Security Cultures in Organizations: A Theoretical Model

Development of a security culture in an organization needs an understanding of the factors that influence the security-related beliefs and behaviors of organizational members. Security culture in an organization includes the culture of management and the culture of employees. The focus of the current study is on the security culture of employees. First, we argue that the security culture of employees of an organization is not monolithic, but comprises a collection of the security sub-cultures of the diverse professional groups in the organization. Thus understanding security culture of employees equates to understanding the factors that influence the security sub-cultures of professional groups in the organization. Next, we argue that security-related beliefs (espoused security culture) may be different from the security-related behaviors (enacted security culture). Hence, models of security culture should incorporate both constructs. With these goals in mind, we propose a preliminary theoretical model of the security sub-cultures of professional groups in organizations.