Help your team use approved security practices
A practical guide for local technology advocates and the IT and Security specialists who support them.
Northstar Works is a fictional, cross-industry organization used for the examples on this page. Champions make approved guidance easier to find and connect colleagues with specialists; they do not replace either.
What a champion does—and does not do
Support consistent use of existing practices while leaving policy and specialist decisions with their owners.
Make approved practices usable
Point colleagues to the practice your organization has approved, explain where to find it, and raise recurring questions with the appropriate specialist.
Own authoritative answers
IT and Security specialists interpret policy, investigate concerns through established routes, and decide how approved practices or exceptions are handled.
A useful participation rhythm
Keep each activity small, connected to approved guidance, and easy to hand off.
-
1
Choose one relevant topic
Start with a recurring team task or question and locate the approved guidance before discussing it.
-
2
Share it in a normal team touchpoint
Use a short meeting, team update, or working session to show where the guidance lives and when colleagues use it.
-
3
Collect general questions safely
Capture the question or confusing wording, not passwords, personal information, confidential material, or incident content.
-
4
Route what you cannot answer
Use your organization's established IT and Security route for specialist questions. Use its established reporting route for suspected incidents or concerning messages; do not investigate or decide whether something is safe.
Local activities that help without creating new rules
These examples support discussion and discovery; they are not security policy or a substitute for approved procedures.
Practice finding the right guidance
In a team huddle, ask colleagues where they would look for the approved guidance used in a recurring work task. Note any navigation or wording that makes it hard to find.
- Ask participants to identify the authoritative source.
- Record the confusing label or missing context, not sensitive work details.
- Send the general usability question to the appropriate specialist.
Bring a confusing explanation to a specialist
If colleagues interpret an approved message differently, collect the general wording question and ask IT and Security for an authoritative explanation before repeating an interpretation.
- Quote only non-sensitive wording needed to explain the question.
- Do not create a local workaround or promise an exception.
- Share the specialist's approved explanation with the team.
Worked example: uncertainty about a message
The champion helps colleagues reach the right route without judging the message or handling its sensitive contents.
A colleague is unsure whether a request they received is legitimate.
The champion does not inspect, forward, or declare the message safe; they direct the colleague to the organization's established reporting route.
Separately, the champion asks the security specialist a general question about how the approved guidance explains this situation.
The reporting route handles the specific concern. The specialist handoff addresses the general question; neither is replaced by a champion's judgment.
Illustrative conversation
Share learning without sharing sensitive details
When the same question comes up more than once, share the general question and the approved explanation with the relevant champion group or specialist. Leave out personal information, confidential material, credentials, and details from an incident or suspected incident.
Specialists remain the source of authoritative answers. If an answer is unclear or a practice appears to have changed, ask IT and Security to confirm the current guidance before passing it on.
For a suspected incident or concerning message, use the established reporting route rather than discussing the specific case in a team forum. For questions about how the champion program itself works, contact the program owner through your organization's usual IT and Security channel.