The secret to instilling good behaviours in cyber security and data protection. Start with the why – outline the threat to the organisation, the financial and reputational issues, not to mention the impact it can have on colleagues. Create a narrative that drives a instils of urgency and importance. Clarity about your responsibility – for some people, it may be simply regularly updating passwords; for others, who are managing data or responsible for key information, it’s making them more aware of their everyday responsibility. Champions in the workplace – find the people who can advocate for cyber security and data protection, whether as experts or as supporters. They will encourage others to take the right action and follow the right behaviours. Nudge the behaviour – it’s always important to provide nudges to ensure the right behaviour, whether regular reminders or within a particular context (for example, stickers on your laptop or warnings within data-sets). Have a crisis communications plan – align your crisis comms to your recovery plans, ensuring timely and appropriate communications if the worst does happen.