The organization's culture may impact security practices and execution. The term culture may be quite vague, but generally speaking, there are two kinds of security culture. One is the strict process type, and the other is empowering the team. In the strict process, there is almost no room for flexibility. Once the expected security baselines are defined, they are all compulsory. Detailed security checklists are defined for every project to follow. No violation is allowed. On the other hand, the empowering the team type means the organization only defines general security guidelines, while project teams may define their own security checklists based on project needs.
A strict-process culture fits an environment that requires high-level controls, such as the military or banking. There are defined Standard Operating Procedures (SOPs) and checklists for every...