Information security culture is a foundational element for a successful implementation of an information security program. An information security culture is not explicitly required by information security frameworks, yet it is an integral part of the formula. Cultural development and evolution is difficult to quantify and measure, although it is not impossible. Through various mechanisms such as employee engagement, security awareness and training, and gamification, it is possible not only to develop but also to evolve an information security culture, no matter what framework the information security program was built upon. By James Brosnan, MBA, CISM