For years, protecting Controlled Unclassified Information to the NIST 800-171 standard has mostly meant one audience: defense contractors, and the CMMC program built to enforce it. The proposed FAR CUI rule changes who’s on the hook. It would extend NIST SP 800-171 to every federal contractor that handles CUI, civilian agencies included, and once the clause lands in your contracts there’s no phase-in period to catch up.

What the FAR CUI rule actually does

The FAR Council published an updated proposed rule on 23 June 2026, with a comment period running to 23 July 2026, and it’s expected to be finalized before the end of 2026. It would require any contractor whose contract identifies CUI to implement NIST SP 800-171 Revision 3, and a limited set of contractors tied to critical programs or high-value assets would also face the enhanced controls of NIST SP 800-172. The headline here is the scope. This is no longer a Department of Defense requirement. It’s a whole-of-government one.

Why “we have CMMC handled” is not the same thing

If you already work with the DoD, CMMC has you thinking about NIST 800-171 through third-party assessment. The FAR CUI rule is the civilian counterpart, and it reaches contractors who have never touched CMMC because they sell to agencies outside defense. The control backbone is the same, but the audience is far larger, and a lot of the newly-covered contractors are starting from a standing stop. One difference cuts the other way. Where CMMC verifies you through a third-party assessor, the FAR CUI rule leans on self-attestation. That sounds lighter, but it just moves the burden of proof onto you, and a false attestation about your own security is not a small thing to sign. If you sell to any federal agency and touch CUI, the same obligations are coming for you. The DoD-specific view is in why CMMC wants you to test your incident response.

The part that is about your people, not your GRC tool

Most of NIST 800-171 is technical implementation, and a policy binder covers the paperwork. But two of its requirements are about human readiness, and those are the ones a document can’t fake. You have to train your people on their security roles, and you have to test your incident response capability, not just plan it. When a real CUI incident hits, the only question that matters is whether your team can actually run the response, inside the reporting deadlines, without opening the runbook for the first time.

What readiness looks like

It looks like the team running the incident, not narrating a plan. That’s what Malware & Monsters does. It’s a tabletop incident response game where the scenario changes because of what the team decides, so you’re exercising the capability the standard asks you to test, and building the instinct a real CUI incident will demand. There’s a nice overlap worth naming here: a tabletop exercise is one of the artifacts these rules expect you to be able to produce. Running the game both builds the capability and gives you the evidence that you tested it. It has been run with security teams across Europe and North America.

The FAR CUI rule isn’t final yet, but the direction is set and there’s no phase-in waiting for you. The contractors who are ready when the clause appears will be the ones who trained and tested before they had to. If your obligations sit on the European side of the Atlantic instead, the same readiness logic runs through EU cyber regulation training.

Frequently asked questions

What is the FAR CUI rule?

It is a proposed Federal Acquisition Regulation rule, updated on 23 June 2026, that would require federal contractors whose contracts involve Controlled Unclassified Information to implement NIST SP 800-171 Revision 3. The comment period runs to 23 July 2026 and it is expected to be finalized before the end of 2026.

Does the FAR CUI rule apply to non-defense contractors?

Yes, that is the change. It would extend the NIST 800-171 requirement from defense contractors to all federal contractors that handle CUI, across civilian agencies too.

When does it take effect?

It is still a proposed rule, expected to be finalized before the end of 2026. Notably, there is no phase-in: once the clause is inserted into a contract, compliance is required from that point.

How is the FAR CUI rule different from CMMC?

CMMC is the DoD-specific program that verifies NIST 800-171 compliance through a third-party assessment. The FAR CUI rule applies the same standard across the whole federal government but relies on contractor self-attestation rather than an external assessor. Same control backbone, different audience, different proof.

Want to put this in front of your team?

I run these as games your board and your responders actually take part in, not another slideshow. Tell me where your team is and what they need to practise, and we will set it up.

CMMC certification is how a company stays eligible for US Department of Defense contracts, and it asks for more than a binder of policies. To reach Level 2 you have to meet the practices in NIST SP 800-171, and two of them are about your people, not your paperwork. You have to train them, and you have to test your incident response capability. A slide deck and a filed plan satisfy neither one, at least not in the way an assessor actually checks.

What CMMC asks of your people

Level 2 aligns to the 110 practices of NIST SP 800-171, and sitting among the technical controls are a couple that are squarely about human readiness. The Awareness and Training family requires you to make your people aware of security risks and train them on their specific roles. The Incident Response family goes further than “have a plan”: practice 3.6.3 requires you to test the organizational incident response capability. Not document it. Test it. That’s a verb an auditor can ask you to evidence.

Why the checklist is the default

The checklist is the obvious answer, and for good reasons. A lot of CMMC is genuine technical implementation, and a self-assessment or a tabletop template produces the artefact a C3PAO assessor expects to see. If the goal were to show that an IR plan exists, the template would be enough. But the practice doesn’t ask whether a plan exists. It asks whether the capability works.

A tested capability is not a filed plan

An incident response plan nobody has run is a set of assumptions about how your team will behave during a breach involving controlled unclassified information. Who declares the incident. Who talks to the prime contractor and to the government. Whether the runbook still matches the systems you have now. You don’t find those gaps by reviewing the document, and neither does the assessor. You find them by running it under pressure, before a real incident and a real audit find them for you.

What testing your IR capability looks like

It looks like the team working a real incident, making the calls, and living with the consequences on the table instead of in production. That’s what Malware & Monsters does. It’s a tabletop incident response game where the scenario changes because of what the team decides, so you’re exercising the capability CMMC 3.6.3 asks you to test, not narrating a plan. It has been run with security teams across Europe and North America, and it sits in the wider serious games catalogue alongside my other facilitated tabletop exercises.

CMMC is US defense contracting today, but the same NIST 800-171 backbone is about to reach every federal contractor under the proposed FAR CUI rule. The readiness problem is also exactly the one the EU is now legislating for its own entities. If you operate on both sides of the Atlantic, the EU equivalents are in game-based training for EU cyber regulation.

Frequently asked questions

Does CMMC require incident response testing?

Yes. CMMC Level 2 aligns to NIST SP 800-171, and practice 3.6.3 requires you to test the organizational incident response capability, not just document a plan.

Does CMMC require security training?

Yes. The Awareness and Training practices require you to make personnel aware of security risks and train them on their assigned security roles and responsibilities.

What is CMMC Level 2?

Level 2 is the Advanced level of CMMC 2.0, aligned to the 110 practices of NIST SP 800-171, required for contractors that handle Controlled Unclassified Information, and assessed by a third party for most.

Can a game help with CMMC compliance?

A game does not certify you, but it directly serves the human practices CMMC checks: it tests your incident response capability and trains your people on their roles, which is exactly what a tabletop like Malware & Monsters is built to do.

Want to put this in front of your team?

I run these as games your board and your responders actually take part in, not another slideshow. Tell me where your team is and what they need to practise, and we will set it up.

DORA made operational resilience testing a legal duty for financial entities across the EU, not an internal best practice. It expects a real testing programme and business-continuity arrangements that actually work. Plenty of firms are handling that with a documented plan and a checklist. The document proves you have a plan. It proves nothing about whether the plan works, or whether the people who’d have to run it can.

What DORA actually requires

DORA isn’t a paperwork exercise dressed up as resilience. Article 11 requires ICT business continuity policies and response and recovery plans that are maintained and tested. Articles 24 to 26 require a programme of digital operational resilience testing of your ICT systems, and for the larger entities, advanced threat-led penetration testing. The word doing all the work there is testing. DORA doesn’t ask you to have a continuity plan. It asks you to prove it holds up.

Why firms default to the checklist

The checklist is the obvious answer, and it’s obvious for good reasons. It’s auditable, it’s cheap, and it produces the artefact a supervisor asks for. If the goal were to show that a plan exists on paper, the checklist would be enough. That’s just not what DORA is testing for.

A plan you have never run is a hypothesis

A continuity plan that’s never been exercised is a set of assumptions about how people will behave in the worst hour of their year. Who makes the call to fail over. Whether the runbook still matches the systems you actually have now. Whether the business owner and the technical team even agree on what “recovered” means. You don’t find those gaps by reviewing the document. You find them by running it, under time pressure, before a real disruption finds them for you.

What resilience testing looks like when it works

It looks like the team running the plan, not reading it. You take your actual continuity plan, put it under a realistic disruption with a clock, and watch where it breaks. That’s what FAILOVER does. It’s a business-continuity exercise run against your real plan, not a generic case study, so the gaps you find are the gaps you actually have. It’s the difference between a plan you filed and a plan you trust.

DORA will keep raising the bar on what counts as testing, and a checklist was never going to tell you whether your organisation can actually recover. Test the plan the way you’d test anything you depend on. Run it.

DORA is one of several EU regimes now demanding tested capability rather than filed documents. NIS2 makes the same move at board level, and the game-based approach across both sits in training for EU cyber regulation.

Frequently asked questions

Does DORA require operational resilience testing?

Yes. DORA Articles 24 to 26 require a programme of digital operational resilience testing of ICT systems, and Article 11 requires ICT business continuity plans that are maintained and tested. Larger entities also face threat-led penetration testing.

Is a documented continuity plan enough for DORA?

No. DORA is explicit that plans must be tested, not just maintained. A documented plan satisfies the paperwork but does not demonstrate the resilience DORA is asking you to prove.

What counts as a DORA resilience test?

Exercising your actual ICT continuity and response plans against a realistic disruption, so you find where they break before an incident does. A facilitated business-continuity exercise against your real plan, such as FAILOVER, is one way to do it.

Who does DORA apply to?

Financial entities in the EU and their critical ICT third-party providers. If you fall under DORA, the operational resilience testing obligation applies to you.

Want to put this in front of your team?

I run these as games your board and your responders actually take part in, not another slideshow. Tell me where your team is and what they need to practise, and we will set it up.

NIS2 turned board-level security training into a legal obligation, not a nice-to-have. Article 20 puts accountability for cyber risk on the management body itself, and Article 20(2) requires those same people to be trained. Most organisations are dealing with that by booking a ninety-minute seminar or an e-learning module. It ticks the box. It does almost nothing for the thing NIS2 actually cares about.

What NIS2 actually asks of your board

Article 20 isn’t a training requirement bolted onto a technical directive. It’s a governance requirement. The management body has to approve the cyber risk-management measures, oversee how they’re implemented, and can be held personally liable when they get it wrong. Article 20(2) then says those same managers have to be trained to identify risks and assess the organisation’s cyber risk-management practices. Read that again. The law doesn’t ask your board to be aware of cyber risk. It asks them to make and defend decisions about it.

Why the seminar is the default

The seminar is the obvious answer, and it’s obvious for good reasons. It’s cheap, it scales, one expert can brief a whole leadership team in an afternoon, and it leaves you with an attendance record to show an auditor. If the goal were to inform the board that NIS2 exists and that cyber risk is real, the seminar would be exactly the right tool. That’s just not the goal.

Information is not instinct

A board that has sat through a good NIS2 briefing can tell you what the directive says. That’s not the same as being able to run the meeting where the CISO asks for budget they don’t want to give. Or the meeting thirty minutes after a breach, where someone has to decide what to tell the regulator inside the seventy-two hour window. Those are decisions made under pressure, with half the information you’d like and real consequences either way. You don’t get better at them by being told about them. You get better at them by making them, getting them wrong somewhere it’s safe to get them wrong, and making them again. That’s the training the law has in mind, whether it puts it in those words or not.

What board training looks like when it works

It looks like the board actually making the calls. You put a real governance decision in front of them, with a clock and a trade-off, and let the consequences play out on the table instead of in production. That’s what EXPOSURE does. It’s a board-governance game built around the decisions NIS2 Article 20 puts on management, run as a facilitated half-day. The board doesn’t learn about oversight. They practise it.

NIS2 won’t accept “we ran a seminar” as evidence forever. And even if it did, a seminar was never going to change how your board behaves in the room that actually matters. Train them the way you’d train anyone for a decision that counts. Let them make it.

NIS2 is not the only EU regime raising this bar. DORA does the same for operational resilience in financial services, and the wider case for training over slideware runs through game-based training for EU cyber regulation.

Frequently asked questions

Does NIS2 legally require board-level cybersecurity training?

Yes. NIS2 Article 20(2) requires members of management bodies to undergo training to identify risks and assess cyber risk-management practices, and Article 20(1) makes them accountable for the measures themselves.

Is a seminar or e-learning enough for NIS2 management training?

It satisfies the paper obligation but not the intent. NIS2 holds management accountable for decisions, and a seminar transfers information without ever rehearsing the decisions. It is the minimum, not the goal.

What is the alternative to a NIS2 board seminar?

A facilitated exercise where the board actually makes the governance decisions under pressure, such as a board-governance game like EXPOSURE, so they practise the accountability the law assigns them.

Who is legally accountable under NIS2?

The management body. Article 20 makes them approve and oversee the risk-management measures and allows them to be held liable, which is why their training has to go beyond awareness.

Want to put this in front of your team?

I run these as games your board and your responders actually take part in, not another slideshow. Tell me where your team is and what they need to practise, and we will set it up.

In the rapidly evolving digital landscape, traditional marketing strategies no longer suffice in the InfoSec sector. This article explores a transformative approach based on deep community engagement, demonstrating how genuine support and understanding of the InfoSec community can lead to unparalleled marketing success. This piece is intended for InfoSec marketers and those interested in leveraging community support for business success.

Disclaimer: For simplicity, this discussion treats the InfoSec community as a unified entity, though it is diverse and multifaceted.

I have a long-term vision rooted in my passion for the community: I aim to convince companies of the benefits of supporting it. In those rare cases where management understands, I seek to enhance their marketing departments’ understanding of the community, its members, and the most effective targeting strategies.

This article is designed to contribute to the debate, primarily engaging InfoSec marketers, but of course, it is open for all to read. Should you have any questions or wish to discuss further, please feel free to reach out.

So, are you an InfoSec marketer? Interestingly, I never envisioned myself in that role. My background is deeply rooted in the technical aspects of InfoSec, and I’ve always viewed its commercial side with skepticism. I never found marketing particularly intriguing or relevant, until now.

Marketing indeed comes in many forms. The traditional methods never captured my interest, but I discovered the power of community-focused content marketing.

If you’re unfamiliar with this term, there’s a good reason. I devised it when I realized that content marketing in InfoSec could take on various forms.

Starting My Journey in InfoSec

Let’s backtrack to the beginning of my engagement with the InfoSec community. It started when I began organizing OWASP meetings in my local chapter. I’m not entirely sure why I started. It just felt natural. But I know why I continued: I relished organizing insightful talks, bringing people together, and witnessing the joy in their eyes when they learned something new or made meaningful connections. Assisting the community provides me with immense satisfaction. Thus, when the opportunity arose to help bring the non-profit InfoSec conference Security BSides to Copenhagen, I seized it without hesitation.

Imagine my elation when I realized that combining my extensive background in InfoSec with my love for the community could evolve into a genuine profession, something as exciting as ‘marketing’.

The Power of Community Engagement in InfoSec

Over the years, my active participation has shown me the immense power of the InfoSec community. My recent role as the head of community for an emerging FOSS project only reinforces this:

• Influences Company Trends: The community decides which companies and individuals are trending.
• Shapes Service Perceptions: It determines who provides excellent service.
• Defines Desirable Workplaces: Influences which companies are considered great places to work.

This influence can be subtly shaped through content marketing.

As the name suggests, content marketing revolves around content. Though it might sound unusual, it’s not focused on converting customers, generating leads, or making sales. Rather, it’s about building familiarity, likability, and trust toward your brand, all while genuinely supporting the InfoSec community.

The InfoSec community generally seeks to support those who appreciate it. If your marketing strategy involves loving the community, it will reciprocate by promoting how excellent your products are, how skilled your specialists are, and what a great place your company is to work. Or to put it another way:

When people trust your content and recognize you as an expert, you effectively eliminate your competition.

In a market where it’s challenging to sell products and services and even harder to attract qualified employees, this approach is invaluable.

Defining Effective Content in InfoSec Marketing

Fundamentally, content is anything that immediately adds value to the community. When your marketing strategy is built on this premise, it goes without saying that it must be produced consistently with high quality so that the InfoSec community recognizes and values your contributions over time. Types of content include:

• Blog Articles: In-depth discussions on relevant InfoSec topics.
• Podcasts/Webcasts: Engaging audio and video content.
• Talks and Workshops: Interactive sessions that provide valuable knowledge.
• Innovative Formats: Memes and jokes that resonate with the community’s culture.

Essentially, anything that resonates with the inner InfoSec geek in your target group is valuable. It’s crucial to foster a culture where people are encouraged to have ‘stupid ideas’: ideas so unique they might be either ridiculous or brilliant. If they work, the rewards can be significant. And honestly, what’s the worst that could happen if they fail?

I am immensely grateful to Jason Blanchard from Black Hills Information Security for his inspiration and guidance. He has been instrumental in helping me discover this path and make it my own, particularly now as I’ve begun a consultancy to assist companies and their marketers in adopting this approach. Thank you, Jason!

Jason directed me to a workshop he conducted with Jon Barnes titled “Infosec Marketing in 2021: Hacking the New Normal,” which offers an overview of content strategies and examples of how to create compelling content. I highly recommend watching it if you’re interested in this approach – in spite of it being a few years old it’s still relevant today.

InfoSec Marketing: Not for Everyone

Indeed, there’s a catch: This field is challenging. Particularly if you lack experience in InfoSec and are unfamiliar with the community’s dynamics, it requires significant time and effort.

Creating content that truly engages InfoSec professionals isn’t easy, unless you know exactly what will captivate an InfoSec geek. And gaining that knowledge is often the hardest part if you don’t inherently possess InfoSec geekiness. From my experience, such a blend of skills is rare among marketers.

The more you understand about InfoSec and geek culture, the better equipped you’ll be as a content producer or editor here. But all this expertise won’t amount to much without solid communication skills and an intuitive understanding of what makes a compelling talk or blog article.

In other words, this field is neither purely marketing nor purely InfoSec. It’s both. And those who master both are indeed rare.

Embracing community-focused content marketing is a long-term strategy. When engaging the InfoSec community (or any community), it takes time before you see significant results. The upside is that once you achieve success, that reputation tends to persist within the community.

Ready to Transform Your InfoSec Marketing Strategy?

Navigating the complex world of InfoSec marketing requires a nuanced approach tailored to your unique business needs. As a seasoned consultant specializing in community-driven marketing strategies, I am here to help your company connect deeply with the InfoSec community and achieve sustainable success. If you’re looking to revolutionize your marketing efforts and build lasting relationships within the industry, don’t hesitate to reach out. Together, we can craft a marketing strategy that not only meets but exceeds your expectations.

Good luck on your journey to revolutionize InfoSec marketing!

Embracing the infosec community and people in it is important if you want to attract the talent you need. Learning to understand geeks and geek subculture is an important skill here. Read on and understand why both your HR and marketing departments need to learn geek.

So you’re one of those companies that has problems attracting talent? Or keeping it. Maybe even both?

Here’s some comfort in a sense: You’re not alone. That’s the new normal everywhere in IT. Luckily, there are ways to improve your situation. The infosec community holds the key: Embrace its culture and language, show people in it that you understand and respect them, and demonstrate that everybody in your organization takes security seriously. The community will love you back by spreading the word about how great it is to work at your company and how much fun people have there. Succeed, and all your challenges with attracting and retaining talent will be a thing of the past.

Marketing and Employer Branding Are Often Overlooked

In reality, this is marketing and for some reason it’s vastly overlooked in talent acquisition and employer branding. Is it because talent professionals know little about tech culture? Probably, but that can be fixed.

Let’s start from the beginning: What is this community, why is it important, and how does one communicate with it and make it do all those amazing things I mentioned earlier?

The Infosec Community

In short (and hugely oversimplified), the infosec community consists of all those passionate, geeky personalities who love infosec so much that they just have to make it part of their careers. Many of them can’t leave it at that and meet up with like-minded people in their spare time to discuss infosec, watch talks, and get to know more people like them.

Because of these passionate people, the infosec community consists of many of those security wizards every company wants to hire. And they’re in short supply.

Providing Value and Getting Respect

The way to get their attention is actually quite simple: Provide them with content that gives immediate value. If you succeed, the community will help you out, recognizing you as a friend.

Providing value to the community is done by creating meaningful, inspiring, or just fun content of high quality. An important thing is to not take yourself too seriously. If you have an edge, it’s appreciated and rewarded.

Real-Life Examples of Building Credibility

• Reddit Outreach: When working on a FOSS project aiming to replace Fail2Ban, I monitored Reddit for mentions and subtly suggested our alternative where it added value. This helped gain direct interest and awareness.
• Stickers and Humor: Designing stickers that reference geeky jokes or sci-fi like Star Wars can surprise people. At BSides Prishtina, I was introduced as “the guy with the coolest stickers.”
• Talks and Meetups: I’ve given talks on living with ADHD in infosec to dispel myths, share personal stories, and build connections. It’s been a way to showcase my expertise while building my authority in the community.

Providing value to the community is done by creating meaningful, inspiring (or just fun) content of high quality

Getting HR, Marketing, Communications, and the Security Pros to Work in Sync

For this strategy to work best, HR, marketing, communications, and your security team need to be in harmony. Here’s how to make this collaboration happen:

• Cross-Department Workshops: Get everyone together to share their perspectives. Your security team can explain the challenges they face, while marketing and HR can help craft messaging.
• Joint Strategy Development: Build a strategy with common goals that align everyone’s strengths. Let your security team highlight key points while HR and marketing turn these into compelling job descriptions and campaigns.
• Content Creation: Security experts provide technical depth, while marketing ensures it’s clear and engaging. Share behind-the-scenes stories and thought leadership pieces that spark curiosity.
• Feedback Loop: Set up a feedback loop to improve your strategy. Share findings across departments so that adjustments can be made based on community feedback.
• Internal Advocates: Find internal advocates to bridge the gap between technical and non-technical teams. They’ll ensure your message remains authentic and appealing.

More Ways to Engage

I’ve been involved with my local infosec community for a long time, arranging events and talks for peers to show up, grab some pizza, and get inspired for new projects. This has helped me build a network of peers, many in decision-making positions, whom I can reach out to and leverage to my advantage. I can only do that because my involvement in the community has helped me build trust and authority over time.

Other ways to engage include arranging CTF (Capture the Flag) competitions for your employees and the local infosec community, contacting universities to sponsor student events, or interviewing an employee who maintains an open-source security tool that your organization uses.

Content Marketing for the Infosec Community

All these examples are forms of content marketing. Conceptually, it’s nothing new, but using it specifically for the infosec community is still relatively uncommon. When used well, it’s an effective way to speak directly to the community, provide them with valuable content, and show that you understand their needs. This helps you build brand recognition and earn their trust.

Conclusion

Dare to step out of your corporate image and show the infosec community who you really are. Embrace their culture, show respect, and connect authentically. Your company will be seen as an attractive place to work. And if you need help combining these skills, feel free to reach out to me.

There’s a lack of talent in cybersecurity. Nobody seems to be able to hire enough qualified specialists. Nothing’s new in that.

What’s really strange when speaking of this lack of talent is that no one seems to do anything about that and their situation. While you can’t magically snap your fingers to make the specialists you need magically disappear, what you can do is to stand out among the companies looking to hire talent and talk to them in a language they understand.

There’s too many job ads out there that are too formal and neither show the true spirit of the workplace and the specialists already working there nor the specialist they’re trying to attract. Also, there’s practically no companies who understand that engaging with the cyber security community could be a part of their employer branding strategy.

To me that makes absolutely no sense.

In reality, employer branding is marketing and like any other types of marketing it’s about creating immediate value to the recipient who in this case is the cyber security community.

If you think about it, it makes sense: the cyber security community is full of those engaged, talented professionals your company needs to make your business strategy become reality. Those professionals who simply love cyber security so much that they are submerged in pet projects in their spare time, who love seeing other community members with the same passions to share inspiration, knowledge and to feel togetherness in an uncertain world.

By hooking into this community professionally, you show members of the community that you share their values and beliefs; that you are part of the tribe. Tribes are the cornerstone of civilization; people in the same tribe look out for each other, they help and support each other when they can. They truly care for each other. These are the feelings you want to awaken in the cyber security community.

Basically you want sentiment, you want the cyber security community to look up to you as a company, to your specialists. You want to make the cyber security community want to work with you.

The good news is that it’s not hard to do this as long as you know the language of the community, which defines the rules and the tone of your communication and you can predict what community members will find interesting. And, admitted, that last part is quite hard. But basically it’s about knowing about cyber security and knowing about subcultures, about geekiness. Being a geek yourself, regardless of type, is definitely not a disadvantage.

So how do you create value? You give the community what fuels it:

• Knowledge in the shape of videos, talks, articles, workshops, courses and more.
• Humor is a tough element to get right but important. It’s important to show that you as a company dare to show a human side of yourself and that you don’t take yourself too seriously. If you’re capable of that and of doing jokes at your own expense, you win.
• Meetups are where the magic happens; where people interact and get inspired. Your company can support it by sponsoring food and drinks, engaging in planning and doing talks. Those two last ones are always the hardest ones and are typically the reasons for community meetup groups to hibernate or dissolve.

To be frank, community employer branding is not for everyone. Honesty and transparency are important factors. Let me explain:

As a cyber security professional nothing is worse than not being taken seriously; to be hired to help increase security, to see that there is a need and that significant risks need to be addressed but not being able to. What usually happens is that management in theory finds security important but in reality finds other things, like making money, more important. I’m not saying that that isn’t fair to do if it’s done in complete transparency, if all risks have been assessed and addressed on management level and it has been decided. Unfortunately that is rarely the reason. More often than not, it’s the result of incompetent management, bad communication and reporting by people who are not very good at explaining exactly what impact this or that threat has on business risk.

So if you’re not one of those companies that truly does take cyber security seriously in every part of the business, you can’t go around pretending to be. Not forever, at least. And when the community finds out, your efforts will backfire.

So in other words: If your company’s management truly mean it, and you have an organization that supports it, the effort you put into this will pay off if done in the right way.