# A Model for Information Security Culture with Innovation and Creativity as Enablers

Adéle da Veiga

► To cite this version:

Adéle da Veiga. A Model for Information Security Culture with Innovation and Creativity as Enablers. 16th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2022, Mytilene, Lesbos, Greece. pp.186-196, 10.1007/978-3-031-12172-2_14. hal-05324939

HAL Id: hal-05324939

https://inria.hal.science/hal-05324939v1

Submitted on 21 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# A Model for Information Security Culture with Innovation and Creativity as Enablers

Adéle da Veiga✉️ ID

School of Computing, College of Science, Engineering and Technology, University of South Africa (UNISA), Florida Campus, Johannesburg, South Africa

dveiga@unisa.ac.za

**Abstract.** This research aims to elicit a conceptual understanding of creativity and innovation to enable a totally aligned information security culture. Stimulating the creativity and innovation of employees in an organisation can help to solve information security problems and to create a culture where information security issues are addressed and resolved, as opposed to being introduced by end-users. The study applied a theoretical approach with a scoping literature review using the PRISMA method to derive traits and programmes that organisations can implement to stimulate creativity and innovation as part of the organisational culture. A model for engendering employee creativity and innovation as part of the information security culture is proposed, through the lens of the three levels of organisational culture. This study both offers novel insights for managerial practice and serves as a point of reference for further academic research about the influence of creativity and innovation in information security culture.

**Keywords:** Information security culture · Creativity · Innovation · Model

## 1 Introduction

Creativity is critical for organisational success [1], while innovation is regarded as a driver for organisational growth, resilience [2], sustainability [3], performance [4] and competitiveness [5]. Creativity and innovation are becoming a core part of organisational strategies to achieve success and to incorporate technology changes [6], these being key factors that can aid organisations to adapt in a world where there is an accelerated pace of change [7]. Creativity and innovation will play a critical role in equipping organisations to become cyber resilient, to manage through the change brought about by the fourth industrial revolution [8], and to enhance organisational effectiveness by also applying innovation in information systems security [9]. Research has shown that eighty-eight per cent of board members are concerned about cyber threats [10], affecting the confidentiality, integrity and availability of information and information systems. With increasing numbers of cyber-attacks and data breaches, organisations need to be creative and innovative if they are to combat threats and become cyber resilient. The human element is still a key target in attacks and often part of the threat [11, 12]. Phishing
attacks accounted for the majority of data breaches in 2021, with 96% occurring via e-mails targeting end-users [10]. Information security challenges, especially those related to end-users, require organisations to develop an information security culture where creativity and innovation are encouraged so as to protect information and information systems.

Organisational culture is seen as an enabler to facilitate creativity and innovation in an organisation [2, 5, 7, 13]. Organisational culture can be explained as the assumptions, beliefs, values and norms that are shared by employees [14] and that distinguish the organisation from other organisations [3]. Values, beliefs, and knowledge of employees influence the organisational culture, but they also shape the employee's cognition, motivation, and problem solving [15] that is visible in the employee behaviour. This behaviour of employees should be shaped to be in line with the information security policies of the organisation where compliance behaviour is required. In an organisation where there is a supportive organisational culture for creativity and innovation, employees will be equipped to solve information security issues and problems [15]. Creativity on the part of individual employees extends to problem solving and competency in information security and individuals require it to address security issues that occur in their daily work [15]. Innovation and creativity could therefore play an additional role in aiding with problem solving to combat cyber-attacks and data breaches and to encourage employee behaviour that mitigates risks to information protection.

Information security culture research has shown that a strong information security culture can aid in protecting information and in minimising employee behaviour that results in information security risk or data breaches [11, 12, 16]. The factors that influence information security culture have been defined and investigated in numerous studies [12, 16, 17]. To date, however, there has not been a study that has considered creativity and innovation to strengthen the information security culture. Nonetheless, numerous research studies have been conducted about the role of creativity and innovation in an organisational culture [1, 2, 5, 18] and these studies can be leveraged in an information security context.

The objective of this paper is to propose a conceptual model whereby creativity and innovation are applied to strengthen an information security culture. This study is conducted by applying a scoping literature review and building on research in the organisational culture domain. The research question that has guided this research is, “What would an information security culture model comprise where innovation and creativity are used as enablers?”.

It is envisaged that such a model can be applied in organisations to stimulate creativity and innovation as traits of an information security culture and with the aim of mitigating security risks and threats from a human perspective. The model will serve as a point of reference for further academic work to investigate the influence of creativity and innovation on the information security culture.
# 2 Background

## 2.1 Information Security Culture

An information security culture is a subculture of the organisational culture [19–21]. In line with Schein’s [14] definition of organisational culture, the information security culture also comprises assumptions, values, beliefs and attitudes [21, 22] of employees toward information security. These influence the employee behaviour when employees interact with information and information systems and, over time, become the way things are done in the organisation to protect information and information systems, that will be visible in behaviour and artifacts in the organisation [23, 24]. It is critical that the way things are done in an organisation is in line with the information security policy of the organisation and that employees share the same values and beliefs to protect information. In order to secure and protect information effectively, a strong information security culture is required [11]. The organisation should aim for a totally aligned information security culture where the strategy of the organisation, as well as employee behaviour and values, are both in support of the protection of information [24]. A strong information security culture will enable employee behaviour, thereby leading to fewer security incidents and data breaches arising from end user threats due to error or negligent behaviour [24]. Information security should be part of the organisational strategy and vision and should be seen as a strategic advantage, as opposed to a hindrance. In an organisational culture where information security is valued, one would observe compliant behaviour which is strengthened through positive reinforcement and proactive interventions such as awareness, education and training of employees.

## 2.2 Creativity and Innovation in an Organisation

The terms “creativity” and “innovation” are used interchangeably and together in literature [18, 25]. Creativity is part of the innovation processes, with innovation resulting after creativity [6, 26] as part of a routine process. Creativity is seen by some researchers as a subset of innovation [27] whereby new ways to resolve a problem are expected. Creativity is regarded as a requirement for innovation; however, authors agree that creativity does not always result in innovation [27]. Willingness and creativity (which relates to intrinsic motivation) lead to the generation of new ideas, resulting in turn in knowledge creation when applied in a work situation [25]. To encourage innovation in an organisation, a bottom-up approach can be followed, with ideas emanating from employees, or a top-down approach can be taken, with the organisation driving creativity through its vision and strategy [26]. Creativity in an organisation can also be achieved by encouraging creativity in individual employees in three areas, namely, “expertise, creative thinking skills and intrinsic task motivation” [3] Creative ideas from individuals and groups lead to new approaches, solutions [28] and problem solving. These, as part of a dynamic process in an organisation, will result in knowledge creation. The organisational culture can be conducive to creativity and innovation or hinder them. In either case, there is an impact on creativity and innovation through basic values, assumptions and beliefs which are translated into artifacts such as the information security policy and management processes [7]. When management provides employees with resources
to develop new ideas or to solve problems they will perceive it as valuable, which will
influence how they behave [7].

## 2.3 Applying Creativity and Innovation in Information Security Culture

An information security culture is required where innovation for information security is supported and where the employees of the organisation feel encouraged to support information security but also to partake in the day-to-day implementation thereof [9]. Employees of an organisation will be more committed to innovation in information security, as well as more committed to implementing and upholding it, in an organisational culture where flexibility is promoted and where such organisational culture is conducive to information system security innovation [9]. One of the cultures that are found to be supportive of innovation in information security is the open culture, where employees are seen as flexible with a focus on the future [9]. Hwang and Choi state, for "ISS to be effective, a culture that facilitates information security and supports information systems security innovation is crucial for encouraging members to support information systems security and actively participate in its implementation" [9]. The behaviour of each employee in the organisation impacts on the effectiveness of information security, which means that their behaviour should be in line with the policies, standards, procedures and required practices of the organisation, as directed by the organisation's management and leadership [9]. In the study of [9], it is argued that there is a dependency on every employee to implement information system security policies in order for information system security to be effective. However, they also emphasise that there should be a culture in the organisation that supports information system security innovation, as promoted by the leaders of the organisation, in order for the employees to adopt the culture and for their own values and belief to be aligned to that culture. There is, however, no guidance on how management should foster an information security culture that is enabled through creativity and innovation.

# 3 Research Methodology

The literature review study was conducted using a scoping literature review approach to identify the extent of research published focusing on creativity and innovation in an information security culture context [29]. The PRISMA (Preferred Reporting Items for Systematic reviews and Meta-Analyses) method was applied to systematically gather, screen and review the retrieved research papers [30].

Two literature searches were conducted in the Emerald, Science Direct, Scopus and Web of Science databases. The first search used the keywords: (title: Information security culture) AND (abstract: Innovation OR Creativity) in the abstract, between the years 2011–2022, and in English. Only two papers from Web of Science, [9, 15] were extracted. Due to the limited research previously carried out on creativity and innovation in information security culture, a second literature search was conducted to identify studies where creativity and innovation were considered as part of organisational culture. Table 1 outlines the results of the second literature search. A total of 18 papers were included in the full-text review. The next section provides a summary of the eligible papers.
<table><caption>**Table 1.** PRISMA approach for literature search</caption><thead><tr><th rowspan="2">Databases</th><th colspan="5">(title: "organisational culture") AND (title Innovation OR Creativity) in abstract, 2011–2022, English</th></tr><tr><th>#Records identified through database searching</th><th>#Records after duplicates removed</th><th>#Records screened</th><th>#Records excluded (exclusion/inclusion criteria)</th><th>#Full-text articles assessed for eligibility</th></tr></thead><tbody><tr><td>Emerald</td><td>1</td><td>1</td><td>1</td><td>0</td><td>1</td></tr><tr><td>Science Direct</td><td>6</td><td>6</td><td>6</td><td>1</td><td>5</td></tr><tr><td>Scopus</td><td>21</td><td>21</td><td>21</td><td>15</td><td>6</td></tr><tr><td>WoS</td><td>18</td><td>17</td><td>17</td><td>11</td><td>6</td></tr></tbody></table>

# 4 Results

## 4.1 Creativity and Innovation in the Information Security Culture Context

Hwang et al. [9] conducted a study in the e-government sector to investigate innovation in information systems security. They argued that increased organisational effectiveness can be established if there is a culture for information systems security innovation. The participating organisation fostered an information systems security innovative-support culture, which incorporated an information security culture. Some of the key factors focused on to facilitate this were formal and information communication and education, as well as training programmes on the organisational, group and interpersonal levels. They also introduced an artifact creation programme to aid in shifting security attitudes to information systems. They used the example of symbols or mottos about information systems security aspects which can be shown on end users' computer screens.

Individual creativity was emphasised as an important factor to facilitate problem solving concerned with information security issues at work [15]. The authors refer to the work of Ambile [31] in which creativity is portrayed as task motivation, domain-relevant skills and creativity-relevant processes. Task motivation relates to intrinsic (internally motivated, "inherently interesting or enjoyable" [32]) as well as extrinsic motivation (such as rewards for compliance, leading to an outcome [32]). Intrinsic motivation is linked with commitment, which, in turn, is associated with task completion at work and can aid in the completion of information security tasks and problem solving. The implementation of security awareness and training in organisations aids in developing the domain-relevant skills that it is necessary for employees to apply in their work. These skills are a prerequisite to facilitating creativity in information security problem solving. This supports research that showed if employees are trained they are five times more likely to identify and avoid clicking on malicious links [10]. Lin and Wittmer [15] argued that creativity-relevant processes, which are the manner or pathways in which a solution is derived, are required for problem solving in information security management.
## 4.2 Creativity and Innovation in an Organisational Culture Context

Martins [33] conducted a study to investigate aspects of organisational culture and behaviour that influence knowledge retention in an organisation. The paper refers to creativity, but not in the context of an innovation culture. Earlier work of Martins [7, 18] focused on the development of a model for the Influence of Organisational Culture on Creativity and Innovation, using determinants of organisational culture that promote creativity and innovation, these being: strategy of the organisation, with a vision and mission that supports creativity and innovation; purposefulness (vision and mission understanding); trust relationships (trust and support for change); behaviour that encourages innovation (idea generation, risk taking, decision making); working environment (goals and objectives, conflict handling, cooperative teams, participation, control of own work); customer orientation (flexibility & improvement in service, understanding needs); and management support (open communication, availability of resources, tolerance of mistakes, adaption of rules and regulations).

Other aspects that support creativity and innovation in an organisation are the organisational structure being non-hierarchical, autonomy, working in teams, freedom, being flexible; support mechanisms (e.g. rewards and recognition, use of technology, recruitment of certain types of employees valuing diversity, energetic, with knowledge, inquisitiveness); behaviour (e.g. tolerance of mistakes, taking risks and experimenting, as long as it does not harm the organisation, support for change); and communication (open and transparent) [7]. The study of Martins et al. did not focus on what type of organisational culture promotes creativity and innovation but rather defined the elements that could determine or encourage creativity and innovation as part of an organisational culture.

The Competing Values Framework of [34, 35] is used to measure organisational culture in four distinct quadrants, namely, Hierarchy, Market (Rational), Clan (Group) or Adhocracy (Developmental) through the evaluation of two dimensions. The first dimension considers internal focus and integration versus external focus and differentiation. The second dimension focuses on flexibility and discretion versus stability and control. Choo [36] applied the Competing Values Framework to an information culture and postulated that an organisation might have one or two dominant information cultures while also valuing other cultures to varying degrees. While this profile was not tested empirically, it provides a visual representation of an information culture, which is valuable both in contextualising the culture and directing change.

The clan culture has, based on a study in Serbia, been found to be one of the cultures that lead to innovation being encouraged in an organisation [37]. Some of the reasons for this are related to knowledge sharing and communication, both of which are pertinent in the clan culture [37], and there is also a link to domain-relevant skills, which are required for creativity. Innovation is applied to identify and solve new information security problems are the solutions are then shared with the group as part of knowledge sharing and communication. A further study in Brazil also found the clan culture, as well as the adhocracy culture, to be conducive to innovation and creativity, whereas the hierarchical type culture did not have an influence on innovation [13]. The adhocracy culture was also found to have the most impact on innovativeness in universities [38]. This is supported by the work of Makumbe [8] in Zimbabwe. Ogbeibu et al. [28] also proposed that the clan and adhocracy organisational cultures might positively influence
employee creativity, but found in a further study in a manufacturing organisation that clan and rational organisational culture have a negative effect on employee creativity, while the hierarchy organisational culture has no effect [39]. The flexibility and external orientation traits of the adhocracy organisational culture favour innovation. Cameron et al. [35] explain that the adhocracy culture supports the generation of new ideas, innovation and creativity. However, in a study in Brazil conducted in the T-Kibs organisations, it was found that the market culture supports innovation, whereas the clan, adhocracy and hierarchical organisational cultures did not have an influence on innovation in this study [5]. Further research confirmed that the clan and rational culture have a positive influence on creativity; however, it was also established that the influence of the clan culture on creativity did not appear to be affected as a result of whether computer-mediated communication or face-to-face communication was used. Nonetheless, the rational culture was influenced positively [27]. The culture that supports creativity and innovation therefore varies, based on the industry or type of organisation being researched. However, group and adhocracy cultures seem to mostly support creativity and innovation.

A study in Pakistan measured the influence of five constructs. i.e. external orientation, organisational climate, flexibility to change, teamwork, and employee empowerment, on innovation performance in an organisation and found that all five constructs positively correlate with innovation performance [6]. They concluded that an organisation should aim to promote research and development activities to contribute to innovation.

Kashan et al., [2] identified 12 innovation values (risk tolerance, creativity, trust, empowerment, flexibility, teamwork and collaboration, employee recognition, diversity, external orientation, learning, continuous development and proactivity) with 33 underlying cultural dimensions that can positively contribute to an innovation culture. These factors were identified through a literature review and interviews with experts in the mining industry in Australia. While the findings are specific to the mining industry, with its unique culture of risk and rigid structures, the findings can still be applicable to relevant contexts to drive innovation as part of the organisational culture [2]. The authors also use the organisational cultural levels of Schein and explain that a culture of innovation will be perceived at an abstract, values-and-belief level and that such a culture is “built, promoted, reinforced and communicated through behaviours, practices and artefacts [2]. Employee creativity can be positively influenced when knowledge sharing is taking place and if employees are motivated [1]. A further study, conducted in Romania, found that employees consider autonomy as a positive contributor to being creative [26] and that innovation supports risk-taking while also enabling trust in organisations [9]. Table 2 outlines the elements, extracted and summarised from the literature, that can stimulate creativity and innovation as part of the organisational culture.

## 4.3 Conceptual Model

The information security culture model, enabled through creativity and innovation, is depicted in Fig. 1. The concepts applied in the model were derived from the literature review summary in Table 2, grouped according to either organisational traits or programmes that the organisation can implement to stimulate creativity and innovation. The model displays that organisations can implement certain organisational traits to stimulate creativity and innovation. For some organisational cultures, such as the clan or group
<table><caption>**Table 2.** Stimulating creativity and innovation elements</caption><thead><tr><th colspan="2">Elements that can stimulate creativity and innovation as part of the organisational culture</th></tr></thead><tbody><tr><td>Artifact program [9]</td><td>Knowledge sharing [2, 37]</td></tr><tr><td>Autonomy [2, 18, 26]</td><td>Leaders who challenge, support and empower staff to generate new ideas [18]</td></tr><tr><td>Awareness, training and education on organisational, group and levels [9, 15]</td><td>Research and development activities [6]</td></tr><tr><td>Continuous learning and development [2]</td><td>Resources [18]</td></tr><tr><td>Creativity-relevant processes and behaviour [18]</td><td>Risk tolerance [2, 6, 18]</td></tr><tr><td>Communication: formal and informal communication [9, 37]; value free, open and transparent [18]</td><td>Strategy that support creativity and innovation [18]</td></tr><tr><td>Conflict handling [18]</td><td>Support change, flexible [2, 6, 18]</td></tr><tr><td>Diversity [2, 18]</td><td>Task motivation: extrinsic (reward and recognition) [2, 15, 18, 31, 32] and intrinsic motivation [15, 31, 32]</td></tr><tr><td>Domain-relevant skills [31, 37]</td><td>Teamwork and collaboration [2, 6, 18]</td></tr><tr><td>Employee empowerment [2, 6]</td><td>Tolerate mistakes [18]</td></tr><tr><td>External orientation [2, 6]</td><td>Trust [2, 18]</td></tr><tr><td>Freedom and discretion [18]</td><td></td></tr></tbody></table>

culture, certain traits – for instance, open communication or teamwork – will already be part of the organisational culture. Creativity and innovation are an output that is applied in the context of information security within the organisation. The information security programme block in the model refers to the people, process, technology, governance and regulatory aspects of information security within the organisation, encapsulating all aspects of information and cyber security. These could relate to applying creativity to the manner in which information security policies are written, an innovative approach for information security awareness, innovative solutions to aid employees in combatting phishing attacks and encouraging employees to apply creative thinking to resolve security issues and problems, as examples.

The model depicts that creativity and innovation stimulate a totally aligned information security culture whereby security is part of the organisation's strategy and vision, employees display compliant behaviour and adapt their behaviour in creative and innovative manners to combat security threats, whereby information security is regarded as a strategic advantage resulting in minimised security incidents, especially from a human perspective, as stimulated through creative and innovative problem solving by employees. Risk mitigation is part of such a culture, with proactive management, problem solving and monitoring of information security. The model postulates that, if creativity and innovation can be stimulated in an organisation as part of the organisational culture
<figure><img src="image_3.png" /><figcaption>Fig. 1. Information security culture enabled through creativity and innovation</figcaption></figure>

and specifically translated to the information security culture, it will aid in establishing a strong and totally aligned security culture, on a values, assumptions and artifact level – one where the risk of the human element is minimised and converted to become a contributing element in combatting security risks and threats through creativity and innovation.

## 5 Conclusion and Future Work

An investigation was conducted into what an information security culture model would be comprised of where innovation and creativity are used as enablers. The study provided a foundation to propose a conceptual model whereby information security culture is enabled through creativity and innovation. Key traits to stimulate creativity and innovation were identified, such as support for change, diversity, autonomy, teamwork and trust, that can stimulate creativity and innovation in an organisation. Certain organisational programmes also enable creativity and innovation, such as an artifact programme, education, training and awareness, communication and recognition and rewards. These traits can be applied to stimulate a creative and innovative-friendly security culture in organisations. A limitation of the paper is that the model is conceptual in nature and has not been validated. Future research will employ a qualitative research method to validate the model using an expert panel and to further explore the implementation of the model in organisations with different types of organisational cultures.

## References

1. Andleeb, N., Ahmad, M.F., Hassan, M.F., Rahman, N.A.A., Abdullah, A.S., Nawi, M.N.M.: Linkage of knowledge sharing, organizational culture, supply chain strategies towards employee creativity in manufacturing organizations. Int. J. Supply Chain Manage. 9, 132–140 (2020)

2. Javanmardi Kashan, A., Wiewiora, A., Mohannak, K.: Unpacking organisational culture for innovation in Australian mining industry. Resour. Policy 73, 1021249 (2021). https://doi.org/10.1016/j.resourpol.2021.102149
3. Robbins, S.P., Judge, T.A., Odendaal, A., Roodt, G.: Organisational behaviour - Global and Southern African Perspectives, 3rd edn. Pearson Holdings South Africa, Cape Town (2018)

4. Strychalska-Rudzewicz, A., Rudzewicz, A.: The impact of organizational innovativeness on Firm performance in Poland. The moderating role of innovation culture. European Research Studies Journal. XXIV, 130–148 (2021)

5. Bianchi, C.E., Tontini, G., Gomes, G.: Relationship between subjective well-being, perceived organisational culture and individual propension to innovation. European J. Innova. Manage. ahead-of-print, 1460–1060 (2021). https://doi.org/10.1108/EJIM-01-2021-0045

6. Shahzad, F., Xiu, G.Y., Shahbaz, M.: Organizational culture and innovation performance in Pakistan's software industry. Technol. Soc. 51, 66–73 (2017). https://doi.org/10.1016/j.tec hsoc.2017.08.002

7. Martins, E.C., Terblanche, F.: Building organisational culture that stimulates creativity and innovation. Eur. J. Innov. Manag. 6, 64–74 (2003). https://doi.org/10.1108/146010603104 56337

8. Makumbe, W.: The impact of organizational culture on employee creativity amongst Zim-babwean academics. African J. Sci. Technol.Innova. Develo. (2021). https://doi.org/10.1080/ 20421338.2020.1864882

9. Hwang, K., Choi, M.: Effects of innovation-supportive culture and organizational citizenship behavior on e-government information system security stemming from mimetic isomorphism. Gov. Inf. Q. 34, 183–198 (2017)

10. Mimecast: Confronting the new wave of cyberattacks - The State of Email Security 2022 (2022)

11. ENISA: Cyber Security Culture in organisations. European Union Agency for Network and Information Security (ENISA) (2017)

12. Da Veiga, A., Astakhova, L. V., Botha, A., Herselman, M.: Defining organisational information security culture—perspectives from academia and industry. Computers and Security 92 (2020). https://doi.org/10.1016/j.cose.2020.101713

13. Scaliza, J.A.A., et al.: Relationships among organizational culture, open innovation, innovative ecosystems, and performance of firms. J. Bus. Res. 140, 264–279 (2022). https://doi.org/ 10.1016/j.jbusres.2021.10.065

14. Schein, E.H.: Organizational culture and leadership. Jossey-Bass, San Francisco (1985)

15. Lin, C., Wittmer, J.L.S.: Proactive information security behavior and individual creativity: effects of group culture and decentralized IT governance. In: IEEE International Conference on Intelligence and Security Informatics: Security and Big Data, pp. 1–6. IEEE International Conference on Intelligence and Security Informatics: Security and Big Data (2017)

16. Tolah, A., Furnell, S.M., Papadaki, M.: An empirical analysis of the information security culture key factors framework. Computers & Security 108 (2021). https://doi.org/10.1016/j. cose.2021.102354

17. AlHogail, A.: Design and validation of information security culture framework. Comput. Hum. Behav. 49, 567–575 (2015). https://doi.org/10.1016/j.chb.2015.03.054

18. Martins, E.C., Martins, N., Terblanche, F.: An organisational culture model to stimulate creativity and innovation in a university library. Advances in Library Administration and Organization 21, 83–130 (2004). https://doi.org/10.1016/S0732-0671(04)21003-3

19. Hayden, L.: People-centric security Transforming your enterprise security culture. McGraw-
Hill Education, New York (2016)

20. Van Niekerk, J., Von Solms, R.: A holistic framework for the fostering of an information security sub-culture in organizations. In: Proceedings of the Information Security South Africa Conference, pp. 1–13 (2005)

21. Schlienger, T., Teufel, S.: Information security culture: the socio-cultural dimension in infor-
mation security management. In: Proceedings of the IFIP TC11 17th International Conference
on Information Security: Visions and Perspectives, pp. 191–202 (2002)
22. Von Solms, R., Van Niekerk, J.: From information security to cyber security. Comput. Secur. 38, 97–102 (2013). https://doi.org/10.1016/j.cose.2013.04.004

23. Da Veiga, A.: Information Security Culture. In: Encyclopedia of Cryptography, Security and Privacy, pp. 1–4. Springer Berlin Heidelberg (2021). https://doi.org/10.1007/978-3-642-27739-9

24. Da Veiga, A.: Achieving a Security Culture. In: Cybersecurity Education for Awareness and Compliance, pp. 72–100. IGI Global, Hershey PA, USA (2019). https://doi.org/10.4018/978-1-5225-7847-5.ch005

25. Auernhammer, J., Hall, H.: Organizational culture in knowledge creation, creativity and innovation: towards the Freiraum model. J. Inf. Sci. 40, 154–166 (2014). https://doi.org/10.1177/0165551513508356

26. Ciuciu, R.A., Mateescu, V., Ciuciu, I.: Organizational Culture and Innovation: An Industrial Case Study. In: Meersman, R., et al. (eds.) OTM 2014. LNCS, vol. 8842, pp. 514–518. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-45550-0_52

27. Scheibe, K.P., Gupta, M.: The effect of socializing via computer-mediated communication on the relationship between organizational culture and organizational creativity. Commu. Associ. Info. Sys. 40, 294–314 (2017). https://doi.org/10.17705/lcais.04013

28. Ogbeibu, S., Senadjki, A., Luen Peng, T.: An organisational culture and trustworthiness multidimensional model to engender employee creativity. American Journal of Business. 33, 179–202 (2018). https://doi.org/10.1108/ajb-12-2017-0043

29. Grant, M.J., Booth, A., Centre, S.: A typology of reviews: an analysis of 14 review types and associated methodologies. Health Info. Libr. J. 26, 91–108 (2009). https://doi.org/10.1111/j.1471-1842.2009.00848.x

30. Moher, D., Liberati, A., Tetzlaff, J., Altman, D.G., Group, P.: Preferred reporting items for systematic reviews and meta-analyses: The PRISMA statement. Annals of Internal Medicine 151(4), 264-270 (2009)

31. Ambile, T.M.: Creativity in context. Westview Press, Boulder, CO (1996)

32. Padayachee, K.: Taxonomy of compliant information security behavior. Comput. Secur. 31, 673–680 (2012). https://doi.org/10.1016/j.cose.2012.04.004

33. Martins, E.C., Meyer, H.W.J.: Organizational and behavioral factors that influence knowledge retention. J. Knowl. Manag. 16, 77–96 (2012). https://doi.org/10.1108/13673271211198954

34. Quinn, R.E., Rohrbaugh, J.: A spatial model of effectiveness criteria - towards a competing values approach to organizational analysis. Manage. Sci. 29, 363–377 (1983)

35. Cameron, K.S., Quinn, R.E.: Diagnosing and changing organizational culture: Based on the competing values framework. Jossey-Bass, San Francisco, CA (2011)

36. Choo, C.W.: Information culture and organizational effectiveness. Int. J. Inf. Manage. 33, 775–779 (2013). https://doi.org/10.1016/j.ijinfomgt.2013.05.009

37. Colovic, A., Williams, C.: Group culture, gender diversity and organizational innovativeness: Evidence from Serbia. J. Bus. Res. 110, 282–291 (2020). https://doi.org/10.1016/j.jbusres.2019.12.046

38. Gorzelany, J., et al.: Finding links between organisation's culture and innovation. The impact of organisational culture on university innovativeness. Plos ONE. 16 (2021). https://doi.org/10.1371/journal.pone.0257962

39. Ogbeibu, S., Senadjki, A., Gaskin, J.: The moderating effect of benevolence on the impact of organisational culture on employee creativity. J. Bus. Res. 90, 334–346 (2018). https://doi.org/10.1016/j.jbusres.2018.05.032