Institutional Repository

Comparing the information security culture of employees who had read the information security policy and those who had not

Show simple item record

dc.contributor.author Da Veiga, Adele
dc.date.accessioned 2017-09-13T10:59:34Z
dc.date.available 2017-09-13T10:59:34Z
dc.date.issued 2016
dc.identifier.citation Adéle Da Veiga , (2016),"Comparing the information security culture of employees who had read the information security policy and those who had not", Information & Computer Security, Vol. 24 Iss 2 pp. 139-151 en
dc.identifier.issn 2056-4961
dc.identifier.uri http://hdl.handle.net/10500/23161
dc.description.abstract Purpose – This study aims, firstly, to determine what influence the information security policy has on the information security culture by comparing the culture of employees who read the policy to those who do not, and, secondly, whether a stronger information security culture is embedded over time if more employees have read the information security policy. Design/methodology/approach – An empirical study is conducted at four intervals over eight years across 12 countries using a validated information security culture assessment (ISCA) questionnaire. Findings – The overall information security culture average scores as well as individual statements for all four survey assessments were significantly more positive for employees who had read the information security policy compared with employees who had not. The overall information security culture also improved from one assessment to the next. Research limitations/implications – The information security culture should be measured and benchmarked over time to monitor change and identify and prioritise actions to improve the information security culture. If employees read the information security policy, it has a positive influence on the information security culture of an organisation. Practical implications – Organisations should ensure that employees have read the information security policy to aid in minimising the human risk, related errors and incidents and, ultimately, to instil a stronger information security culture with a higher level of compliant behaviour. Originality/value – This research confirms theoretical research indicating that the information security policy could influence the information security culture positively. It provides novel and statistical evidence illustrating that if employees read the information security policy, they have a stronger information security culture and that the culture can be improved through targeted interventions using an ISCA. en
dc.publisher Information & Computer Security (Emerald Journal) en
dc.relation.ispartofseries Vol 24;Iss 2
dc.subject Assessment, Information security, Policy, Culture, Influence, Factors en
dc.title Comparing the information security culture of employees who had read the information security policy and those who had not en
dc.type Article en
dc.description.department College of Engineering, Science and Technology en


Files in this item

This item appears in the following Collection(s)

Show simple item record

Search UnisaIR


Browse

My Account

Statistics