With the digitization of supply chain operations and interconnectivity of IT and OT, Johnson & Johnson realized the need to strengthen cyber resilience in manufacturing by establishing a strong cybersecurity culture.  

As a large healthcare company with multiple sites globally, Johnson & Johnson has on-the-ground cybersecurity advocates to educate everyone at the site and coordinate site-level actions and responses. Inconsistent or reactive responsibility for security awareness and actions across more than 60 sites is a challenge for the security programme.

The following are some of the key actions the company took:

• Created a core team of IT and business leadership to lead the effort and define the roles and responsibilities of a “cybersecurity champion”.  
• Partnered with industry experts to build a plan with change management, training material, website, videos and an OT cybersecurity lab to incubate solutions. 
• Connected with “make” and “deliver” leadership to nominate points of contact for each site to establish a network of cybersecurity champions. 
• Successfully mobilized the cybersecurity champions network at each site.

The cybersecurity champion role has been instrumental as the liaison between site, business teams and cybersecurity. The champions collaborate with the cybersecurity team for risk assessments, remediation actions and any urgent needs to strengthen cybersecurity and resiliency.