How should you use it?
Each component allows you to better understand a different aspect of your organisation’s security culture. You can run any combination of survey(s) or workshop in any order, but certain options and orders may be more effective depending on what you want to get out of them and the organisational data you may already have available to you.
Tip: NPSA guidance in the Resources section of Tool’s web platform provides a more in-depth overview of the benefits and limitations of each survey.
Below is a more in-depth description of each component of the Tool:
The Cultural Style Workshop is an interactive, vision-setting session designed for your organisation’s leadership. Using our in-depth facilitator guide and simple web platform, walk your senior leaders through the process of exploring and aligning on your organisation’s current and desired styles of security culture. Secure their sponsorship and support as you set out to improve your security culture.
The remaining three components of the tool are individual workforce surveys that will help you to understand different aspects of your organisation’s security culture. You can customise each of these surveys to include bespoke questions and collect key demographic information that will help you to structure and analyse your survey responses.
The Security Behaviours Survey helps you to build an understanding of the relevant security behaviours that are a priority for your organisation. The tool allows you to select relevant security behaviours questions from a predefined list, alongside adding custom questions to ensure the survey relates to your current priorities.
The Personal Attitudes and Skills Survey allows you to assess your workforce’s awareness of the threats faced by your organisation, alongside their knowledge of expected practices and how motivated they are to behave securely. Baselining how well security threats are understood across your workforce, and how motivated they are to act, can help you decide whether and where to invest further resource in education, awareness, or incentivisation.
The Organisational Influences Survey helps you to measure your workforce’s perceptions of how well security is managed within your organisation. The survey provides you with an overview of how well your organisation uses different ‘levers’ – such as incentives, policies and processes, and management commitment – to instil good security practice/behaviours. It also helps you to understand how satisfied your workforce are with your security initiatives.
The results from any component of the tool are then presented to you in an interactive dashboard that can be used to interrogate your workforce data, identify trends, and target areas for improvement.
Tool Development and Feedback
This is a newly developed tool, which will continue to evolve as we develop new functionalities and resources. In late 2025 we are aiming to launch a new ‘interventions’ functionality that will take the outputs from any combination of survey(s) and/or workshop, and generate a prioritised list of the types of intervention that can help you to form the basis of a strategy to improve your security culture.
As the tool continues to develop we would welcome your feedback on what works well, any other functions that would be useful, and how we could improve the user journey.
Security Culture Case Study 1
Organisation – Nuclear Restoration Services (NRS) Dounreay
What was Security Culture like in your organisation prior to using the Tool?
Dounreay has always performed quite well with Security Culture. We have had good security staff driving forward physical, personnel and cyber disciplines, understanding Security Culture and organising security awareness campaigns. Dounreay has always embraced NPSA for the value it adds to the overall security of our site.
We define Security Culture as “a way of life for all staff, contractors and visitors to our site”. Alongside the physical security apparatus, our culture is the lifeblood that keeps our site safe, secure and compliant with regulations.
Why did you use the tool and what were your experiences of using it?
Dounreay had used NPSA’s SeCuRE 4 tool in the past, so using the new Security Culture Tool and being involved in the pilot was a natural step. We also wished to understand our culture further following our transfer to Nuclear Restoration Services, plus recent industrial action at the site. The ability to measure our people, processes, tools and our likelihood of doing the right thing and acting as required, in a safety or security-related time of need, is crucial in identifying our strengths and weaknesses.
Dounreay opted to pilot two of the Tool’s workforce surveys: Security Behaviours and Organisational Influences, in addition to the Cultural Style workshop which was attended by our senior management. Support from senior managers, including our new Managing Director, who has an interest in Security, was crucial in moving the pilot forward.
The tool itself is very intuitive. Once registration was completed, following NPSA’s guidance enabled us to set up the surveys and include demographics and bespoke questions with ease.
What are your next steps and do you have any advice for organisations considering using the tool?
NPSA is currently providing some support to us by way of helping us think through the most impactful types of intervention that could help address some of our areas of concern. [NPSA note: This is a planned feature that will be released as part of a future update to the Security Culture Tool.] Early indications are that our culture is good; results will be analysed further over the coming weeks.
The Security Culture Tool is part of a toolset for supporting the Insider Threat Mitigation Programme at NRS Dounreay. It will become the benchmark for annual Security Culture assessments at Dounreay and we will use these initial surveys as baselines for further work, highlighting issues and publicising our successes. The results will also show where we can add value within the Nuclear Decommissioning Authority Group and wider Nuclear Restoration Service corporate spheres.
Our advice would be to embrace the surveys. Tailor them all to optimise your post-survey analysis, particularly the demographics questions on the Security Behaviours survey (working routines, ages, management posts etc).
Maximise uptake by selling the benefits to your staff and include options for accessing and completing the surveys, including the newer feature of completing the surveys on mobile devices.
Secure the support of your managing director/CEO and Board; ensure they are engaged from the outset. Finally - difficult comments are the most useful. Only through honesty and clarity will you learn the true culture of your organisation.
Security Culture Case Study 2
Organisation – Nuclear Transport Solutions
What was Security Culture like in your organisation prior to using the tool?
We have a very diverse and mixed culture within Nuclear Transport Solutions (following the integration of Direct Rail Services and International Nuclear Services ) which makes our commitment to security even more important. In December 2024, we conducted an internal Security Culture baseline assessment which provided insights on areas for improvement, and allowed us to plan training and awareness programmes.
NTS is committed to getting our security culture right; we want to understand what is going well, and what improvements we can make. This will help us to direct and shape future initiatives and to better understand the sources of problems we have already identified. To measure our progress we use internal reporting of close calls and security events – these metrics allow us to monitor trends.
We wish to embed an effective security culture where security is a collective responsibility shared by everyone. To achieve this we deliver a range of education and awareness campaigns including animations, scenarios, modules and quizzes. Staff have the opportunity to attend briefings and engage in practical training sessions.
Why did you use the tool and what were your experiences of using it?
NTS have a ‘Culture Blueprint’ that states “great organisations that achieve great things are driven by great cultures”. We want everyone in NTS to perform to the best of their ability to achieve the best possible results. With this in mind, and given changes to the threat landscape and working practices, we want to best support staff to act securely. Further to this, our senior management are invested in improving our security culture.
NTS was therefore drawn to the Security Behaviours survey within the Security Culture Tool to explore and understand specific behaviours demonstrated by staff across the organisation, enabling us to identify how frequently staff engage in those behaviours. This would then allow us to enhance our security practices and foster a culture of security awareness across the organisation.
The Tool was very easy to navigate, and the user guidance provided by NPSA was concise and easy to follow. As a pilot partner, it was expected that we might encounter technical glitches when using the tool. These were reported the NPSA team and fixes released as part of subsequent updates to the tool.
What are your next steps and do you have any advice for organisations considering using the tool
We are in the process of sharing our results with our senior leadership team and identifying new initiatives to drive Security Culture forward in the organisation
Our advice would be to consider how your workforce will complete the surveys. We flagged to NPSA that some of the workforce are not in desk-based roles and we did not want to have to exclude them from the process. NPSA supported us in planning around this and have since developed mobile-friendly versions of the surveys that mean all of our workforce would be able to participate.
Think about the wording of any custom questions to reduce the number of ‘not applicable’ options. This will allow you to better understand your staff’s attitudes towards security.