Design and validation of information security culture framework

Abstract

Establishing information security culture in organizations impacts employees’ perceptions and security behavior in a way that can guard against many information security threats posed by insiders. This paper is concerned with the development of a comprehensive information security culture framework for organizations. The structured STOPE (Strategy; Technology; Organization; People; and Environment) scope has been used as a base for the framework so that the various issues of information security can be integrated. The resulted framework incorporates the four main domains of the human factor diamond: preparedness, responsibility, management, and society and regulations. The framework also incorporates change management principles that guide the cultivation of the information security culture. The framework is validated by surveying experts to provide their views and feedback on the correctness and comprehensiveness of the framework structure and its associated tasks. The framework can assist organizations to develop an effective information security culture that protects their information assets.