In building a security risk-aware culture, it is most important to convey to employees that the responsibility for security rests with all employees. Every employee plays a role in ensuring the security of the organization's information assets, and it is essential that they understand their role and take security seriously. This means not only following security policies and procedures but also being vigilant in identifying and reporting potential security incidents.
The other items listed (personal information requiring different security controls than sensitive information, employee access should be based on the principle of least privilege, and understanding an information asset's value is critical to risk management) are all important elements of a comprehensive security program, but they are secondary to the fundamental message that security is a shared responsibility. By emphasizing this message and empowering employees to take an active role in security, organizations can build a stronger, more effective security risk-aware culture.

Residual risk is the remaining risk after all security controls have been implemented. It is important to measure the residual risk of an organization in order to determine the effectiveness of the security program and to justify continued investment in the program. A reduction in residual risk is an indication that the security program is effective and that continued investment is warranted.

An incident response plan is a critical component of an organization's overall security strategy, as it provides a framework for responding to security incidents in a timely and effective manner. To ensure that incidents are responded to by the appropriate individuals, it is essential to have a detailed incident notification process that clearly outlines who is responsible for responding to different types of incidents, how incidents should be reported and escalated, and who should be notified in the event of an incident. This helps to ensure that incidents are addressed promptly and effectively, and that the right resources are brought to bear to resolve the issue. Other important elements to include in an incident response plan include a clear definition of roles and responsibilities, a list of external resources to assist with incidents, and incident response procedures, such as steps to contain, assess, and recover from incidents.