Organizational culture is crucial because it shapes behaviors and attitudes in the workplace, and this can have a profound impact on operations and overall success. However, it is sometimes difficult for CISOs and other infosec managers to fully understand their culture, because they are inside it constantly. This article shows how infosec managers can assess the organizational culture, by using a culture model to examine the behaviors, relationships, attitudes, values, and environment that the culture sustains.  It also discusses possible ways to lead a culture change initiative.