Eleven agencies. Eleven different ways in. Built to get people acting, not just aware.
One department, eleven agencies and business units - each with its own culture, its own people, and its own way of taking in a message.
Sam Mackay, the department's CISO, wanted a program that would change what people actually did, not just what they knew, and he needed evidence it was working.
Reaching eleven very different agencies and business units, without flattening them into one generic campaign. The right messengers inside each one - the people staff already trusted, and a measurement approach that could stand up to government reporting, tracking behaviour rather than awareness.
The conviction was Sam's: cybersecurity behaviour does not change because someone sends an email. It changes when the right message reaches the right person, through the right channel, from someone they already trust. He could see that one uniform approach, pushed out the same way to everyone, wasn't landing across a department as varied as his.
So we worked with him to build it differently: a single campaign could not reach all of them, so we did not build one. Each part of the department got its own engagement playbook, built around its specific people, its internal influencers, and the channels its teams already used. Not eleven versions of the same document - eleven genuinely different approaches, each grounded in the make-up of that part of the department.
Together, this became LAND - the department's cybersecurity engagement program.
Eleven agencies and business units, each reached through the people its staff already trusted - the Business Information Security Officer (BISO) inside each one, equipped to craft messages that would actually land. The program was built to get staff acting, not just aware, and one the department's own leaders could run themselves after handover.
The eleven playbooks and the measurement framework live inside LAND - a working program the department reviews, updates and actions on an ongoing basis, part by part. Not a document that lands once and gathers dust.
Eleven tailored playbooks, one per agency, each built around its specific people, its internal influencers and the channels its teams already used.
The right message reaching people through the person they already trusted: the BISO inside each agency and business unit, equipped to craft and deliver messages that landed with their own teams - not one generic broadcast from the CISO's office trying to move everyone at once.
Built to government reporting standard, it tracks behaviour and action rather than awareness - so leaders could see the work landing.
“When you can actually see the work your department and the agencies within it are delivering, you can know you're making a difference.”
Sam MackayCISO, NSW Department of Customer Service