## 5 Discussion and Implications
### Discussion  
Based on their ISM concerns, the respondents considered that security policies were the most important in running their business operation processes. One research question asked whether establishing a complete information security policy was necessary. However, the respondents replied that their company did not communicate clear information on their employees' security policies. This usually caused employees to follow incorrect procedures and indicated that most of the shipping did not implement their right processes. This study's findings can advance container shipping firms' information ex-changes and publishing platforms, which may facilitate employees in clearly receiving the latest news as soon as it is available.  
The respondents also believed that learning how to adopt security behaviors would result in a significant loss of their work time. How can organizations progress from passive to active learning? A proper reward or a rewarding scheme [53] has encouraged employees to continue learning while working. Research findings have also shown that this is the largest RSC, and total RSC could be improved if employees are willing to improve their workplace security behaviors. This implied the container shipping companies are suggested to establish a rewarding policy or system that encourages employees' security intention.  
Regarding ISI, most of the respondents' agreement was that they considered their security policies when using their information systems. This implied that the respondents had a basic security concept when assessing their work systems. The shipping companies may consider holding more security training activities to improve greater information security. On the other hand, employees almost focused on their attention; however, they did not always remind their partners to consider security issues, which should be promoted. Having more warning messages in the workplace, enhancing supervisors' security leadership [12] in information security, and having clear security work procedures [52; 54] would effectively help solve this circumstance.  
ISA was noted in the respondents' cognition of information security. Responding to calls to conceptualize and investigate ISA, the results indicated that violations of the organization's security policies would cause severe damage. On the other hand, the respondents did not fully know the potential security threats and their risk consequences. This implied that organizations were only aiming for employees to follow the security instruction but did not show the severe outcomes of the damage. For example, system breakdown cannot handle the ports, ships, cargo, and other partners. All world shipping operations may be interrupted, bringing a great deal of business loss. Organizations shouldshare more knowledge about the threats caused by the lack of information security to emphasize its importance.  
From an ISC perspective, most employees were focused on information security and the need to protect it well. However, a perfect security climate is one in which most employees reach a security consensus. How can an organization encourage security consensus of most employees? To cultivate abundant ISC, the current study results notably suggested that supervisors and colleagues should support their coworkers in adopting security practices. When employees feel they are supported, they are more willing to act themselves and influence others.