# Advanced Technologies in Data and Information Security
## 6 Cyberawareness, Security Level Estimation and Security Policy Compliance  
The daily digital exposure to the Internet, the increasing digitalisation of Internet services, and the misbehaviour of employees regarding information security have increased the need for better cybernetic awareness, the assessment of security level in online services, and compliance with security policies.  
[PERSON] et al. [7] described a three-fold integrated cybersecurity and cyberawareness strategy for schools, consisting of an assessment of risky attitudes and behaviours in cybersecurity, a self-diagnosis web application to measure students' cybersecurity skills, and a cyberawareness lesson plan. This strategy was implemented and tested in a junior high school, with sixth- and ninth-grade students. The assessment of risky attitudes and behaviours was achieved with the development of two new questionnaires, namely, Cybersecurity Behaviours in Schools (CsB-S), and Cybersecurity Attitudes in Schools (CsA-S). Both questionnaires were completed by 164 students, the web self-diagnosis application became available to the same students who also benefited from the implementation of a lesson plan designed for digital citizenship courses. Regarding the results that emerged from the assessment of attitudes and behaviours, although positive, the authors observed that the attitudes and behaviours in ninth-grade students are globally inferior compared to those attained by sixth-grade students. Although the proposed cyberawareness strategy was applied in a school context, the authors noted that it can be applied in other contexts as well, such as enterprises, healthcare institutions and the public sector.  
[PERSON] et al. [8] proposed a security level estimation model for educational organisations, without requiring the usage of external security experts. This model takes into account the specifics of distance learning and allows the quantitative estimation of an organisation's security level. To achieve this, it relies on values of 49 quantitative criteria, structured into an Analytic Hierarchy Process (AHP) tree, and arranged to the final estimation score of security level by incorporating criteria of importance based on the opinion of experts. The validation of the proposed model confirmed that the model meets the expert-based security ranking and can be used as a simpler alternative security model in educational organisations.  
Finally, [PERSON] et al. [9] conducted a systematic literature review over the last decade (2010-2020), highlighting the Information Security Behaviour (ISB), its factors, and its theoretical implications for Information Security Policy Compliance (ISPC). More precisely, the main focus was to determine the transformation of behaviour from non-compliance to compliance behaviour. For this reason, the researchers reviewed the literature in two dimensions: (1) studies measuring compliance behaviour; (2) studies measuring non-compliance behaviour. The findings showed that ISPC research focused more on compliance than non-compliance behaviours. Regarding non-compliance, many factors play a role, such as value conflicts, security-related stress, and neutralisation. On the other hand, internal, external and protection motivations in an organisation proved to be positively important in terms of compliance behaviours. Deterrence techniques, management behaviours, culture, and information security awareness play a vital role in transforming employees'non-compliance into compliance behaviours. Overall, this systematic review contributes to information system security literature by providing a behaviour transformation process model based on the existing ISPC literature.  
Conceptualization, G.D., K.R. and K.D.; writing--original draft preparation, G.D.; writing--review and editing, K.R. and K.D.; All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
The authors declare no conflict of interest.