limited leadership support, part time ownership and minimal collaboration with other areas of the business.  ","Leadership involvement. A full time program lead, behaviour driven training, messaging and cross department collaboration.  Leadership understands human risk and assigns a dedicated awareness lead.","Strong Executive sponsorship, dedicated team of professionals, annual formal program reviews, security integrated into onboarding and workflows, active champion/advocate networks.","Integrated with business strategy; continuous measurement and optimisation, alignment with standards and frameworks and/or and benchmarking against peers, tailored executive reporting. "]
["People Indicators","Employees are unaware of expectations and rarely demonstrate secure behaviours. Security decisions based on personal judgement. Secure behaviours rarely demonstrated.","Low engagement, employees view training as a requirement. Policies seen as disconnected from daily work, risky shortcuts common","Employees recognise security responsibilities; active reporting of suspicious activity, adoption of secure behaviours at work and home.  Increased phishing and incident reporting. Staff actively engage in discussions. ","Peer to peer reinforcement of secure behaviours, teams proactively seek security advice, open reporting culture, Staff suggest process improvements, sense of shared responsibility, proactive engagement with security teams, open communication about mistakes.","Shared accountability for risk; leaders use insights for strategic input and resource allocation, high Staff confidence and resilience, Staff confidently recognise/respond to threats."]
["Behavioural Analysis","Tracking completion of foundational tasks, such as initial training or policy acknowledgment.  Policy acknowledgements. Number of basic awareness communications. Program ownership assigned.","Percentage of employees completing annual training, number of awareness materials distributed, number of training sessions.  Training completion rates, policy acknowledgement rates. ","Phishing click and report rates, MFA/password manager adoption,  frequency of policy violations, malware incident rates, Secure data handling incidents, lost/stolen device statistics.","Security culture survey results, requests for security engagement/support, number of Staff improvement suggestions, participation in optional security events, feedback regarding security support and policies. Surveys measuring security beliefs and perceptions; number of requests for briefings.","Number of security incidents over time, organisation trust/reputation, time to detect/recover, correlation between behaviour and incidents, security incident trends over time, compliance violation trends, industry benchmark comparisons."]
["Steps to Next Level","Lay groundwork by identifying regulations, assigning responsibility for a program, and creating initial training materials. Identify compliance obligations and standards. Define awareness requirements. Assign program ownership  Create or source foundational training. Communicate baseline expectations. Track completion and acknowledgement activities.","Shift focus to risk, engage leadership for executive support and a strategic role, assign a dedicated owner; and identify top human risks.   Create a formal program charter, define desired secure behaviours, build communication and reinforcement plans.","Shift from individual behaviour to shaping collective attitudes; increase leadership visibility and expand to Champion networks. Simplify policies, integrate awareness into operational activities and improve collaboration across business areas.\n","Strongly align culture with business objectives and strategic functions; deepen leadership engagement with cultural insights.  Develop unified behavioural/cultural dashboards, align metrics with frameworks, standardise culture expectations across business units. Increase business-security engagement. Continue refining communications and reinforcement.","Maintain through continuous refinement, adjusting messaging and measurement as threats and business needs evolve.  Maintain unified dashboards, use insights in Executive decision making to ensure effective resourcing, continuously refine training and communications, monitor emerging risks, sustain cross functional collaboration."]

{"sheet":"Likert Scale","index":5,"n_rows":11,"n_cols":1,"rows_kept":11,"cut":false,"hidden":true,"merged":[]}
["5 = Strongly Agree"]
["4 = Agree"]
["3 = Neutral"]
["2 = Disagree"]
["1 = Strongly Disagree"]
[]
[10]
[25]
[50]
[75]
[100]

{"sheet":"Calculations","index":6,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":true,"merged":[]}
[]
[]
[]
[]
[]
[]
[null,"Embrace Cyber Change",{"$f":"SUM('Diagnostic Tool'!G29:G33)","v":5}]
[null,"Social Cyber Norms",{"$f":"SUM('Diagnostic Tool'!G24:G28)","v":5}]
[null,"Cyber Rules & Guidelines",{"$f":"SUM('Diagnostic Tool'!G19:G23)","v":5}]
[null,"Psychological Safety",{"$f":"SUM('Diagnostic Tool'!G14:G18)","v":5}]
[null,"Security as an Enabler",{"$f":"SUM('Diagnostic Tool'!G9:G13)","v":5}]
[null,"Leadership",{"$f":"SUM('Diagnostic Tool'!G4:G8)","v":5}]