Defining organisational information security culture—Perspectives from academia and industry

Key finding

Combines a scoping review with a 512-respondent industry survey to define information security culture, identifying 5 external and 20 internal influencing factors. Academic definitions were much broader than industry's, and strong cultures were linked to mutual trust and integrity.

Why it matters

Provides a consolidated, evidence-based definition and factor model of security culture for measuring and shaping it.

Informs

• Builds a culture where it's safe to admit mistakes context

Cite

Veiga, A. d., Astakhova, L. V., Botha, A., & Herselman, M. (2020). Defining organisational information security culture—Perspectives from academia and industry. Computers & Security, 92, 101713. https://doi.org/10.1016/j.cose.2020.101713