Information security culture: a qualitative approach on management support / Qamarul Nazrin Harun ... [et al.]

In the Industrial Revolution 4.0 (IR 4.0), information security has been highlighted as one of the critical components that needs to be addressed by industry practitioners. To this effect, the deployment of information security controls, both technical and nontechnical is very essential so as
to safeguard and protect organizational information from any form of threats or danger. Information Security Culture (ISC) is a term used to describe a situation where not only members aware and skillful in terms of information security, but the process and procedure as well as the technologies are also in place to protect and safeguard organizational information. This paper reports the findings of a study aimed at assessing the ISC of the Malaysian public organizations. The study used a survey research methodology with a questionnaire as the data collection technique. The results of the study suggest that ISC which are measured in terms of management support, policy and procedures, compliance, awareness, budget and technology are not in place in these participating organizations. The findings send a strong message that much effort is needed to
strengthen the ISC in these participating organizations.