An information security-positive culture is required in organisations where employees process information in line with its confidentiality, sensitivity and privacy requirements. The information security policy serves as ...