## 5 Discussion
### **Mishandling Information**
#### 5.1.2 Structure-Related Cybersecurity Challenges  
The structure-related cybersecurity challenges subtheme explains all cybersecurity incidents that happened due to limitations in organizational work structure and designs in the HERS amidst the major crisis. **Lack of Communication**  
Lack of communication is defined as restricted communication between various entities in an organization. This can be a critical hurdle to an organization's cybersecurity infrastructure [76]. Employees could not communicate and discuss with each other, resulting in increased clicking of malicious links and system viruses. One of the common factors highlighted by [PERSON] and [PERSON] under the social subsystem in STS is poor communication [55; 58]. Another study supports a need for better communication and staff training to avoid disruptive cybersecurity breaches [77]. Similarly, based on our findings and literature, it can be argued that limited communication between entities leads to cybersecurity issues during and after major crises. Furthermore, another reported situation was that employees were unable to use cloud services due to a communication gap. [PERSON] said that _\"When we launch the cloud services by partnering with external stakeholders. The staff was making errors. I believe it was a communication gap, we should have plan some meetings between us and staff members to teach them beforehand\"_. This lack of communication between leadership and subordinates is studied under the literature's organizational social structure issues [55]. A recent study highlights that communication plays a significant role in successfully implementing cybersfactors [78]. Restricted communication results in more stress and limits an organization's ability's ability to deal with emerging threats like cybersecurity challenges [79; 80]. However, to the best of our knowledge, the lack of communication by senior leadership to learn cloud features has not been reported in literature exclusively in the HERS during and after the COVID-19 crisis as a significant structure-related cybersecurity challenge. Therefore, it can be concluded that this study adds more significance to the literature by revealing communication as a structure-related cybersecurity issue in a major crisis in the HERS in Australia. **Opposing Cultural Shift**  
Another structural cyber-risk identified is the non-acceptance of this new cybercultural shift. Employees were not ready to accept this huge cultural change, which included (1) leaving the physical offices and working from home or away from the central locations, (2) learning the basic security measures, and (3) setting up office workspaces at home. All organizations are guided by their culture, norms, and values [81], and organization culture is a primary attribute of the social subsystem in STS theory. Moreover, changing organizational culture is a big step that needs to be managed strategically [82]. Employees are used to traditional organizational culture and are too stubborn to change their attitudes, accept new changes, and learn new cyberculture values. R008 stated _\"It was a big hurdle at start, traditional changes were being opposed\". This prove to be a big challenge to HERS during and after the recent crisis as employees were determined to practice old values. Also, transforming the old into a new cyberculture where everyone should be aware of cybersecurity concerns wasn't easy for upper-level management. However, it was necessary to implement to ensure a safe cyber environment\"_. Literature also highlights that employees in most organizations lack a sense of security culture [83]. A recent study conducted surveys to assess cybersecurity culture during COVID-19 during work-from-home periods [84]. However, to our knowledge, this is one of the initial studies to report cultural shifts as key structural cybersecurity challenges during and after the recent major crisis.