A survey of 500 Australian employees revealed a significant, positive relationship between information security decision making and organizational information security culture. This suggests that improving the security culture of an organization will positively influence the behavior of employees, which in turn should also improve compliance with security policies.
| Construct | Cites | Category | Questions given? | Content validity | Pretests | Response type | Notes |
|---|---|---|---|---|---|---|---|
| knowledge of information security policy and procedures | Parsons et al., 2014 | HAIS-Q | no | no | none | 5-point likert scales ranging from "strongly agree" to "strongly disagree" | |
| attitude towards information security policy and procedures | Parsons et al., 2014 | HAIS-Q | no | no | none | 5-point likert scales ranging from "strongly agree" to "strongly disagree" | |
| behavior regarding information security policy and procedures | Parsons et al., 2014 | HAIS-Q | no | no | none | 5-point likert scales ranging from "strongly agree" to "strongly disagree" | |
| Organizational information security culture | NEW | partially | no | none | 5-point likert scales ranging from "strongly agree" to "strongly disagree" | ||
| penalties | NEW | yes | no | none | various | ||
| rewards | NEW | yes | no | none | various |
Kathryn Marie Parsons, Elise Young, Marcus Antanas Butavicius, Agata McCormac, Malcolm Robert Pattinson, and Cate Jerram. The influence of organizational information security culture on information security decision making. Journal of Cognitive Engineering and Decision Making, 9(2):117–129, 2015. doi:10.1177/1555343415575152.
@article{parsons_influence_2015,
author = {Parsons, Kathryn Marie and Young, Elise and Butavicius, Marcus Antanas and McCormac, Agata and Pattinson, Malcolm Robert and Jerram, Cate},
doi = {10.1177/1555343415575152},
journal = {Journal of Cognitive Engineering and Decision Making},
number = {2},
pages = {117--129},
title = {The Influence of Organizational Information Security Culture on Information Security Decision Making},
volume = {9},
year = {2015}
}