An approach to information security culture change combining ADKAR and the ISCA questionnaire to aid transition to the desired culture

Abstract

Purpose Employee behaviour is a continuous concern owing to the number of information security incidents resulting from employee behaviour. The purpose of this paper is to propose an approach to information security culture change management (ISCCM) that integrates existing change management approaches, such as the ADKAR model of Prosci, and the Information Security Culture Assessment (ISCA) diagnostic instrument (questionnaire), to aid in addressing the risk of employee behaviour that could compromise information security. Design/methodology/approach The ISCCM approach is constructed based on literature and the inclusion of the ISCA diagnostic instrument. The ISCA diagnostic instrument statements are also presented in this paper. The ISCCM approach using ISCA is illustrated using data from an empirical study. Findings The ISCCM approach was found to be useful in defining change management interventions for organisations using the data of the ISCA survey. Employees’ perception and acceptance of change to ensure information security and the effectiveness of the information security training initiatives improved significantly from the as-is survey to the follow-up survey. Research limitations/implications The research illustrates the ISCCM approach and shows how it should be combined with the ISCA diagnostic instrument. Future research will focus on including a qualitative assessment of information security culture to complement the empirical data. Practical implications Organisations do not have to rely on or adapt organisational development approaches to change their information security culture – they can use the proposed ISCCM approach, which has been customised from information security and change management approaches, together with the presented ISCA questionnaire, to address information security culture change purposefully. Originality/value The proposed ISCCM approach can be applied to complement existing information security management approaches through a holistic and structured approach that combines the ADKAR model, Prosci’s approach of change management and the ISCA diagnostic instrument. It will enable organisations to focus on transitioning to a positive or desired information security culture that mitigates the risk of the human element in the protection of information.

Coaching Belgian and Dutch Broiler Farmers Aimed at Antimicrobial Stewardship and Disease Prevention

“…To quantify farmers’ attitudes towards a reduction in AMU, the ADKAR ® change management model was used. This model is already well established in the fields of corporate business and human medicine [ 31 , 37 , 38 ] and offers a practical tool for guiding change. ADKAR ® is an acronym for the 5 building blocks necessary for successful change: Awareness, Desire, Knowledge, Ability, and Reinforcement.…”

Defining organisational information security culture—Perspectives from academia and industry

“…Authors have also considered the protection of an organisation's information assets as a goal of information security culture (Alfawaz, Nelson, & Mohannak, 2010). At the same time, "people are very often perceived as an obstacle rather than an asset in this regard" (Furnell & Thompson, 2009: 5) as security incidents and breaches are often related to employee error or negligence (Da Veiga, 2018). However, today more and more authors are exploring information security culture from the human perspective as a critical resource to success in protecting information resources.…”

“…Various studies have pointed out that human behaviour is a threat to information security (Lim, et al 2012, Da Veiga 2018 with the behaviour of employees over time resulting in the information security culture (Thompson et al 2006, Da Veiga andMartins 2017). The concept of behaviour was also the most common theme in the literature descriptions of information security culture in table 1.…”

A systematic review of scales for measuring information security culture

“…The security culture scale developed by Alharbi et al (2017) does not meet the thresholds. Furthermore, six studies do not mention or test any Notes: 1 Security culture is measured as (an independent) unidimensional concept; 2 Information from several articles is collected into one evaluation (IPCA: Da Veiga and Martins, 2015b;Da Veiga, 2016 andDa Veiga, 2018; Information security culture: Masrek et al, 2018a andMasrek et al, 2018b;ISCA: Da Veiga andMartins, 2015a andDa Veiga, 2015; Organisational information security culture: Parsons et al, 2014 andParsons et al, 2015) Legend:…”

“…•: the criterion is fulfilled : the criterion is partially fulfilled ? : limited evidence because of no numerical data and only an interpretation Empty cell: data is not available Notes: 1 In the case of a partially fulfilled criterion, half of the point was taken into account in the total score; 2 Security culture is measured as (an independent) unidimensional concept; 3 Information about characteristics of the same scale is collected from several articles (Information security culture: Masrek et al, 2018a andMasrek et al, 2018b;ISCA: Da Veiga andMartins, 2015a andDa Veiga, 2015;IPCA: Da Veiga and Martins, 2015b;Da Veiga, 2016 andDa Veiga, 2018; Organisational information security culture: Parsons et al, 2014 andParsons et al, 2015) Legend:…”