Towards a Three-Tiered Framework for Fostering Organizational Cybersecurity Culture

Cybersecurity is an increasing concern for organizations. Reports indicate that most incidents stem from human factors and, fostering a desired cybersecurity culture (CSC) is a crucial strategy to minimize the risk. Research suggests that exploring CSC in an organizational context requires a theoretical foundation, with numerous theories offering diverse perspectives on studying CSC in various organizational contexts. Previous studies have proposed and utilized Schein's organizational culture framework to conceptualize, analyze, and understand organizational CSC. However, these studies have not addressed the dynamics of the framework's levels for fostering a desired CSC within an organizational context. The present study addresses this gap by adapting a framework based on Schein's organizational culture framework to use it as a foundation for fostering a desired cybersecurity culture in organizations. The adapted framework is structured into three interconnected levels (tiers): 1) Operations 2) Principles 3) Mindset. The study also explores the interplay of the adapted concepts to foster the desired CSC in an organization. The adapted framework provides a theoretical basis to explore CSC and insights for practitioners on shaping and sustaining a culture that prioritizes cybersecurity.