The effect of perceived organizational culture on employees’ information security compliance

Abstract

Purpose This paper aims to investigate the connection between different perceived organizational cultures and information security policy compliance among white-collar workers. Design/methodology/approach The survey using the Organizational Culture Assessment Instrument was sent to white-collar workers in Sweden (n = 674), asking about compliance with information security policies. The survey instrument is an operationalization of the Competing Values Framework that distinguishes between four different types of organizational culture: clan, adhocracy, market and bureaucracy. Findings The results indicate that organizational cultures with an internal focus are positively related to employees’ information security policy compliance. Differences in organizational culture with regards to control and flexibility seem to have less effect. The analysis shows that a bureaucratic form of organizational culture is most fruitful for fostering employees’ information security policy compliance. Research limitations/implications The results suggest that differences in organizational culture are important for employees’ information security policy compliance. This justifies further investigating the mechanisms linking organizational culture to information security compliance. Practical implications Practitioners should be aware that the different organizational cultures do matter for employees’ information security compliance. In businesses and the public sector, the authors see a development toward customer orientation and marketization, i.e. the opposite an internal focus, that may have negative ramifications for the information security of organizations. Originality/value Few information security policy compliance studies exist on the consequences of different organizational/information cultures.

COVID-19 pandemic-induced organisational cultural shifts and employee information security compliance behaviour: a South African case study

“…Hu et al (2012) and Solomon and Brown (2021), hence, used only the control orientations RO and GO to assess the role of culture in information security compliance behaviour. However, Karlsson et al (2022) claim cultural differences in control (RO, GO) and flexibility (SO, IO) have little bearing on compliance behaviour, with an internal (RO, SO) focus in contrast to an external focus (GO, IO) being more salient. The SO and IO orientations have rarely been examined in information security research (Hu et al , 2012; D'Arcy and Greene, 2014; Tang and Li, 2016; Solomon and Brown, 2021).…”

“…Hence, there have been numerous studies directed at understanding and explaining employee compliance behaviour (Alassaf and Alkhalifah, 2021; Cram et al , 2019; Moody et al , 2018). Factors directly and indirectly influencing compliance behaviour are many and varied, with organisation culture playing a key role (Hu et al , 2012; Ali et al , 2021; Karlsson et al , 2022). Similarly fostering an information security culture has been touted as a means of improving employee information security compliance behaviour (Dong et al , 2021; Alshaikh, 2020; Alshare et al , 2018).…”

“…The SO and IO orientations have rarely been examined in information security research (Hu et al , 2012; D'Arcy and Greene, 2014; Tang and Li, 2016; Solomon and Brown, 2021). In this study, as with Karlsson et al (2022), all four orientations will be used to characterise culture. We go further, however, by examining both organisation and information security across all four orientations (see Table 1 below).…”

“…Figure 1 below is illustrative of the conceptual framing for the study. Prior research has demonstrated that organisational culture, across a range of dimensions, influences employee information security compliance behaviour (Hu et al , 2012; Solomon and Brown, 2021; Karlsson et al , 2022). Similarly information security culture has been shown as influential on compliance behaviour (D'Arcy and Greene, 2014; Solomon and Brown, 2021).…”

What Triggers Violation of Information Security Policies

“…Organizations with a bureaucratic organizational structure must recognize the benefit provided by this structure and weigh it carefully when confronted with opportunities for more customer-centric modes of operation. [12]…”