Security disconnected from the organization's purpose feels like bureaucratic overhead to the people asked to follow it. Connecting it to the mission — what you're actually protecting and why — gives the work a meaning that drives genuine diligence.
“People protect a mission harder than they follow a policy.”