Impediments to Cybersecurity Policy Implementation in Organisations: Case Study of Windhoek, Namibia

Abstract

The increasing dependence on digital infrastructure has exposed organisations to heightened risks of cyber-attacks, necessitating the implementation of comprehensive cybersecurity policies. These policies aim to safeguard organisational data by establishing security requirements, ranging from acceptable use and access controls to incident response and encryption protocols. However, despite the critical importance of these policies, their effective implementation often encounters significant challenges. This study investigates the impediments to cybersecurity policy implementation within Namibian organizations, focusing on the perspectives of IT managers and employees. Using a qualitative research approach, interviews were conducted with 8 IT managers and 12 employees across various organisations to identify the key obstacles faced in adhering to and enforcing these policies. The findings reveal that the major impediments include a lack of executive and leadership support, challenges with compliance and policy adherence by employees, insufficient training and awareness, budget and resource constraints, poor communication, and the influence of human factors. This research underscores the need for a multifaceted approach to overcoming these impediments, emphasizing the importance of strong leadership, continuous and practical training, adequate resource allocation, and transparent communication. Building a cybersecurity culture within organizations is essential to mitigate these challenges and ensure the effective implementation of cybersecurity policies, thereby enhancing organizational resilience against cyber threats. The study recommends that future research should expand the sample size to include a more diverse group of participants from various organizations and sectors across Namibia. This broader representation would provide a more comprehensive understanding of the issues, reveal sector-specific challenges, and ensure that the findings are more generalizable across different industries and contexts.