Information security culturem ?

 Employee behavior can have a big impact on information security in organizations. Cultural concepts can help different segments of the organization work effectively or work against effectiveness towards information security within an organization. Information security culture is the "...totality of patterns of behavior in an organization that contributes to the protection of information of all kinds."

Andersson and Reimers (2014) found that employees often do not see themselves as part of their organization's information security effort and often take actions that impede organizational changes. Indeed, the Verizon Data Breach Investigations Report 2020, which examined 3,950 security breaches, discovered 30% of cyber security incidents involved internal actors within a company. Research shows information security culture needs to be improved continuously. In ″Information Security Culture from Analysis to Change″, authors commented, ″It's a never-ending process, a cycle of evaluation and change or maintenance.″ To manage the information security culture, five steps should be taken: pre-evaluation, strategic planning, operative planning, implementation, and post-evaluation.

• Pre-evaluation: To identify the awareness of information security within employees and to analyze the current security policies.
• Strategic planning: To come up with a better awareness program, clear targets need to be set. Assembling a team of skilled professionals is helpful to achieve it.
• Operative planning: A good security culture can be established based on internal communication, management-buy-in, security awareness and a training program.
• Implementation: Four stages should be used to implement the information security culture. They are:

1. Commitment of the management
2. Communication with organizational members
3. Courses for all organizational members
4. Commitment of the employees

• Post-evaluation: To assess the success of the planning and implementation, and to identify unresolved areas of concern.