Conceptualizing and Validating Information Security Culture as a Multidimensional Second-Order Formative Construct

This paper discusses a pilot study on conceptualization and validation of Information Security Culture (ISC) as a multidimensional second-order formative construct. The concept was developed in our previous works, and is based on widely accepted concepts of Organizational Culture and ISC. The model is validated using samples from employees of one Malaysia Public University. The Partial Least Squares Approach to Structural Equation Modeling (PLSSEM) using Smart-PLS software was used to model and analyse the data. The ISC construct was treated as reflective formative second-order construct and analysed using the latest approach in PLS-SEM. The findings empirically support the conceptualization and validation of ISC as a reflective formative second-order construct with all seven dimensions being significant in contributing to the underlying concept of ISC. The study contributes to the ISC literature by providing new insights on the conceptualization, operationalization and validation of ISC the concept based on widely accepted concepts and approaches.