# Systematic Review of Factors that Influence the Cybersecurity Culture

Emilia N. Mwim, Jabu Mtsweni

► To cite this version:

Emilia N. Mwim, Jabu Mtsweni. Systematic Review of Factors that Influence the Cybersecurity Culture. 16th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2022, Mytilene, Lesbos, Greece. pp.147-172, 10.1007/978-3-031-12172-2_12. hal-05324920

HAL Id: hal-05324920

https://inria.hal.science/hal-05324920v1

Submitted on 21 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Systematic Review of Factors that Influence the Cybersecurity Culture

Emilia N. Mwim<fnref n="1" />(✉) and Jabu Mtsweni<fnref n="2" />

mwimen@unisa.ac.za

jmtsweni@csir.co.za

**Abstract.** There is a need to shift from a purely technological approach in addressing cybersecurity threats to a more human inclusive method. As a result, cybersecurity culture is gaining momentum in research as an approach in addressing cybersecurity challenges due to human related issues. To develop a better understanding of cybersecurity culture, this paper presents a comprehensive view of cybersecurity culture (CSC) factors. These holistic cybersecurity culture factors have been developed by conducting a detailed review of literature. A total of 539 records were initially identified from seven different databases and via other sources, from which 58 records were finally selected using focused inclusion and exclusion criteria. The review identified a total of 29 cybersecurity culture factors, with security education, training, and awareness (SETA), and top management or leadership support appearing among the 10 dominant factors. The researchers produced a consolidated list of factors for CSC that can guide future researchers in this research area.

**Keywords:** Cybersecurity · Cybersecurity culture · Cybersecurity culture factor

## 1 Introduction

Cyber threats are considered a global concern across all levels of society [1, 2]. To minimise cyberthreats and their associated challenges, various technological and non-technological solutions have been applied [3, 4]. Examples of efforts focused on developing cybersecurity regulations and legislation are the development of the Health Insurance Portability and Accountability Act (HIPAA) of 1996 [104–191], the Protection of Personal Information (POPI) Act, the International Organization for Standardization (ISO), and the National Institute of Standards and Technology Cybersecurity Framework (NIST) [5–9]. The non-regulatory measures include the development and use of anti-virus software, firewall protection, encryption, and the development of policies and standards [10–14].

<footnote n="1">¹ Department of Information System, School of Computing, College of Science Engineering and Technology, Unisa, Florida, South Africa</footnote>

<footnote n="2">² Head of Information and Cyber Security Centre, CSIR, Pretoria, South Africa</footnote>
Despite all these efforts, however, cyber threats and challenges continue to increase [14]. It is argued that the core reason for the increase is that all the efforts have focused predominantly on technological solutions which on their own cannot minimise cyber-security threats due to the element of human vulnerabilities [14]. Solving cybersecurity problems requires more than technical controls, as the human factor in security is becoming increasingly prominent, alongside technical issues [15–17]. According to research, the appropriate approach to address the human factor problem of information security is the cultivation of an information security culture [15, 17]. Similarly, to solve the human factor problem in cybersecurity, it is argued that the solution should focus on human factors by cultivating a cybersecurity culture [17]. Cybersecurity culture is still an emerging research field, which has not been well researched [17–20]. To contribute to the body of knowledge, the researchers in this study tried to provide a consolidated and holistic list of cybersecurity culture factors by conducting a systematic review. As an emerging research area, the identified factors in this research will future serve as a point of reference for fellow researchers in this area.

## 2 Research Aims

In this research, a systematic literature review process [21] was applied using the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) method to develop a comprehensive list of cybersecurity culture factors that can be used as a basis for researchers working in the field of cybersecurity culture. The objective of this paper is to provide a holistic review of literature that is specific to the cybersecurity culture.

The results are combined and synthesised to develop a consolidated list of cybersecurity culture factors that can be used as a point of reference for cybersecurity culture research in the future.

## 3 Background

During the review, the researchers came across different definitions and description of cybersecurity culture that exist in literature [10, 17, 22–25]. The elements that emerge out very strongly in the existing definitions of cybersecurity culture include human characteristics, context and SETA. The definition of cybersecurity culture in this research is informed by the existing definitions.

"Cybersecurity culture" is defined in this research as a measure used as a performance tool by management (guided by policies and procedures) to change human characteristics and their socio-cultural measures (e.g. attitudes, assumptions, beliefs, norms, knowledge, perceptions, skills, behaviours and practices) to achieve cybersecurity at all levels of cybersecurity culture (i.e. international, national and organizational) to hinder intentional and unintentional cyber-harms.
Significant efforts have been made in addressing cybersecurity challenges, but there is a concern that the majority of the efforts have focused predominantly on technological solutions [10, 14, 26], which on their own have proven insufficient in addressing cybersecurity problems because of threats emerging from human related problems [14, 16, 20, 26, 27]. This calls for the establishment of measures that will incorporate human factor elements (non-technical solutions) and cybersecurity culture is one such measures.

Up until now, the work done in the area of cybersecurity and information security culture: has (1) focused predominantly on information Security culture (ISC) [2, 28–30] and (2) the reviews on CSC have not been sufficiently comprehensive as they have focused only on cybersecurity culture at a specific level (either at the international, national or organisational levels) [31, 32]; as such, there is no consolidated and comprehensive list of cybersecurity culture factors. Consequently, the majority of cybersecurity culture factors consolidated in most reviews are factors that influence the cultivation of cybersecurity culture at the organisational level and there is no consolidated and comprehensive list of factors that influences cybersecurity culture in literature. This is a major limitation in research, which intensifies the need to take a more comprehensive approach in identifying holistic and all-inclusive factors of cybersecurity culture.

# 4 Information Security and Cybersecurity

Over the years researchers have considered information security and cybersecurity to be the same hence the terms are used interchangeably [33–35]. Research has argued that using the terms synonymously confuses research communities and security practitioners thereby obscuring the main difference between the two concepts and that extends to information security culture and cybersecurity culture [20]. Although in most cases the information security and cybersecurity are used interchangeably, a profound difference exist between them according to literature [17, 19, 36, 37]. In addition to other differences between the terms, the critical distinction between them is based on the fact that information security focuses on the protection of information within the organizational context while cybersecurity extends to the outside borders of the organization since cyberspace allows the sharing of information outside the borders of the organization [17]. The same approach applies to information security culture and cybersecurity culture. The two concepts both refer to culture as it relates to security with the main difference being in the context they are applied. On this ground, this research finds it needful to review literature specifically on cybersecurity culture to help consolidate list of factors that are associated with cybersecurity culture.

# 5 Research Method

The paper followed a systematic literature review method using the PRISMA technique [38]. The PRISMA guideline for performing systematic reviews makes use of cautiously designed methods that enables the selection and review of relevant records and an analysis of the findings that emerge from the literature.
This review used four phases, as contained in the PRISMA diagram. The following study selection steps were taken in this research:

* Publications in the academic databases and non-academic databases were searched. The focus of the retrieved literature related to cybersecurity culture at all levels (international, national and organisational).

* After reviewing the title and abstract, duplicates articles were removed.

* The remaining records (after the removal of duplicates) were saved on the researchers computers and from there, imported into ATLAS.ti for final review.

* During the review, other articles were removed either because the content covered in the article was not predominantly focused on cybersecurity culture or because the paper used the concept of information security culture as a synonym for cybersecurity culture. Lastly, a few more articles were added from the references of the reviewed articles.

## 5.1 Data Sources and Selection Criteria

The researchers conducted a search of peer-reviewed literature through the databases depicted in Fig. 1.

Cybersecurity is a broad and multi-disciplinary research area that cuts across various industrial sectors. To ensure a rigorous search for the systematic review on cybersecurity culture, the literature search included both computing and non-computing databases. The search included peer-reviewed academic publications and a few other non-academic publications, which were included to accommodate industry, business and experts' writings on the topic of cybersecurity culture. The search was conducted between December 2010 and March 2021 and the following key words were used in the search:

* "cybersecurity culture" OR "cyber security culture".

* "cybersecurity cultur*" OR "cyber security culture*".

After the search, alerts were also set up for the keywords to identify any important literature that might be published after the search so that these sources could be added during the review.

The searched databases, together with the number of retrieved records, is depicted in Fig. 1.

<figure><img src="image_3.png" /><figcaption>**Fig. 1.** Systematic review search database</figcaption></figure>
The following inclusion criteria (IC) were used:

IC1 - the year range- (e.g. papers published between 2010 and 2021)

IC2 - only articles published in English

IC3 - published work in the form of journal articles, conference proceedings, policy documents, book chapters, theses, reports and/or statistics

IC4 - cybersecurity culture studies conducted at all levels of cybersecurity culture (where available, that included cybersecurity culture research done at international, national and organisational levels)

The review excluded (EX) any of the following papers:

EX1 - those that fell outside the stipulated year range (2010 – 2021)

EX2 - those not published in English

EX3 - those whose content was not predominantly cybersecurity culture

EX4 - those that covered predominantly information security culture.

## 5.2 Results

The keyword search yielded a total of 539 articles. After all the retrieved articles were assembled, 39 duplicates were removed. Upon review of the titles and abstracts, a further 423 records were removed because they were either irrelevant or included editor's notes. A total of 77 articles were retained for full-text review. Thereafter, 19 records were removed when the last inclusion criteria (IC) criteria was applied, which excluded those sources where cybersecurity culture was not the focus of the research, the concept was mentioned only in passing or it was an information security paper. After all these exclusions, a total of 58 records were deemed relevant for inclusion in the review to address the main research objective, which was to identify holistic factors that influence cybersecurity culture. Figure 2 depicts the PRISMA method used.
<figure><img src="image_4.png" /><figcaption>Fig. 2. PRISMA flow process</figcaption></figure>

Table 1 presents the full list of all the documents reviewed and their references, as organised in ATLAS.ti.
<table><caption>**Table 1.** List of reviewed documents and their references</caption><thead><tr><td>Document #</td><td>Author/s & year</td><td>Document #</td><td>Author/s & year</td></tr></thead><tbody><tr><td>D1</td><td>Abeyratne, 2016 [23]</td><td>D35</td><td>Pătrascu, 2019 [64]</td></tr><tr><td>D2</td><td>Alshaikh, 2020 [40]</td><td>D36</td><td>Paul & Porche, 2012 [65]</td></tr><tr><td>D3</td><td>Bounas et al., 2020 [76]</td><td>D37</td><td>Pavlova, 2020 [48]</td></tr><tr><td>D4</td><td>Cardoso et al., 2017 [44]</td><td>D38</td><td>Ramluckan et al., 2020 [78]</td></tr><tr><td>D5</td><td>Ciuperca et al., 2019 [24]</td><td>D39</td><td>Reegård et al., 2019 [43]</td></tr><tr><td>D6</td><td>Clark et al., 2017 [52]</td><td>D40</td><td>Reid & Van Niekerk, 2014a [15]</td></tr><tr><td>D7</td><td>Saigushev et al., 2020 [25]</td><td>D41</td><td>Reid & Van Niekerk, 2014b [17]</td></tr><tr><td>D8</td><td>Corradini, 2020 [22]</td><td>D42</td><td>Reid & Van Niekerk, 2015 [72]</td></tr><tr><td>D9</td><td>Da Veiga, 2016 [80]</td><td>D43</td><td>Ribeiro, 2019 [75]</td></tr><tr><td>D10</td><td>Simona, 2019 [54]</td><td>D44</td><td>Trim & Upton, 2016 [71]</td></tr><tr><td>D11</td><td>ENISA, 2017 [10]</td><td>D45</td><td>Wierzynski, 2019 [66]</td></tr><tr><td>D12</td><td>Gcaza & Von Solms, 2017a [19]</td><td>D46</td><td>Van't Wout, 2019 [14]</td></tr><tr><td>D13</td><td>Gcaza et al., 2017 [20]</td><td>D47</td><td>Lewis, 2020 [67]</td></tr><tr><td>D14</td><td>Gcaza, 2017 [18]</td><td>D48</td><td>Rinchi, 2021 [68]</td></tr><tr><td>D15</td><td>Gcaza & Von Solms, 2017b [39]</td><td>D49</td><td>Marotta & Pearlson, 2019 [27]</td></tr><tr><td>D16</td><td>Aiken, 2019 [50]</td><td>D50</td><td>Gcaza et al., 2015 [11]</td></tr><tr><td>D17</td><td>Georgiadou et al., 2020 [53]</td><td>D51</td><td>Da Veiga, 2018 [47]</td></tr><tr><td>D18</td><td>Georgiadou et al., 2020 [73]</td><td>D52</td><td>Ronchi, 2019 [69]</td></tr><tr><td>D19</td><td>Georgiadou et al., 2021 [74]</td><td>D53</td><td>Branley-bell et al., 2021 [41]</td></tr><tr><td>D20</td><td>Ghernaouti et al., 2019 [79]</td><td>D54</td><td>Uchendu et al., 2021 [31]</td></tr><tr><td>D21</td><td>Ghernouti-Hélie, 2010 [56]</td><td>D55</td><td>Alvarez-Dionisi & Urrego-Baquero, 2019 [70]</td></tr><tr><td>D22</td><td>Gundu et al., 2019 [32]</td><td>D56</td><td>Malmedal & Roislien, 2016 [49]</td></tr><tr><td>D23</td><td>Gupta & Bajramovic, 2017 [57]</td><td>D57</td><td>Huang & Pearlson, 2019 [36]</td></tr><tr><td>D24</td><td>Holdsworth & Apeh, 2017 [12]</td><td>D58</td><td>Ogden, 2021 [42]</td></tr><tr><td>D25</td><td>Ioannou et al., 2019 [58]</td><td></td><td></td></tr><tr><td>D26</td><td>ISACA, 2018a [77]</td><td></td><td></td></tr><tr><td>D27</td><td>ISACA, 2018b [46]</td><td></td><td></td></tr></tbody></table>

(continued)
<table><caption>**Table 1.** (continued)</caption><thead><tr><td>Document #</td><td>Author/s & year</td><td>Document #</td><td>Author/s & year</td></tr></thead><tbody><tr><td>D28</td><td>Leenen & Van Vuuren, 2019 [45]</td><td></td><td></td></tr><tr><td>D29</td><td>Kortjan & Von Solms, 2014 [1]</td><td></td><td></td></tr><tr><td>D30</td><td>Leenen et al., 2018 [59]</td><td></td><td></td></tr><tr><td>D31</td><td>Loică, 2017 [60]</td><td></td><td></td></tr><tr><td>D32</td><td>Mills, 2018 [61]</td><td></td><td></td></tr><tr><td>D33</td><td>Malyuk & Miloslavskaya, 2016 [62]</td><td></td><td></td></tr><tr><td>D34</td><td>Sousane, 2018 [63]</td><td></td><td></td></tr></tbody></table>

The identified CSC factors have been found to be critical in the development, recommendations for, maintenance, best practices or framework of cybersecurity culture [10, 22, 39–45]. Therefore, the identified factors are not only elements or factors that constitute CSC; they can also be considered factors that characterize, challenge, influence, and are used in the development of CSC. The absence of these factors are (1) regarded as challenges that inhibit the cultivation and improvement of cybersecurity culture [39, 46] and (2) are considered critical source factors for developing and strengthening CSC [32, 46].

After working through years of publications, 29 factors were identified as the cybersecurity culture factors. These factors are depicted using the ATLAS.ti network diagram in Fig. 3. Among the identified CSC factors, the top 10 include training and education; awareness; top management or leadership support; human behaviour; organisational culture; cybersecurity policy and procedures; cybersecurity champions; budget and resources; knowledge; and engagement, encouragement and cooperation. Other identified factors of cybersecurity culture include cybersecurity strategy; commitment; information sharing; accountability; a cybersecurity hub; national culture; role and responsibility; compliance; ethical conduct; security audit; change management; measure of effectiveness; trust; rewards and sanctions; collectivism; physical security; collaboration; governance and control (legal and regulatory); and a business continuity plan.
<figure><img src="image_5.png" /><figcaption>Fig. 3. Network diagram of the identified cybersecurity culture factors</figcaption></figure>

## 5.3 Cybersecurity Culture Factors

The identified cybersecurity culture factors are summarised below according to their order of importance in the review. See APPENDIX A for the full table with factors, the number of literature sources that highlighted the factors and their literature references.

<table><thead><tr><td>#</td><td>Cybersecurity culture factors</td></tr></thead><tbody><tr><td>1.</td><td><strong>Cybersecurity training and education:</strong> This factor deals with providing members of the organisations, communities and societal groups with the necessary, essential and appropriate training and education on cybersecurity. The combination of training and education emerged as the dominant factor of CSC, with 43 records highlighting this aspect during the review</td></tr><tr><td>2.</td><td><strong>Cybersecurity awareness:</strong> This factor deals with making members and employees aware of security-related issues and maintaining their consciousness on security obligations within their organisations. Awareness was overwhelmingly highlighted as the greatest and essential factor for the cultivation and achievement of CSC. A total of 38 out of 58 reviewed records highlighted awareness as a factor in cybersecurity culture</td></tr></tbody></table>

(continued)
(continued)

<table><thead><tr><td>#</td><td>Cybersecurity culture factors</td></tr></thead><tbody><tr><td>3.</td><td><strong>Top management support:</strong> This factor also referred to as leadership support and executive buy-in, clarifies the type of support that management provides for the cultivation and implementation of CSC. Top management support assumes different forms, starting with developing cybersecurity policy; defining clear goals for the management of security; endorsement of security requirements; the willingness to commit by providing financial resources to support the implementation of cybersecurity requirements and support cybersecurity; and organising and following up on cybersecurity activities such as education, skills and awareness programmes within the organisation. This factor emerged as the third most dominant factor and was contained in 21 records</td></tr><tr><td>4.</td><td><strong>Cybersecurity policy and procedures:</strong> This factor deals with the definition, clarification and management of cybersecurity policies and procedures that are fundamental for the achievement of CSC. Cybersecurity policy is indicated in the literature as a foundational factor for the achievement of cybersecurity culture; hence it ranked number 4 among the top factors of CSC, with 17 records testifying to this</td></tr><tr><td>5.</td><td><strong>Human behaviour:</strong> This factor entails developing an understanding of human attributes in terms of their beliefs, values, perceptions, attitudes and emotions. Security culture should mirror people's behaviour so that security culture becomes their natural form of behaviour and CSC should shape and reshape human behaviours. These human factors are essential for the cultivation and integration of successful CSC. 14 articles signified the importance of this factor</td></tr><tr><td>6.</td><td><strong>Knowledge and understanding:</strong> This factor relates to acquiring facts and information about the organisation upon which CSC will be built. Such knowledge assists in comprehending the diversity of groups within the organisation (e.g. educational level, age group, gender, and departmental level) and will assist the security team in making well-informed security-related decisions accommodate different groups. This factor also relates to equipping the members of the organisation with the necessary cybersecurity knowledge (e.g. on security policies and procedures) that should inform their actions regarding cybersecurity-related issues, thereby helping to create a culture of security [47]</td></tr><tr><td>7.</td><td><strong>Cybersecurity champions or a team:</strong> This factor refers to the appointment and management of authorities in the form of individuals (e.g. chief security officers) or teams that champion cybersecurity and are responsible for ensuring a secure system, the development of awareness and training activities and consistency across organisational efforts regarding the creation and management of CSC [36]</td></tr><tr><td>8.</td><td><strong>Organisational culture:</strong> This factor refers to the components of belief systems that form collective action, values that indicate what is considered important and artifacts that comprise the visible technology and behavioural patterns that form the bases of cybersecurity culture layers and factors</td></tr></tbody></table>

(continued)
(continued)

<table><thead><tr><td>#</td><td>Cybersecurity culture factors</td></tr></thead><tbody><tr><td>9.</td><td><strong>Engagement, encouragement and cooperation:</strong> This factor addresses and manages how members of an organisation or community are involved in cybersecurity-related activities such as decision making and strategy development, are motivated to adhere to the security regulations/guidelines and how teams work collaboratively to achieve a culture of security. The importance of these factors was highlighted in 11 of the reviewed records</td></tr><tr><td>10.</td><td><strong>Budget and resources:</strong> This factor refers to the financial and non-financial commitment and support provided for the development and maintenance of CSC</td></tr><tr><td>11.</td><td><strong>Cybersecurity strategy:</strong> This factor addresses the strategies that guide cybersecurity practices that underlies any cybersecurity culture development. 11 articles identified the existence of cybersecurity strategy as a cybersecurity culture factor</td></tr><tr><td>12.</td><td><strong>Collaboration:</strong> This factor deals with how collaborative efforts are initiated and strengthened by and between members (leaders and employees) and across different sectors of the organisation to confront the challenges to cybersecurity [27, 48]</td></tr><tr><td>13.</td><td><strong>Commitment:</strong> This factor relates to assessing executive management and employee commitment to support CSC and it is evidence of the kind of relationship that exists between the organisation, management and the users. Commitment also relates to the actions that guarantee adherence to policy and foster a solid security culture [31]</td></tr><tr><td>14.</td><td><strong>Role and responsibility:</strong> This factor deals with people's (and groups, teams, sections and levels') expectations in terms of their roles and responsibilities in achieving cybersecurity culture. 8 records indicated this as an influential factor of CSC</td></tr><tr><td>15.</td><td><strong>Risk and change management:</strong> Risk management deals with assessing the security culture of an organisation to identify security vulnerabilities and understand their security condition for effective and improved achievement of cybersecurity [48]. Change management relates to efforts in getting members of the organisation to comprehend and accept changes related to security to prevent employee resistance to change [27, 47]</td></tr><tr><td>16.</td><td><strong>Trust:</strong> This factor refers to the relationship that exists between the top management and employees of the organisation in relation to compliance with security policies. The factor of trust also relates to confidence in employees' actions and intentions, as well as in management's transparency and communication within the organisation [31, 49]</td></tr><tr><td>17.</td><td><strong>Communication:</strong> This factor deals with discussions and providing feedback to the role-players that have security responsibilities. It also entails circulation of best security practices, policies and procedures to the stakeholders</td></tr><tr><td>18.</td><td><strong>Information sharing:</strong> This factor is associated with communication that contributes to achieving CSC. It deals with sharing of security knowledge and known or potential cyber threats and vulnerabilities through formal security structures and a steering committee with the stakeholders</td></tr><tr><td>19.</td><td><strong>Rewards and sanctions:</strong> This factor deals with the principles of rewarding good and acceptable behaviors and punishing unacceptable and non-compliant behaviours. Rewards also refer to the element of incentives in relation to cybersecurity compliance</td></tr></tbody></table>

(continued)
(continued)

<table><thead><tr><td>#</td><td>Cybersecurity culture factors</td></tr></thead><tbody><tr><td>20.</td><td><strong>Governance and control (legal and regulatory):</strong> This factor relates to the views concerning how a group of people should be regulated and legally guided on cybersecurity issues and who should regulate them. It draws attention to the question of responsibility regarding online safety</td></tr><tr><td>21.</td><td><strong>Compliance:</strong> This factor relates to the importance of ensuring and encouraging adherence to security policies, procedures, standards, and regulations among all organisational members. It highlights the relationship between organisational security behaviour and the organisation's existing security policies and standards</td></tr><tr><td>22.</td><td><strong>Measure of effectiveness:</strong> This factor refers to the key performance indicators (KPIs) and controls established in the organisation for baseline measurement in evaluating the effectiveness and efficiency of their security controls. The KPIs help organisations to track any improvements</td></tr><tr><td>23.</td><td><strong>National culture:</strong> This factor refers to national differences that determine and influence people's attitudes, beliefs, values and assumptions about CSC and the use of technologies in general</td></tr><tr><td>24.</td><td><strong>Ethical conduct:</strong> This factor refers to the codes of ethics that guide the organisation and its members, as well as the influences of workforce perceptions and attitudes on the achievement of acceptable ethical conduct in relation to cybersecurity. This factor can help with the categorisation of attitudes and perceptions that are not consistent with the code of ethics of the organisation</td></tr><tr><td>25.</td><td><strong>Business continuity plan:</strong> This factor relates to organisational plans of recovery and continuity in the event of threats</td></tr><tr><td>26.</td><td><strong>Collectivism:</strong> According to this factor, individuals relate to the collective and, as a result, individual behaviours are formed by the collective shared norms and behaviours [49]</td></tr><tr><td>27.</td><td><strong>Cybersecurity hub:</strong> As with a cybersecurity champion, this factor deals with the establishment and existence of cybersecurity centres that play a role in achieving a culture of cybersecurity</td></tr><tr><td>28.</td><td><strong>Security audit:</strong> This factor relates to the actions of institutions to test their implemented security controls [44]</td></tr><tr><td>29.</td><td><strong>Physical security:</strong> This factor refers to ensuring a secure location, placing physical equipment such as routers and servers in locked places, having access control and conducting background investigations on new employees and visitors, when necessary [50]</td></tr></tbody></table>

## 6 Discussion and Contribution

Although research has recently worked to aggregate various components (factors and metrics) that are essential (core) for the achievement of cybersecurity culture [31], the current research produced a more comprehensive list of factors of cybersecurity culture,
as it focused on understanding and consolidating factors across all levels of cybersecu-
rity culture. Moreover, there are a few additional factors that might not be considered
essential (core), but their significance should not be underestimated as they might/could
emerge as factors that contribute to the achievement of cybersecurity culture at a particu-
lar level or in a different context, since cybersecurity culture is not a one size fits-all but is
greatly influenced by contextual factors. In conducting this review, 11 factors were iden-
tified as additional cybersecurity culture factors that are missing from recent review by
[31]. These factors include cybersecurity strategy; budget and resources; organisational
culture; human behavior; collectivism; a cybersecurity hub; a business continuity plan;
physical security; information sharing; a security audit; and measure of effectiveness.

Among all the identified factors, fulfilling the three elements of providing security education, training and awareness, together with having the support of top management, ensuring a sound policy that promotes cybersecurity, understanding human factors, acquiring knowledge and understanding of the organization, establishing cybersecurity champions and understanding organizational culture, appeared as the leading cybersecurity culture factors. A significant number of the reviewed articles indicated in one way or another the importance of these factors in the development, maintenance, best practices, recommendations for and framework of cybersecurity culture. These factors are considered the top factors, not necessarily because of their number of occurrences in the literature, but because of their level of significance in the cultivation, implementation and maintenance of cybersecurity culture, as well as in the level of association and relationship that they have with other factors.

Some of the top cybersecurity culture factors identified in this review are inconsistent with top factors identified in other reviews, for instance top management support, awareness, training, policy, knowledge, role and responsibility. However, some of the top factors identified in this review, such as organisational culture, human factors and budget and resources, are not even recognised as cybersecurity factors in a recent review conducted by [31].

7 Limitations and Future Work

A possible limitation of this paper is that it included a few sources of literature on
security culture in the reviewed records. Since this paper is part of a bigger research,
the identified factors are still to be validated. In future studies, the researchers plan to
provide a detailed comparison between cybersecurity culture and information security
culture factors (to identify factors that are specific to each of these types of security
culture). Also, part of the future research would involve mapping and categorising the
identified CSC factors according to the human factor domain [51].

8 Conclusion

The study developed a comprehensive list of cybersecurity culture factors by broadening
the search scope and the review to include cybersecurity culture studies conducted at all
levels of cybersecurity culture, not just those specific to the organisational level. This
helped the researchers to consolidate factors of cybersecurity culture that are spread
across all levels. Such consolidation will help future researchers in the field and can also help in the development and maintenance of cybersecurity culture as the developers would be able to consider factor/s that are level specific but might contribute to building a cybersecurity culture at a different level. During the review, a broad list of 29 factors, summarised in Table 1, were consolidated as the cybersecurity culture factors that can be added to the body of knowledge in this fast-emerging field of research.

## Appendix

<table><thead><tr><td>#</td><td>Cybersecurity culture factors</td><td># of literature sources and their references</td></tr></thead><tbody><tr><td>1.</td><td>Cybersecurity training and education: This factor deals with providing members of the organisations, communities and societal groups with the necessary, essential and appropriate training and education on cybersecurity. The combination of training and education emerged as the dominant factor of CSC, with 43 records highlighting this aspect during the review</td><td>The 43 records are –<br/>[1, 10, 11, 15, 18–20, 22–25, 27, 31, 32, 36, 39–41, 44–48, 52–54, 56–72]</td></tr><tr><td>2.</td><td>Cybersecurity awareness: This factor deals with making members and employees aware of security-related issues and maintaining their consciousness on security obligations within their organisations. Awareness was overwhelmingly highlighted as the greatest and essential factor for the cultivation and achievement of CSC. A total of 38 out of 58 reviewed records highlighted awareness as a factor in cybersecurity culture</td><td>The 38 records are –<br/>[1, 10–12, 17–20, 22, 23, 27, 31, 32, 36, 39–45, 47, 48, 54, 56–61, 64, 66–70, 73, 74]</td></tr></tbody></table>

(continued)
(continued)

<table><thead><tr><th>#</th><th>Cybersecurity culture factors</th><th># of literature sources and their references</th></tr></thead><tbody><tr><td>3.</td><td><strong>Top management support:</strong> This factor also referred to as leadership support and executive buy-in, clarifies the type of support that management provides for the cultivation and implementation of CSC. Top management support assumes different forms, starting with developing cybersecurity policy; defining clear goals for the management of security; endorsement of security requirements; the willingness to commit by providing financial resources to support the implementation of cybersecurity requirements and support cybersecurity; and organising and following up on cybersecurity activities such as education, skills and awareness programmes within the organisation. This factor emerged as the third most dominant factor and was contained in 21 records</td><td>21 records are –<br/>[10, 19, 22, 31, 32, 36, 39, 40, 42–44, 46, 47, 50, 52, 58, 65, 67, 70, 74, 75]</td></tr><tr><td>4.</td><td><strong>Cybersecurity policy and procedures:</strong> This factor deals with the definition, clarification and management of cybersecurity policies and procedures that are fundamental for the achievement of CSC. Cybersecurity policy is indicated in the literature as a foundational factor for the achievement of cybersecurity culture; hence it ranked number 4 among the top factors of CSC, with 17 records testifying to this</td><td>The 17 records are –<br/>[18, 19, 31, 32, 39, 41, 43–47, 52, 58, 62, 65, 71, 76]</td></tr></tbody></table>

(continued)
(continued)

<table><thead><tr><th>#</th><th>Cybersecurity culture factors</th><th># of literature sources and their references</th></tr></thead><tbody><tr><td>5.</td><td><strong>Human behaviour:</strong> This factor entails developing an understanding of human attributes in terms of their beliefs, values, perceptions, attitudes and emotions. Security culture should mirror people's behaviour so that security culture becomes their natural form of behaviour and CSC should shape and reshape human behaviours. These human factors are essential for the cultivation and integration of successful CSC. 14 articles signified the importance of this factor</td><td>The 14 records are –<br/>[10, 14, 17, 19, 22, 24, 31, 32, 36, 40, 41, 43, 45, 49]</td></tr><tr><td>6.</td><td><strong>Knowledge and understanding:</strong> This factor relates to acquiring facts and information about the organisation upon which CSC will be built. Such knowledge assists in comprehending the diversity of groups within the organisation (e.g. educational level, age group gender group, and departmental level) and will assist the security team in making well-informed security-related decisions accommodate different groups. This factor also relates to equipping the members of the organisation with the necessary cybersecurity knowledge (e.g. on security policies and procedures) that should inform their actions regarding cybersecurity-related issues, thereby helping to create a culture of security [47]</td><td>The 14 records are –<br/>[10, 22, 24, 25, 36, 39, 41, 44, 46-48, 57, 61, 65]</td></tr></tbody></table>

(continued)
(continued)

<table><thead><tr><th>#</th><th>Cybersecurity culture factors</th><th># of literature sources and their references</th></tr></thead><tbody><tr><td>7.</td><td><strong>Cybersecurity champions or a team:</strong><br>This factor refers to the appointment and management of authorities in the form of individuals (e.g. chief security officers) or teams that champion cybersecurity and are responsible for ensuring a secure system, the development of awareness and training activities and consistency across organisational efforts regarding the creation and management of CSC [36]</td><td>The 13 records are –<br>[14, 22, 31, 36, 39, 40, 42, 44, 46, 52, 58, 59, 66]</td></tr><tr><td>8.</td><td><strong>Organisational culture:</strong><br>This factor refers to the components of belief systems that form collective action, values that indicate what is considered important and artifacts that comprise the visible technology and behavioural patterns that form the bases of cybersecurity culture layers and factors</td><td>The 12 records are –<br>[10, 17, 22, 27, 32, 41, 43, 45, 48, 59, 63, 74]</td></tr><tr><td>9.</td><td><strong>Engagement, encouragement and cooperation:</strong><br>This factor addresses and manages how members of an organisation or community are involved in cybersecurity-related activities such as decision making and strategy development, are motivated to adhere to the security regulations/guidelines and how teams work collaboratively to achieve a culture of security. The importance of these factors was highlighted in 11 of the reviewed records</td><td>The 11 records are –<br>[10, 14, 22, 27, 31, 39, 43, 46, 58, 61, 77]</td></tr></tbody></table>

(continued)
(continued)

<table><thead><tr><td>#</td><td>Cybersecurity culture factors</td><td># of literature sources and their references</td></tr></thead><tbody><tr><td>10.</td><td><strong>Budget and resources:</strong><br/>This factor refers to the financial and non-financial commitment and support provided for the development and maintenance of CSC</td><td>The 11 records are –<br/>[11, 20, 22, 36, 39, 44, 46, 52, 66, 66]</td></tr><tr><td>11.</td><td><strong>Cybersecurity strategy:</strong><br/>This factor addresses the strategies that guide cybersecurity practices that underlies any cybersecurity culture development. 11 articles identified the existence of cybersecurity strategy as a cybersecurity culture factor</td><td>The 11 records are –<br/>[10, 19, 22, 24, 25, 36, 44, 46, 56, 62, 63]</td></tr><tr><td>12.</td><td><strong>Collaboration:</strong> This factor deals with how collaborative efforts are initiated and strengthened by and between members (leaders and employees) and across different sectors of the organisation to confront the challenges to cybersecurity [27, 48]</td><td>The 10 records are –<br/>[10, 18, 19, 23, 36, 40, 45, 46, 57–59]</td></tr><tr><td>13.</td><td><strong>Commitment:</strong> This factor relates to assessing executive management and employee commitment to support CSC and it is evidence of the kind of relationship that exists between the organisation, management and the users. Commitment also relates to the actions that guarantee adherence to policy and foster a solid security culture [31]</td><td>The 9 records are –<br/>[10, 11, 22, 27, 31, 36, 46, 57, 65]</td></tr><tr><td>14.</td><td><strong>Role and responsibility:</strong><br/>This factor deals with people's (and groups, teams, sections and levels') expectations in terms of their roles and responsibilities in achieving cybersecurity culture. 8 records indicated this as an influential factor of CSC</td><td>The 8 records are –<br/>[17, 20, 27, 31, 42, 46, 47, 57]</td></tr></tbody></table>

(continued)
(continued)

<table><thead><tr><td>#</td><td>Cybersecurity culture factors</td><td># of literature sources and their references</td></tr></thead><tbody><tr><td>15.</td><td><strong>Risk and change management:</strong> Risk management deals with assessing the security culture of an organisation to identify security vulnerabilities and understand their security condition for effective and improved achievement of cybersecurity [48]. Change management relates to efforts in getting members of the organisation to comprehend and accept changes related to security to prevent employee resistance to change [27, 47]</td><td>The 8 records are –<br/>[14, 27, 31, 32, 47, 65, 74, 78]</td></tr><tr><td>16.</td><td><strong>Trust:</strong> This factor refers to the relationship that exists between the top management and employees of the organisation in relation to compliance with security policies. The factor of trust also relates to confidence in employees' actions and intentions, as well as in management's transparency and communication within the organisation [31, 49]</td><td>The 7 records are –<br/>[31, 41, 47, 49, 53, 58, 73]</td></tr><tr><td>17.</td><td><strong>Communication:</strong> This factor deals with discussions and providing feedback to the role-players that have security responsibilities. It also entails circulation of best security practices, policies and procedures to the stakeholders</td><td>The 6 records are –<br/>[36, 42, 46, 58, 67, 74]</td></tr></tbody></table>

(continued)
(continued)

<table><thead><tr><td>#</td><td>Cybersecurity culture factors</td><td># of literature sources and their references</td></tr></thead><tbody><tr><td>18.</td><td><strong>Information sharing:</strong><br>This factor is associated with communication that contributes to achieving CSC. It deals with sharing of security knowledge and known or potential cyber threats and vulnerabilities through formal security structures and a steering committee with the stakeholders</td><td>The 5 records are –<br>[23, 45, 46, 58, 79]</td></tr><tr><td>19.</td><td><strong>Rewards and sanctions:</strong><br>This factor deals with the principles of rewarding good and acceptable behaviors and punishing unacceptable and non-compliant behaviours. Rewards also refer to the element of incentives in relation to cybersecurity compliance</td><td>The 5 records are –<br>[31, 36, 46, 65, 67]</td></tr><tr><td>20.</td><td><strong>Governance and control (legal and regulatory):</strong><br>This factor relates to the views concerning how a group of people should be regulated and legally guided on cybersecurity issues and who should regulate them. It draws attention to the question of responsibility regarding online safety</td><td>The 5 records are –<br>[10, 39, 49, 53, 73]</td></tr><tr><td>21.</td><td><strong>Compliance:</strong> This factor relates to the importance of ensuring and encouraging adherence to security policies, procedures, standards, and regulations among all organisational members. It highlights the relationship between organisational security behaviour and the organisation's existing security policies and standards</td><td>The 5 records are –<br>[23, 31, 41, 65, 74]</td></tr></tbody></table>

(continued)
(continued)

<table><thead><tr><td>#</td><td>Cybersecurity culture factors</td><td># of literature sources and their references</td></tr></thead><tbody><tr><td>22.</td><td><strong>Measure of effectiveness:</strong><br>This factor refers to the key performance indicators (KPIs) and controls established in the organisation for baseline measurement in evaluating the effectiveness and efficiency of their security controls. The KPIs help organisations to track any improvements</td><td>The 4 records are –<br>[32, 45, 46, 58]</td></tr><tr><td>23.</td><td><strong>National culture:</strong><br>This factor refers to national differences that determine and influence people's attitudes, beliefs, values and assumptions about CSC and the use of technologies in general</td><td>The 4 records are –<br>[10, 22, 31, 32]</td></tr><tr><td>24.</td><td><strong>Ethical conduct:</strong><br>This factor refers to the codes of ethics that guide the organisation and its members, as well as the influences of workforce perceptions and attitudes on the achievement of acceptable ethical conduct in relation to cybersecurity. This factor can help with the categorisation of attitudes and perceptions that are not consistent with the code of ethics of the organisation</td><td>The 4 records are –<br>[31, 45, 47, 62]</td></tr><tr><td>25.</td><td><strong>Business continuity plan:</strong><br>This factor relates to organisational plans of recovery and continuity in the event of threats</td><td>The 4 report are –<br>[50, 53, 73, 74]</td></tr><tr><td>26.</td><td><strong>Collectivism:</strong><br>According to this factor, individuals relate to the collective and, as a result, individual behaviours are formed by the collective shared norms and behaviours [49]</td><td>The 3 records are –<br>[40, 45, 49]</td></tr></tbody></table>

(continued)
(continued)

<table><thead><tr><td>#</td><td>Cybersecurity culture factors</td><td># of literature sources and their references</td></tr></thead><tbody><tr><td>27.</td><td>Cybersecurity hub: As with a cybersecurity champion, this factor deals with the establishment and existence of cybersecurity centres that play a role in achieving a culture of cybersecurity</td><td>The 3 records are – [40, 44, 59]</td></tr><tr><td>28.</td><td>Security audit: This factor relates to the actions of institutions to test their implemented security controls [44]</td><td>The 2 records are – [44, 50]</td></tr><tr><td>29.</td><td>Physical security: This factor refers to ensuring a secure location, placing physical equipment such as routers and servers in locked places, having access control and conducting background investigations on new employees and visitors, when necessary [50]</td><td>The only 1 record is – [50]</td></tr></tbody></table>

## References

1. Kortjan, N., Vson Solms, R.: A conceptual framework for cyber-security awareness and education in SA. South African Computer Journal 52, 29–41 (2014). https://doi.org/10.18489/sacj.v52i0.201

2. Hassan, N.H., Maarop, N., Ismail, Z., Abidin, W.Z.: Information security culture in health informatics environment: A qualitative approach. In: 2017 International Conference on Research and Innovation in Information Systems (ICRIIS), pp, 1–6 (2017). https://doi.org/10.1109/ICRIIS.2017.8002450

3. Harries, D., Yellowless, P.M.: Cyberterrorism: Is the U.S. Healthcare System Safe? Telemedicine and e-Health 19(1), 61–66 (2013)

4. Rengamani, H., Upadhyaya, S., Rao, H.R., Kumaraguru, P.: Protecting senior citizens from cyber security attacks in the e-health scenario: an international perspective. In: Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research - CSIIRW ’10, pp, 1–4 (2010)

5. Jalali, M.S., Kaiser, J.P.: Cybersecurity in hospitals: a systematic, organizational perspective. J. Med. Internet Res. 20(5), e10059 (2018). https://doi.org/10.2196/10059

6. U.S. PUBLIC LAW: Health Insurance Portability and Accountability Act of 1996 (1996)

7. National Institute of Standards and Technology: Framework for Improving Critical Infrastructure Cybersecurity. Version 1.1, April 16 (2018)

8. Information Regulator (South Africa): Protection of Personal Information Act, 2013. Act No. 4 (2013)
9. ISO 27799:2016 - Health informatics — Information security management in health using ISO/IEC 27002. In: International. Organisation for Standardization (2016). https://www.iso.org/standard/62777.html

10. European Union Agency for Network and Information Security (ENISA): Cyber Security Culture in Organisations (2017). www.enisa.europa.eu

11. Gcaza, N., Von Solms, R., Van Vuuren, J.J.: An ontology for a national cyber-security culture environment. In: Proceedings of the Ninth International Symposium on Human Aspects of Information Security & Assurance (HAISA 2015), pp. 1–10 (2015)

12. Holdsworth, J., Apeh, E.: An effective immersive cyber security awareness learning platform for businesses in the hospitality sector. In: Proceedings of 2017 IEEE 25th International Requirements Engineering Conference Workshops, REW 2017, pp. 111–117 (2017). https://doi.org/10.1109/REW.2017.47

13. Pfleeger, S.L., Caputo, D.D.: Leveraging behavioral science to mitigate cyber security risk. Computers and Security 31(4), 597–611 (2012). https://doi.org/10.1016/j.cose.2011.12.010

14. Van 't Wout, C.: Develop and maintain a cybersecurity organisational culture. In: 14th International Conference on Cyber Warfare and Security (ICCWS 2019), pp. 457–466 (2019)

15. Reid, R., Van Niekerk, J.: Towards an education campaign for fostering a societal, cyber security culture. In: 8th International Symposium on Human Aspects of Information Security & Assurance (HAISA 2014), pp. 174–184 (2014)

16. Ponemon Institute: The Rise of Ransomware. Ponemon Institute LLC, January (2017)

17. Reid, R., Van Niekerk, J.: From information security to cyber security cultures. In: 2014 Information Security for South Africa - Proceedings of the ISSA 2014 Conference, pp. 1–7 (2014)

18. Gcaza, N.: A National Strategy towards Cultivating a Cybersecurity Culture in South Africa. PhD thesis, 1–380. Nelson Mandela Metropolitan University Port Elizabeth, South Africa (2017)

19. Gcaza, N., von Solms, R.: Cybersecurity Culture: An Ill-Defined Problem. In: Bishop, M., Futcher, L., Miloslavskaya, N., Theocharidou, M. (eds.) WISE 2017. IAICT, vol. 503, pp. 98–109. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-58553-6_9

20. Gcaza, N., Von Solms, R., Grobler, M.M., Van Vuuren, J.J.: A general morphological analysis: Delineating a cyber-security culture. Information & Computer Security 25(3), 259–278 (2017). https://doi.org/10.1108/ICS-12-2015-0046

21. Xiao, Y., Watson, M.: Guidance on conducting a systematic literature review. J. Plan. Educ. Res. 39(1), 93–112 (2019). https://doi.org/10.1177/0739456X17723971

22. Corradini, I.: Building a cybersecurity culture. In: Building a Cybersecurity Culture in Organizations, pp. 63–86. Springer International Publishing, Berlin/Heidelberg, Germany (2020). https://doi.org/10.1007/978-3-030-43999-6_4

23. Abeyratne, R.: Rulemaking in air transport: a deconstructive analysis, p. 252. Springer International publishing, Switzerland (2016). https://doi.org/10.1007/978-3-319-44657-8

24. Ciuperca, E.M., Vevera, V., Cirnu, C.: Social variables of cyber security educational programmes. In: In The 15th International Scientific Conference eLearning and Software for Education Bucharest, pp. 190–194. Bucharest (2019)

25. Saigushev, N.Y., Vedeneeva, O.A., Melekhova, Y.B., Tsaran, A.A.: Cooperation of future automated machinery specialists in informational context as a means of communication during vocational training process. In: 7th International Conference on Actual Problems in Machine Building IOP Conference Series: Materials Science and Engineering, p. 843 (2020). https://doi.org/10.1088/1757-899X/843/1/012002

26. Gcaza, N., Von Solms, R., Van Vuuren, J.: An ontology for a national cyber-security culture environment. In: Proceedings of the Ninth International Symposium on Human Aspects of Information Security & Assurance (HAISA 2015), pp. 1–10 (2015)
27. Marotta, A., Pearlson, K.: A culture of cybersecurity at banca popolare di sondrio. In: 25th Americas Conference on Information Systems (AMCIS 2019), pp. 1–10 (2019)

28. Da Veiga, A., Eloff, J.H.P.: A framework and assessment instrument for information security culture. Comput. Secur. **29**(2), 196–207 (2010). https://doi.org/10.1016/j.cose.2009.09.002

29. Da Veiga, A., Martins, N.: Improving the information security culture through monitoring and implementation actions illustrated through a case study. Comput. Secur. **49**, 162–176 (2015). https://doi.org/10.1016/j.cose.2014.12.006

30. Thomson, K.L., Von Solms, R., Louw, L.: Cultivating an organizational information security culture. Computer Fraud Security **7**–**11** (2006). https://doi.org/10.1016/S1361-3723(06)70430-4

31. Uchendu, B., Nurse, J.R.C., Bada, M., Furnell, S.: Developing a cyber security culture: current practices and future needs. Computer & Security **109**, 102387 (2021). https://doi.org/10.1016/j.cose.2021.102387

32. Gundu, T., Maronga, M.I, Boucher, D.: Industry 4. 0 business perspective: fostering a cyber security culture in a culturally diverse workplace. In: Proceedings of 4th International Conference on the Internet, Cyber Security and Information Systems, pp. 85–94. Kalpa Publication in Computing (2019)

33. Astakhova, L.V.: The concept of the information-security culture. Sci. Tech. Inf. Process. **41**(1), 22–28 (2014). https://doi.org/10.3103/S0147688214010067

34. Ghernaouti-Hélie, S.: An inclusive information society needs a global approach of information security. In: Proceedings of International Conference on Availability, Reliability Security, pp. 658–662 (2009). https://doi.org/10.1109/ARES.2009.127

35. Republic of Uganda Republic of Uganda Ministry of Information and Communications Technology (Niss Final Draft), pp. 1–54 (2011)

36. Huang, K., Pearlson, K.: for what technology can’t fix: building a model of organizational cybersecurity culture. In: Proceeding of the 52nd Hawaii International Conference on System Sciences, pp. 6398–6407 (2019)

37. van Solms, R., van Niekerk, J.: From information security to cyber security. Computer Security **38**, 97–102 (2013). https://doi.org/10.1016/j.cose.2013.04.004

38. Moher, D., Liberati, A., Tetzlaff, J., Altman, D.G., Group, P.: Preferred reporting items for systematic reviews and meta-analyses: the PRISMA statement. Annuls of Internal Medicine **151**(4), 264–270 (2009)

39. Gcaza, N., Von Solms, R.: A strategy for a cybersecurity culture: a south african perspective. Ele. J. Info. Sys. Develop. Countries **80**(1), 1–17 (2017). https://doi.org/10.1002/j.1681-4835.2017.tb00590.x

40. Alshaikh, M.: Developing cybersecurity culture to influence employee behavior: a practice perspective. Computers & Security **98** (2020). https://doi.org/10.1016/j.cose.2020.102003

41. Branley-bell, D., Coventry, L., Sillence, E.: Promoting cybersecurity culture change in healthcare. In: The 14th PERvasive Technologies Related to Assistive Environments Conference, pp. 544–549 (2021)

42. Ogden, S.E.: Cybersecurity: creating a cybersecurity culture. Master thesis. California State University, San Bernardino (2021)

43. Reegård, K., Blackett, C., Katta, V.: The concept of cybersecurity culture. In: 29th European Safety and Reliability Conference, pp. 4036–4043 (2019)

44. Cardoso, G.M.S., Laureano, R.D., Serrao, C.: Cybersecurity culture in portuguese organizations: an exploratory analysis. In: Iberian Conference on Information Systems and Technologies (CISTI), pp. 7–12 (2017). https://doi.org/10.23919/CISTI.2017.7976008

45. Leenen, L., van Vuuren, J.C.J.: Framework for the cultivation of a military cybersecurity culture. In: 14th International Conference on Cyber Warfare and Security (ICCWS 2019), pp. 212–220 (2019)
46. Information Systems Audit and Control Association (ISACA).: Narrowing the Culture Gap for Better. ISACA, pp. 1–11 (2018)

47. Da Veiga, A.: Achieving a security culture. In: Cybersecurity Education for Awareness and Compliance, pp. 72–100. IGI Global (2018)

48. Pavlova, E.: Enhancing the organisational culture related to cyber security during the university digital transformation. Information & Security **46**(3), 239–249 (2020). https://doi.org/10.11610/isij.4617

49. Malmedal, B., Roislien, H.E.: The Norwegian Cyber Security Culture. Norwegian Centre for Information Security (NorSIS) (2016)

50. Aiken, G.M.: Cybersecurity and productivity: has a cybersecurity culture gone too far? In: ASBBS Proceedings of the 26th Annual Conference, pp. 13–23. American Society of Business and Behavioral Sciences, San Diego (2019)

51. Alhogail, A., Mirza, A., Bakry, S.H.: A comprehensive human factor framework for information security in organizations. J. Theor. Appl. Inf. Technol. **78**(2), 201–211 (2015)

52. Clark, R.M., Panguluri, S., Nelson, T.D., Wyman, R.P.: Protecting drinking water utilities from cyberthreats. J. Am. Water Works Assoc. **109**(2), 50–58 (2017). https://doi.org/10.5942/jawwa.2017.109.0021

53. Georgiadou, A., Mouzakitis, S., Bounas, K., Askounis, D.: A cyber-security culture framework for assessing organization readiness. J. Comp. Info. Sys. 1–11 (2020). https://doi.org/10.1080/08874417.2020.1845583

54. Simona, E.: The concept of cybersecurity culture. In: The Fourth Annual Conference of the National Defency College Romania in the New International Security Dynamics, pp. 176–4191. Carol I National Defence University Publishing House (2019)

55. Ghernouti-Hélie, S.A.: National strategy for an effective cybersecurity approach and culture. In: ARES 2010 - 5th International Conference on Availability, Reliability, and Security, pp. 370–373 (2010). https://doi.org/10.1109/ARES.2010.119

56. Gupta, D., Bajramovic, E.: Security culture for nuclear facilities. In: AIP Conference Proceeding 1799, p. 050014 (2017). https://doi.org/10.1063/1.4972948

57. Ioannou, M., Stavrou, E., Bada, M.: Cybersecurity culture in computer security incident response teams: Investigating difficulties in communication and coordination. In: 2019 International Conference Cyber Security Protection of Digital Services Cyber Security, pp. 1–4 (2019). https://doi.org/10.1109/CyberSecPODS.2019.8885240

58. Leenen, L., Aschman, M., Grobler, M., van Heerden, A.: Facing the culture gap in operational-ising cyber within a military context. In: Proceedings of the 13th International Conference on Cyber Warfare and Security, pp. 387–394 (2018)

59. Loică, M.F.: Genesis of cyber security culture – an important component of education for a modern society. In: International Scientific Conference “Strategies XXI”, pp. 387–397 (2017)

60. Mills, R.R.: The current state of insider threat awareness and readiness in corporate cyber security - an analysis of definitions, prevention, detection and mitigation. Utica College, pp. 1–68 (2018)

61. Malyuk, A., Miloslavskaya, N.: Cybersecurity culture as an element of IT professional training. In: 2016 3rd International Conference on Digital Information Processing, Data Mining, Wireless Communication (DIPDMWC 2016), pp. 205–210 (2016). https://doi.org/10.1109/DIPDMWC.2016.7529390

62. Sousane, R.J.: Understanding federal cybersecurity culture: an expert perspective on current and ideal state. PhD Theses, pp. 1–185. George Washington University (2018)

63. Pătrascu, P.: Promoting cybersecurity culture through education. In: 15th International Scientific Conference on eLearning and Software for Education, pp. 273–279 (2019)

64. Paul, C., Porche, I.R.: Toward a U.S. army cyber security culture. Int. J. Cyber Warfare and Terrorism **1**(3), 70–80 (2012). https://doi.org/10.4018/ijcwt.2011070105
65. Wierzynski, A.J.: The Vulnerabilities of Autonomous Vehicles. Master Thesis, 125. Utica college (2019)

66. Lewis, J.: What is cybersecurity culture, and how do you build it? a strong cybersecurity culture can help keep your organization safe—and your employees engaged. Cira (2021). https://www.cira.ca/blog/cybersecurity/what-cybersecurity-culture-and-how-do-you-build-it

67. Rinchi.: How to create cybersecurity culture according to an SMS scheduling feature.
In: TECHINAFRICA (2021). https://www.techinafrica.com/create-cyber-security-culture-according-professional/. Accessed 15 May 2021

68. Ronchi, A.M.: Fostering the culture of cyber security. IST-Africa 2019 conference Proceedings (IST-Africa 2019), pp. 1–10 (2019). https://doi.org/10.23919/ISTAFRICA.2019.8764870

69. Alvarez-Dionisi, L.E., Urrego-Baquero, N.: Implementing a cybersecurity culture. Isaca Journal 2, 1–6 (2019)

70. Trim, P., Upton, D.: Cyber Security Culture: Counteracting Cyber Threats through Organizational Learning and Training. Routledge, New York (2016)

71. Reid, R., Van Niekerk, J.: A cyber security culture fostering campaign through the lens of active audience theory. In: Proceeding of the 9th International Symposium on Human Aspects of Information Security and Assurance (HAISA 2015), pp. 34–44 (2015)

72. Georgiadou, A., Mouzakitis, S., Askounis, D.: Towards assessing critical infrastructures' cyber-security culture during COVID-19 crisis: a tailor-made survey. In: Wyld, D.C., et al. (eds.) CSEA, DMDBS, NSEC, NETWORKS, Fuzzy, NATL, SIGEM – 2020, pp. 71–80 (2020). https://doi.org/10.5121/csit.2020.101806

73. Georgiadou, A., Mouzakitis, S., Askounis, D.: Designing a cyber-security culture assessment survey targeting critical infrastructures during covid-19 crisis. Int. J. Netw. Secu. ITs Appli. 13(1), 33–50 (2021). https://doi.org/10.5121/ijnsa.2021.13103

74. Ribeiro, L.G.: Understanding Phishing Mitigation Strategies in the U.S. Federal Government: a Qualitative Multiple Descriptive Case Study. PhD Thesis. Capella University (2019)

75. Bounas, K., Georgiadou, A., Kontoulis, M., Mouzakitis, S., Askounis, D.: Towards a cyber-security culture tool through a holistic, multi-dimensional assessment framework. In: Proceedings of the 13th IADIS International Conference Information Systems 2020 (IS 2020). pp. 135–139 (2020). https://doi.org/10.33965/is2020_202006c016

76. Information Systems Audit and Control Association (ISACA).: The Business Impact of a Cybersecurity Culture. ISACA (2018)

77. Ramluckan, T., van Niekerk, B., Martins, I.: A change management perspective to implementing a cyber security culture. In: European Conference on Information Warfare Security (ECCWS), pp. 442–448 (2020). https://doi.org/10.34190/EWS.20.059

78. Ghernaouti, S., Cellier, L., Wanner, B.: Information sharing in cybersecurity: enhancing security, trust and privacy by capacity building. In: 2019 3rd Cyber Security in Networking Conference (CSNet 2019), pp. 58–62 (2019). https://doi.org/10.1109/CSNet47905.2019.9108944

79. Da Veiga, A.: A cybersecurity culture research philosophy and approach to develop a valid and reliable measuring instrument. In: Proceedings of 2016 SAI Computing Conference (SAI 2016), pp. 1006–1015 (2016). https://doi.org/10.1109/SAI.2016.7556102