IS responsive culture

To develop a security culture you must consider these points:

• definition of clear objectives and targets
• definition of roles and responsibilities
• providing awareness about the importance of information security and the consequences of incidents and non-compliances
• providing training about how to perform required activities
• measure and analyze performance and provide feedback

For further information, see:

• What are the benefits of security awareness training for organizations? https://advisera.com/27001academy/blog/2019/03/27/what-are-the-benefits-of-security-awareness-training-for-organizations/
• How to perform training & awareness for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/05/19/how-to-perform-training-awareness-for-iso-27001-and-iso-22301/

This material will also help you regarding awareness and training:

• Free Security Awareness Training: https://advisera.com/training/awareness-session/security-awareness-training/ - this is a series of 25 videos that cover various topics related to security.