Culture and Information Security Awareness: Examining the Role of Organisational and Security Culture

Abstract

The relationship between security culture and ISA has received preliminary support; however, its interplay with organisational culture is yet to be empirically explored. Therefore, this study examined the relationship between ISA, organisational culture, and security culture. A total of 508 working Australians completed an online questionnaire. ISA was measured using the Human Aspects of Information Security Questionnaire (HAIS-Q); organisational culture was measured using the Denison Organisational Culture Survey (DOCS); and security culture was assessed through the Organisational Security Culture Measure. Our results showed that while organisational culture and security culture were correlated with ISA, security culture mediated the relationship between organisational culture and ISA. This finding has important applied implications. Organisations can improve ISA by focussing on security culture rather than organisational culture, saving them time and resources. Future research could further extend current findings by also considering national culture.