"It was a long implementation because of cultural issues," he says, but taking it slow made the changes stick. "You can't just announce one day, 'If you don't do this, you're going to get in trouble,'" he says. "You have to get them to understand why it's so important."

in CIO's Security Drilldown.