Building an Information Security Culture at TCO
TCO
Information security policies are only effective when employees understand, remember, and apply them consistently. When TCO wanted to reinforce key security practices across its Stavanger and Indre Arna offices, the challenge was clear: transform complex procedures and policy documents into an engaging internal campaign that employees would actively interact with.
The result was Pause. Think. Secure. A light, practical campaign connecting everyday decisions with TCO’s Information Security Management System (ISMS).
After an internal townhall on information security, TCO needed a campaign to:
• Raise awareness of key security requirements
• Give practical, everyday guidance
• Drive behaviour change, not just policy awareness
• Act as a single go-to source for security information
Topics included public WiFi, information classification, document labelling, password management, and incident reporting. The scope later expanded to cover AI Guidelines, helping staff use AI tools safely.
We built the campaign around one idea: make the secure choice the easy choice.
A central landing page held all procedures and guidance. This ensured employees always had access to the latest information while avoiding duplication across campaign materials. Around it, we created a series of lightweight reminder assets designed for everyday use:
- Branded mousepads
- Stickers and laptop decals with QR codes
- Desktop wallpapers
- QR-code standees placed in common areas
- AI Guidelines posters and digital wallpapers for screens in the common areas
- Instead of policy language, we used short questions to prompt the right behaviour:
Am I using the right tool?
- Am I sharing the right information?
- Have I verified the output?
- Do I need to report this?
This transformed information security from a compliance exercise into a daily habit.
The campaign launched across both offices to positive feedback from employees and management.
Key outcomes included increased visibility of security procedures, improved access to ISMS guidance, strong engagement with campaign materials, and positive adoption of the AI guidance through practical, non-restrictive messaging. The framework is also scalable, able to evolve alongside future security requirements.
Internal Communication
Marketing collaterals
Employees Advocacy
“The tagline is catchy and memorable, and the campaign materials are exactly the right tools to reinforce the message.”
Return to our latest projects work
Our work