# Factors Associated with Cybersecurity Culture: A Quantitative Study of Public E-health Hospitals in South Africa

Emilia N. Mwim, Jabu Mtsweni, Bester Chimbo

► To cite this version:

Emilia N. Mwim, Jabu Mtsweni, Bester Chimbo. Factors Associated with Cybersecurity Culture: A Quantitative Study of Public E-health Hospitals in South Africa. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.129-142, 10.1007/978-3-031-38530-8_11. hal-05462084

HAL Id: hal-05462084

https://inria.hal.science/hal-05462084v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# Factors Associated with Cybersecurity Culture:
A Quantitative Study of Public E-health
Hospitals in South Africa

Emilia N. Mwim<fnref n="1" />(✉), Jabu Mtsweni<fnref n="2" />,<fnref n="3" />, and Bester Chimbo<fnref n="1" />

**Abstract.** The healthcare sector has become a high target of cyber threats due to the nature of the industry and the potential of personal and confidential information. Human related factors have proven to be the major contributor to the challenges confronting cybersecurity across different domains. Addressing the human problem in cybersecurity calls for a coordinated and inclusive cybersecurity measure like Cybersecurity Culture (CSC). CSC has been argued as an essential cybersecurity measure that contributes to changing human behaviour in terms of their attitude, beliefs and values as well as their performance towards security that may impact positive security behaviour. Research work in CSC is limited in the healthcare sector as existing works focus on financial and insurance sectors. Following a quantitative research method, this paper conducted an empirical study to identify CSC factors that are associated with public e-health hospitals in South Africa. The findings revealed that under the component of preparedness are issues of awareness and competency as factors that are highly associated with CSC. Under management, lack of a cybersecurity team, top management support as well as rewards and punishment were identified. Factors relating to responsibility and environmental components were also identified to have an association with CSC among Information Technology users. Identifying the factors would assist in the development of a framework for establishing CSC in the hospitals which would form a base for hospitals in developing CSC in their settings.

**Keywords:** Healthcare · cybersecurity culture · cybersecurity culture factor · e-health

## 1 Introduction

The positive effect of technological innovations in the modern business process has grown rapidly causing operations in various sectors of life including the healthcare sector to rely vastly on Information Technology (IT) systems. Growing reliance on IT systems

<footnote n="1">¹ Department of Information System, School of Computing, College of Science Engineering and Technology, Unisa, Adelaide city centre, FL, South Africa
mwimen@unisa.ac.az, chimbb@unisa.ac.za</footnote>

<footnote n="2">² Head of Information and Cyber Security Centre, CSIR, Pretoria, South Africa</footnote>

<footnote n="3">³ SILGA, Stellenbosch University, Stellenbosch, South Africa</footnote>
in the delivery of healthcare (e-health) has been shown to improve the quality of health-
care through increased healthcare efficiency, patient accessibility, empowerment, effec-
tiveness, participatory consultation, and medical diagnosis [1–3]. The European Union
2012–2020 e-health Action plan indicates e-health ability to benefit a variety of stake-
holders starting with citizens, patients, healthcare professionals to health organisations
and public authorities [4]. Over the years, the benefits of e-health have grown to include:
patient diagnosis, treatment and care, improved efficiency, effectiveness, and quality
of health services to patients, faster and easier access and sharing of healthcare data,
decrease healthcare costs through administrative cost, system accuracy, participatory
consultation, time saving and patient monitoring [3, 5–7].

However, the increasing dependence on IT systems has made the sector highly vul-
nerable to cyber threats and risks affecting the security, privacy, availability and integrity
of healthcare data and IT systems. Recently, healthcare institutions have become a heavy
target of cyber threats such as ransomware, Denial of Service attacks (DoS)) and data
breaches [8, 9] placing the sector at number 2 of the largest data breach industry accord-
ing to reports by [8, 10, 11]. Security reports and other researchers have showed that a
substantial proportion of cybersecurity incidents in this sector are due to human related
issues and factors [9, 12–15].

The challenge is that the cybersecurity solutions applied towards addressing cyber
threats have predominately focused on technological measures [16, 17]. However, the
technical solution has proven insufficient on its own in addressing cybersecurity issues
due to lack of or limited inclusion of the human factor [16, 18–21]. This intensifies the
call for all-inclusive cybersecurity measures in the sector and research has argued that
cybersecurity culture is the solution as it accommodates elements of human factors and
their culture (beliefs, values, and attitude) [22–24].

Although research in the area of cybersecurity culture is still at its infancy stage
[25–27], it is beginning to gain momentum, but the healthcare sector is not receiving
sufficient attention as a highly targeted sector by cyber criminals. This could be because
work in CSC tends to focus on sectors like finance and insurance [28, 29].

To contribute to this area, empirical work was conducted to identify the CSC factors
that are associated with public healthcare institutions. This paper presents the research
aim and question in Sect. 2. Background on CSC including CSC components are provided
in Sects. 3 and 4. The method followed in conducting the empirical research and the
results are presented in Sect. 5. In Sect. 6, we present the discussion and the contribution
made by this research. Finally, Sect. 7 indicates the future work and concludes the paper.

## 2 Research Aim and Question

In this study, empirical research was conducted using a quantitative research method
with the aim being to identify factors of CSC components that are associated with
cybersecurity culture in the public e-health setting in South Africa. The main research
question answered in this paper is:

What are the factors that are associated with cybersecurity culture in the public
e-health institutions in South Africa?
# 3 Background

## 3.1 Cybersecurity Culture and Its Factors

Based on the systematic review conducted by [30], an informed and a comprehensive definition of cybersecurity culture was developed. This research adopts the definition as it provides an understanding of what constitutes cybersecurity culture.

"Cybersecurity culture is defined in this research as a measure (e.g. cybersecurity education, training and awareness) used as a performance tool by management (guided by policies and procedures) to change human characteristics and their socio-cultural measures (e.g. attitudes, assumptions, beliefs, norms, knowledge, perceptions, skills, behaviors and practices) to achieve cybersecurity at all levels of cybersecurity culture (i.e. international, national and organizational) to hinder intentional and unintentional cyber-harms"

The above definition was developed in [30] and adopted in this research because it emerged from definitions [28, 31–35] that have their basis in the related concepts of security culture, information security culture, and organizational culture.

The components that emerge strongly in the existing definitions of cybersecurity culture [23, 31, 36] are the importance of human characteristics, context (environment), and CSETA (Cybersecurity Education, Training, and Awareness). The above definition was developed to center around these components that are considered important when cybersecurity culture is discussed.

Significant efforts have been made to address cybersecurity challenges, however, there is a concern that the majority of those efforts have primarily been on technological solutions [16, 18, 34], which have independently proven insufficient to address cybersecurity issues because of threats emerging from human-related problems [16, 18, 37, 38]. This necessitates the implementation of non-technical (human factor) solutions, and cybersecurity culture is one such option.

A number of factors have been identified to be critical in relation to cybersecurity culture development, maintenance, best practices, and frameworks [22, 23, 26, 29, 39]. Examples of the top 10 cybersecurity culture factors highlighted in the literature are depicted in Table 1. For the full list of the identified factors and for the full explanations of all the factors together with their related literature, see [30].

<table><caption>**Table 1.** Cybersecurity culture factors.</caption><thead><tr><th colspan="2">Cybersecurity Culture</th></tr></thead><tbody><tr><td>Training and Education</td><td>Cybersecurity champion or team</td></tr><tr><td>Awareness</td><td>Organisational culture</td></tr><tr><td>Leadership support</td><td>Budget and resource</td></tr><tr><td>Cybersecurity policy</td><td>Human behavior</td></tr><tr><td>Knowledge and understanding</td><td>Engagement and encouragement</td></tr></tbody></table>
The identified factors are not only factors that constitute CSC; they are also factors that characterise, challenge, influence, and are used in the development of CSC can also be considered. The absence of these factors are regarded as a challenges that inhibit the cultivation and improvement of cybersecurity culture [26, 40] and are considered critical source factors for developing and strengthening CSC [40, 41].

Cybersecurity culture is an emerging field of research that is beginning to gain momentum recently with the development of factors, frameworks, models and implement steps [28–30, 42–44]). Notwithstanding that, the majority of empirical research in the literature on cybersecurity culture focused attention on other sectors [28], and limited empirical work exists in e-health [45]. This is considered a limitation in research which calls for more work and this research is positioned towards contributing to bridging the gap.

# 4 Cybersecurity Culture Components

With the help of existing cybersecurity culture frameworks or models and the framework of the Human Factors Domain (HFD) [28, 34, 35, 42, 43, 46] the consolidated cybersecurity culture factors were identified, mapped and categorized into four components of *preparedness, responsibility, management and environment*. Preparedness, responsibility, and management components relate to factors that are found at the internal organizational level while factors related to environmental component are found at the external non-organisational level.

Preparedness and responsibility relate to the organisational cybersecurity culture factors that are associated with individuals (employees). The component of preparedness and responsibility relate to the way employees act towards cybersecurity as such they are associated with human and behavioural factors or dimensions of beliefs, values, and attitudes which are the ground of organizational culture model layers [27, 28, 35, 42, 47, 48]. Ultimately employees’ behaviours which influence and are influenced by the culture of the organization as argued diversely by [28, 35] together with other factors (internal and external) play important role in achieving cybersecurity. Employees can be anyone operating at the leadership, group (department) and individual layer of the organization [28, 35, 42]. This means that employees’ behaviour can be official or unofficial and intentional or unintentional cybersecurity behaviours portrayed by individuals at the leadership, departmental and individual level [28, 35, 42]. The competency added to the human individual level component supports the dimension of knowledge that extended the information security model [47, 48].

**Preparedness** includes human individual factors like knowledge, awareness, self-efficacy, training and change of old practice [28, 42, 46].

**Responsibility** includes attitudinal factors such as employees’ practices and personality like the priority given to cybersecurity culture, their perception, acceptance, norms, and participation in relation to cybersecurity culture activities. Responsibility also relates to performances like monitoring and control, compliance as well as rewards and punishment [28, 46].

**Management** just like preparedness and responsibility is an internal cybersecurity culture element, management refers to actions and steps taken at the organizational
level. Organisational factors are also referred to as organisational mechanisms [28]. Therefore, the factors related to this element are under the control and authority of organization management [28, 34, 42, 46]. Examples of management factor element include cybersecurity policy, practices, security governance, organizational learning, assets, cybersecurity culture leadership, and communication issues [28, 42, 46].

**Environment** relates to the external non-organisational factors of cybersecurity culture. The element of environment includes factors outside the organization that the organization has limited control over. Examples of environment factors include emergence of new technology, laws and regulatory requirements, competition from peer institutions, and national or societal culture [28, 34, 35, 46].

**4.1 Model of the Cybersecurity Culture Components**

The various components of the cybersecurity culture discussed above are depicted using the model in Fig. 1.

<figure><img src="image_4.png" /><figcaption>Fig. 1. Model of cybersecurity culture components</figcaption></figure>

It is evident from Fig. 1 that cybersecurity culture factors correspond to the domains (called components in Fig. 1) of the HFD framework. As indicated in Sect. 3, the management domain relates to factors that are performed at the organisational level by the management of the organization. Preparedness and responsibility are associated with factors performed by humans and their culture at the individual level. Lastly, the environment domain relates to factors at the environmental level.

The comprehensiveness of the CSC components modelled in Fig. 1 is improved by relating them to the different categories of CSC factors. Organisational and individual
level factors are related to the internal organizational factors while environmental level factors are connected to the external organizational factors. This is also mostly true with categorization of the domains on the HFD framework. According to the framework, responsibility and preparedness are regarded as employee (individual) dimensions and the management domain falls under the organization dimension. The limitation is with environment domain which the authors categorised under organization dimension as a theme. With the help of well-established CSC frameworks, this is reformulated to a new thematic name called external factors in this paper. These CSC components were used as the based construct upon which the research empirical instruments were grouped for the instrument design, data collection, and analysis. The next section presents the method that was followed in conducting the empirical work.

# 5 Research Method

This paper followed a quantitative research method conducted through a manual and emailed based survey. Consent to participate was included as part of the questionnaire which was designed using the four CSC components as the basis of the survey sections. The questionnaire consisted of five sections. Section A was used to collect demographic information of the participants. Sections B, C, D, and E measured the components of preparedness, responsibility, management, and environment respectively using agreement legend. The rating scale consists of five statements that participants responded to. The statements are based on five agreement points indicating 1- strongly disagree to 5-strongly agree.

The survey instrument was piloted with 12 participants in a similar hospital setting to evaluate the instrument and the feedback received was used to correct and improve the instrument for research data collection. The categories of participants who contributed to the survey included only medical and administrative workers who make use of internet-based IT systems in their daily operations in the hospital and who have access to important confidential information. A total of 99 participants completed the questionnaire from the two hospitals in the Mpumalanga province. The questionnaire was distributed manually to the participants in their place of work, and some were emailed to doctors who were too busy to complete it manually at their facility. The small sample size number was because only a limited number of targeted audiences make use of internet-based IT systems in their daily operations in the hospitals where the data was collected.

Statistical Package for Social Sciences (SPSS) version 28.0 were used for the data analysis. Frequency tables were created to represent the demographic information of the participants. Cronbach's Alpha (α) was used to measure the internal consistency of the components questions and an acceptable threshold value of 0.70 according to [49, 50] was considered. Descriptive statistics were used to summarize the mean and standard deviation of the components measured and their individual items. Finally, Pearson correlation was used to measure the relations between the components.
# 6 Results

## 6.1 Demographical Information

Table 2 shows the demographic information of the 99 participants that responded to 120 questionnaires that were distributed. The demographic analysis covered includes age, and gender. The analysis depicted in terms of gender, 43.4% of the participants were male and 56.6% were female. Table 2 shows that the research participants are spread across different age ranges. Majority of the participants 32.3% fall between 21–30 age range. While 29.3% of them are under the age of 31–40, 20.2% are aged 41–50, and the participants between the age of 51–60 and 60+ contributed 15.2% and 3% respectively.

<table><caption>**Table 2.** Demographics of the participants</caption><thead><tr><th></th><th></th><th>Frequency</th><th>Percentage</th></tr></thead><tbody><tr><td rowspan="2">Gender</td><td>Male</td><td>43</td><td>43.4</td></tr><tr><td>Female</td><td>56</td><td>56.6</td></tr><tr><td rowspan="4">Age</td><td>Total</td><td>99</td><td>100.0</td></tr><tr><td>21–30</td><td>32</td><td>32.3</td></tr><tr><td>31–40</td><td>29</td><td>29.3</td></tr><tr><td>41–50</td><td>20</td><td>20.2</td></tr><tr><td rowspan="3">Age</td><td>51–60</td><td>15</td><td>15.2</td></tr><tr><td>60+</td><td>3</td><td>3.0</td></tr><tr><td>Total</td><td>99</td><td>100.0</td></tr></tbody></table>

## 6.2 Construct Reliability

The Cronbach Alpha values of all the research constructs were above or equal to the acceptable value of 0.7. The result in Table 3 shows that the values range from 0.786 to 0.900.

<table><caption>**Table 3.** Construct reliability</caption><thead><tr><th>Constructs (factors)</th><th>Cronbach's Alpha</th></tr></thead><tbody><tr><td>Awareness and Competency (A&C) (preparedness)</td><td>0.900</td></tr><tr><td>Attitude and Behaviors (A&B) (responsibility)</td><td>0.786</td></tr><tr><td>Management Cybersecurity Practices (MCP) (management)</td><td>0.855</td></tr><tr><td>Healthcare Environment (HE) (Environment)</td><td>0.786</td></tr></tbody></table>
## 6.3 Descriptive Statistics for the Cybersecurity Culture Factors

Table 4 depicts the descriptive statistics mean and standard deviation for the constructs studied. Table 4 also shows a combined mean and standard deviation of the components of preparedness, responsibility, management, and environment measured respectively.

The descriptive statistics for the preparedness show that participants are mostly not in agreement that they have the necessary awareness, knowledge and training of all cybersecurity items that tested this element. The indication is shown with a mean score of 2.496. The score of 2.7119 depicted for responsibility in Table 4 indicates that the participants are neutral in most of the cybersecurity attitude and behavioural items that measured the element of responsibility. For management, a mean of 2.5170 was depicted in Table 4 as a signal that participants are largely neutral on management component items. On the items that measure environment element, a mean of 3.3902 was shown which indicates that participants are neutral on the items of components.

<table><caption>**Table 4.** Descriptive Statistics</caption><thead><tr><td>Constructs</td><td>Mean</td><td>Std</td></tr></thead><tbody><tr><td>Awareness and Competency (A&C) (preparedness)</td><td>2.4963</td><td>.78282</td></tr><tr><td>Attitude and Behaviors (A&B) (responsibility)</td><td>2.7119</td><td>.52159</td></tr><tr><td>Management Cybersecurity Practices (MCP) (management)</td><td>2.5170</td><td>.61890</td></tr><tr><td>Healthcare Environment (HE) (Environment)</td><td>3.3902</td><td>.72256</td></tr></tbody></table>

## 6.4 Pearson Correlation Coefficients Analysis

Pearson correlation was used to measure the association between research variables. The aim was to determine the significance of the association between the research variables [51].

Observed correlations depicted in Table 5 are discussed below.

**Preparedness and Responsibility:** The Pearson correlation of preparedness and responsibility was positive ($r = .600$) and the relationship is statistically significant ($p-value < 0.001$). This indicates that the more prepared hospitals are in terms of cybersecurity by providing staff with the necessary cybersecurity training, education, and awareness there would be more positive attitude and behaviour towards cybersecurity (responsibility) among employee in their institution.

**Preparedness and Management:** These two components also show a positive correlation ($r = .555$) and they are statistically significant ($p-value < 0.001$). This relationship shows that a healthcare institution with more established cybersecurity practices by their management are likely to be more prepared in terms of cybersecurity issues.

**Preparedness and Environment:** These two components show no Pearson correlation between them ($r = .027$) and the ($p-value = 0.788$) greater than 0.05 significant
<table><caption>**Table 5. Correlations**</caption><thead><tr><th></th><th></th><th>A&C</th><th>A&B</th><th>MCP</th><th>HE</th><th>CSC</th></tr></thead><tbody><tr><td rowspan="3">A&C</td><td>Pearson Correlation</td><td>1</td><td></td><td></td><td></td><td></td></tr><tr><td>Sig. (2-tailed)</td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>N</td><td>99</td><td></td><td></td><td></td><td></td></tr><tr><td rowspan="3">A&B</td><td>Pearson Correlation</td><td>.600**</td><td>1</td><td></td><td></td><td></td></tr><tr><td>Sig. (2-tailed)</td><td>&lt;.001</td><td></td><td></td><td></td><td></td></tr><tr><td>N</td><td>99</td><td>99</td><td></td><td></td><td></td></tr><tr><td rowspan="3">MCP</td><td>Pearson Correlation</td><td>.555**</td><td>.536**</td><td>1</td><td></td><td></td></tr><tr><td>Sig. (2-tailed)</td><td>&lt;.001</td><td>&lt;.001</td><td></td><td></td><td></td></tr><tr><td>N</td><td>99</td><td>99</td><td>99</td><td></td><td></td></tr><tr><td rowspan="3">HE</td><td>Pearson Correlation</td><td>.027</td><td>.287**</td><td>.070</td><td>1</td><td></td></tr><tr><td>Sig. (2-tailed)</td><td>.788</td><td>.004</td><td>.493</td><td></td><td></td></tr><tr><td>N</td><td>99</td><td>99</td><td>99</td><td>99</td><td></td></tr><tr><td rowspan="3">CSC</td><td>Pearson Correlation</td><td>.850**</td><td>.815**</td><td>.817**</td><td>.242**</td><td>1</td></tr><tr><td>Sig. (2-tailed)</td><td>.000</td><td>.000</td><td>.000</td><td>.004</td><td></td></tr><tr><td>N</td><td>99</td><td>99</td><td>99</td><td>99</td><td>99</td></tr></tbody></table>

threshold is a sign of statistically insignificant outcome. This is an indication that in the healthcare institution, environmental factors are not regarded as central in relation to how the institutions prepare employees for cybersecurity matters.

**Responsibility and Management:** Although at a moderate level, a positive relationship was also found to exist between responsibility and management indicating a Pearson correlation of (r = .536) and the components are statistically significant (p-value < 0.001). This is an indication that the more there is a positive or negative action from the management in terms of cybersecurity practices, the more likely there are management engagement and support, cybersecurity term which could lead to a positive or negative responsibility from employees with regard to their attitude and behaviour towards cybersecurity actions.

**Responsibility and Environment:** The Pearson correlation between these variables were found to be positive but a weak relationship (r = .287) exists. The correlation is found to be significant (p-value < 0.004). This relationship shows that with an increase in the healthcare environment factors that influence employees, there could be an increase in the positive or negative attitudes and behaviours of the employee towards cybersecurity.

**Management and Environment:** The result in Table 5 found that no correlation exists between these variables (r = .070) and they were found to be insignificant (p-value >

<footnote>**. Correlation is significant at the 0.01 level Sig (2-tailed).</footnote>

<footnote>**. N = the number of participants</footnote>
0.05). This suggests that an increase in the healthcare environment issues could not lead to an increase in MCP within the hospital.

**Cybersecurity Culture:** The result in Table 5 found that there is a correlation between CSC and management, CSC and environment, CSC and responsibility, and CSC and preparedness.

# 7 Discussion and Contribution

In this section, the research question is addressed in relation to the results presented in the preceding section. This is followed by the contribution of the paper.

The main question asked in this paper was

*What are the factors that are associated with cybersecurity culture in the public e-health institutions in South Africa?*

Overall indication based on the Pearson correlation analysis is that the dominating positive correlation between the components and the highly significant indication of the relationships are evidence that meaningful association exists between the components except for the correlation between preparedness and environment, and management and environment. A conclusion can be reached that these components are significantly important in relation to CSC. Therefore, the factors attributed to these components can be associated with CSC in the e-health organisations.

The results from the analysis of the data further show evidence that preparedness is highly associated with CSC in an e-health setting. The preparedness factors which were identified to play a role and therefore need to be taken into consideration when developing a framework that would assist hospitals in establishing CSC include: providing appropriate cybersecurity awareness, education, and training. This finding confirms what is indicated in e-health literature which highlights lack of training and awareness as among the serious reasons why healthcare institutions are targeted by cyber-criminals [52, 53]. On a similar note, lack of cybersecurity awareness, education and training which are factors under preparedness was also indicated as among the factors that make the achievement of cybersecurity challenging to the e-health institutions [14, 54].

Factors under the component of management were also identified to have a correlation with CSC particularly issues relating to lack of a cybersecurity team or champions that handle cybersecurity issues, internal communication problems, and the fact that top management provides limited support in relation to cybersecurity issues. Top management support and the existence of a cybersecurity team were among the top ten CSC factors [30] that organization needs to be serious in relation to CSC [22, 29, 34, 55] as it has link with other factors like budget, resource and cybersecurity policy. The responsibility factors identified include lack of collaboration and interaction on cybersecurity issues among employees and between departments of the hospitals. These factors were also highlighted as factors of CSC in the review conducted by [30].

Lastly, environmental factors include the changing landscape of cybersecurity threat that confronts the sector, cybersecurity regulations of the country, as well the fact e-health professionals have many industry regulations and guidelines to be adhered to. Emerging
new cybersecurity threats was identified as one of the challenges of cybersecurity in e-health sectors [54] and the reason why the sector is targeted [56].

By answering the research question asked in this paper, through the quantitative research method, the study contributes to the body of knowledge by identifying the CSC factors of the CSC components that are associated with public healthcare institutions. In this study, a new theme was formulated to replace environmental factors which are categorized under organization, which is replaced by external factors that are classified under organization as well. This is also a contribution to the field of CSC.

## 8 Limitations and Future Work

The major limitation of the work is the small sample size. This will be complemented by conducting qualitative research which the researchers are busy with to get the perspective of ICT staff in the same hospitals on the factors of the components that are associated with CSC. The information obtained with the qualitative data will be compared with information obtained from quantitative data in this research. The compared information would assist with a final decision on the factors to be used for the development of CSC contextual framework for the establishment of CSC in e-health settings which would be the outcome of the bigger project.

## 9 Conclusion

This research conducted an empirical study using a quantitative research method to identify factors of CSC components that are associated with CSC in e-health public hospitals in South Africa. The findings revealed the existence of meaningful correlation and high significance between the components except for correlation between preparedness and environment, and relationship between management and environment. The finding also show a significant relationship between CSC and all the four components.

Examples of factors that are associated with CSC in the e-health public identified in this research include: awareness, education, and training top management support, establishment of cybersecurity team, lack of collaboration, and lastly emerging new threats and regulations. These factors relate to the four CSC components of preparedness management, responsibility, and environment respectively.

## References

1. Horner, A., Rautenbach, P., Mbananga, N., Mashamba, T., Kwinda, H.: An e-health decision support system for improving compliance of health workers to the maternity care protocols in South Africa. Appl. Clin. Inform. 4(1), 25–36 (2013)

2. Krüger, K., Strand, L., Geitung, J., Eide, G., Grimsmo, A.: Can electronic tools help improve nursing home quality? Int. Sch. Res. Not. 2011, 1–8 (2011)

3. Mandava, M., Lubamba, C., Ismail, A., Bagula, A., Bagula, H.: Cyber-healthcare for public healthcare in the developing world,” In: Proceedings of IEEE Symposium on Computer and Communications, pp.14–19, (2016)
4. Europaean Commissio.: eHealth Action Plan 2012–2020: Innovative Healthcare for the 21st Century, (2012). https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2012:0736: FIN:EN:PD

5. An Roinn Slainte Department of Health.: eHealth Strategy for Ireland (2013)

6. Wikler, E., Bausch, P., Cutler, D.: Paper Cuts: Reducing Health Care Administrative Costs, Center for American Progress, Washington, DC (2012). https://dash.harvard.edu/bitstream/ handle/1/17190515/33796/papercuts_final.pdf?sequence=1

7. Yüksel, B., Küpçü, A., Özkasap, Ö.: Research issues for privacy and security of electronic health services. Futur. Gener. Comput. Syst. **68**, 1–13 (2017). https://doi.org/10.1016/j.future. 2016.08.011

8. ITRC.: 2018 END-OF-YEAR DATA BREACH Report, (2019). https://www.idtheftcenter. org/wp-content/uploads/2019/02/ITRC_2018-End-of-Year-Aftermath_FINAL_V2 Combin edWEB.pdf. Accessed 23 June 2020

9. Ponemon Institute.: 2017 Cost of Data Breach Study Global Overview, (2018). https://www. ponemon.org/blog/2017-cost-of-data-breach-study-united-states%0Ahttps://www.ibm.com/ security/data-breach.

10. Identity Theft Resource Center (ITRC).: 2019 END-OF-YEAR DATA BREACH REPORT (2020). https://www.idtheftcenter.org/wp-content/uploads/2020/01/01.28.2020_I TRC_2019-End-of-Year-Data-Breach-Report_FINAL_Highres-Appendix.pdf

11. Statista.: Statistic U.S. data breaches by industry 2019 | Statista (2020). https://www.statista. com/statistics/273572/number-of-data-breaches-in-the-united-states-by-business/. Accessed 25 Jun 2020

12. Murphy, S.: Healthcare Information Security and Privacy, 1st edn. McGraw - Hill Education Group, New York (2015)

13. Ponemon Institute.: Cost of a Data Breach Report 2019, IBM Security (2019)

14. Ghafur, S., Grass, E., Jennings, N., Darzi, A.: The challenges of cybersecurity in health care: the UK national health service as a case study. Lancet Dig. Health **1**(1), 10–12 (2019)

15. Roohparvar, R.: 5 Industries that Top the Hit List of Cyber Criminals in 2017, Infoguard Cyber Security (2017). http://www.infoguardsecurity.com/5-industries-top-hit-list-cyber-cri minals-2017/. Accessed 10 May 2019

16. Van ‘t Wout, C.: Develop and maintain a cybersecurity organisational culture. In: Proceedings of the 14th International Conference on Cyber Warfare and Security (ICCWS), pp. 457–466 (2019)

17. Holdsworth, J., Apeh, E.: An effective immersive cyber security awareness learning platform for businesses in the hospitality sector. In: Proceedings of the 25th IEEE International Requirements Engineering Conference Workshops (REW), pp. 111–117 (2017)

18. Gcaza, N., Von Solms, R., Van Vuuren, J.: An ontology for a national cyber-security culture environment. In: Proceedings of the 9th International Symposium on Human Aspects of Information Security & Assurance (HAISA 2015), pp. 1–10 (2015)

19. Kotz, D., Gunter, C., Kumar, S., Weiner, J.: Privacy and security in mobile health: a research agenda. Computer **49**(6), 22–30 (2016)

20. Grobler, M., van Vuuren, J.: Broadband broadens scope for cybercrime in Africa. In: Pro- ceedings of the 2010 IEEE Information Security for South Africa conference, pp. 1–8 (2010)

21. Marotta, A., Pearlson, K.: A culture of cybersecurity at Banca Popolare di Sondrio. In: Proceedings of the 25th Americas Conference on Information Systems (AMCIS), pp. 1–10 (2019)

22. Branley-bell, D., Coventry, L., Sillence, E.: Promoting cybersecurity culture change in health- care. In: Proceedings of the 14th PErvasive Technologies Related to Assistive Environments Conference, pp. 544–549 (2021)
23. Corradini, I.: Building a cybersecurity culture. In: Building a Cybersecurity Culture in Organizations. SSDC, vol. 284, pp. 63–86. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-43999-6_4

24. Ismail, W., Yusof, M.: Mitigation strategies for unintentional insider threats on information leaks. Int. J. Secur. Appl. **12**(1), 37–46 (2018)

25. Gcaza, N.: A National Strategy towards Cultivating a Cybersecurity Culture in South Africa. PhD thesis, Nelson Mandela Metropolitan University Port Elizabeth, South Africa 1–380 (2017)

26. Gcaza, N., Von Solms, R.: A strategy for a cybersecurity culture: a South African perspective. Electron. J. Inf. Syst. Developing Countries **80**(1), 1–17 (2017)

27. Reid, R., Van Niekerk, J.: From information security to cyber security cultures. In: Proceedings of the 2014 Information Security for South Africa (ISSA) Conference, pp. 1–7 (2014)

28. Huang, K., Pearlson, K.: For what technology can't fix: building a model of organizational cybersecurity culture. In: Proceeding of the 52nd Hawaii International Conference on System Sciences, pp. 6398–6407 (2019)

29. Alshaikh, M.: Developing cybersecurity culture to influence employee behavior: a practice perspective. Comput. Secur. **98**, 102003 (2020)

30. Mwim, E., Mtsweni, J.: Systematic review of factors that influence the cybersecurity culture research aims. In: Clarke, N., Furnell, S. (eds.) Human Aspects of Information Security and Assurance HAISA 2022. IFIP Advances in Information and Communication Technology, vol. 658, pp. 147–172. Springer, Heidelberg (2022). https://doi.org/10.1007/978-3-031-12172-2_12

31. Abeyratne, R.: Rulemaking in Air transport: A Deconstructive Analysis. Springer, Switzerland, vol. 252 (2016). https://doi.org/10.1007/978-3-319-44657-8

32. Ciuperca, E.M., Vevera, V., Cirnu, C.: Social variables of cyber security educational programmes. In: Proceeding of the 15th International Scientific Conference eLearning and Software for Education Bucharest, Bucharest, pp. 190–194 (2019)

33. Da Veiga, A., Astakhova, V., Botha, A., Herselman, M.: Defining organisational information security culture - Perspectives from academia and industry. Comput. Secur. **92**, 101713 (2020)

34. European Union Agency for Network and Information Security (ENISA): Cyber Security Culture in Organisations. (2017). www.enisa.europa.eu

35. Da Veiga, A.: Achieving a Security Culture. In: Cybersecurity Education for Awareness and Compliance, pp. 72–100. IGI Global (2018)

36. Reid, R., Van Niekerk, J.: Towards an education campaign for fostering a societal, cyber security culture. In: Proceeding of the 8th International Symposium on Human Aspects of Information Security & Assurance (HAISA), pp. 174–184 (2014)

37. Ponemon Institute.: The Rise of Ransomware. Ponemon Institute LLC (2017). https://www.ponemon.org/local/upload/file/Ransomware. Report Final 1.pdf. Accessed 11 July 2020

38. Gcaza, N., Von Solms, R., Grobler, M., Van Vuuren, J.: A general morphological analysis: delineating a cyber-security culture. Inf. Comput. Secur. **25**(3), 259–278 (2017)

39. Ogden, S.: Cybersecurity: Creating a Cybersecurity Culture. Master thesis. California State University, San Bernardino (2021)

40. ISACA.: The Business Impact of a Cybersecurity Culture. ISACA (2018)

41. Gundu, T., Maronga, M., Boucher, D.: Industry 4.0 business perspective: fostering a cyber security culture in a culturally diverse workplace. In: Proceedings of the 4th International Conference on the Internet, Cyber Security and Information Systems. Kalpa Publication in Computing, pp. 85–94 (2019)

42. Georgiadou, A., Mouzakitis, S., Bounas, K., Askounis, D.: A cyber-security culture framework for assessing organization readiness. J. Comput. Inf. Syst. **62**, 1–11 (2020)
43. Bounas, K., Georgiadou, A., Kontoulis, M., Mouzakitis, S., Askounis, D.: Towards a cyber-security culture tool through a holistic, multi-dimensional assessment framework. In: Proceedings of the 13th IADIS International Conference Information Systems (IS), pp. 135–139 (2020)

44. Van Vuuren, J.: Methodology and Model to Establish Cybersecurity for National Security in Africa using South Africa as a Case Study. PhD thesis, University of Venda, Limpopo, South Africa (2016)

45. Georgiadou, A., Mouzakitis, S., Askounis, D.: Designing a cyber-security culture assessment survey targeting critical infrastructures during COVID-19 crisis. Int. J. Netw. Secur. IT's Appl. **13**(1), 33–50 (2021)

46. Alhogail, A., Mirza, A., Bakry, S.H.: A comprehensive human factor framework for information security in organizations. J. Theor. Appl. Inf. Technol. **78**(2), 201–211 (2015)

47. Schein, E.: Organizational Culture and Leadership, 3rd edn. Jossey-Bass, San Francisco, California (2004)

48. Van Niekerk, J., von Solms, R.: Information security culture: a management perspective. Comput. Secur. **29**(4), 476–486 (2010)

49. DeVillis, F. Scale Development: Theory and Applications, FOURTH. SAGE, Los Angeles (2017)

50. Streiner, D.: Starting at the beginning an introduction to coefficient alpha and internal consistency. J. Pers. Assess. **80**(1), 99–103 (2003)

51. Chalil, K.: Statistical Methods for Development Research: Correlation (2020)

52. Zetter, K.: Why Hospitals Are the Perfect Targets for Ransomware. WIRED (2016). https://www.wired.com/2016/03/ransomware-why-hospitals-are-the-perfect-targets/. Accessed 02 July 2020

53. Mello, J.: Healthcare Security $65 Billion Market. Cybersecurity Ventures (2017). https://cybersecurityventures.com/healthcare-cybersecurity-report-2017/. Accessed 06 Oct 2020

54. Kruse, C., Frederick, B., Jacobson, T., Monticone, D.: Cybersecurity in healthcare: a systematic review of modern threats and trends. Technol. Health Care **25**(1), 1–10 (2017)

55. Uchendu, B., Nurse, J., Bada, M., Furnell, S.: Developing a cyber security culture: current practices and future needs. Comput. Secur. **109**, 102387 (2021)

56. Martin, G., Martin, P., Hankin, C., Darzi, A., Kinross, J.: Cybersecurity and healthcare: How safe are we? Brit. Med. J. 358 (2017)