Abstract
Managing Information Security is becoming more challenging in today’s business because people are both a cause of
information security incidents as well as a key part of the protection from them. As the impact of organizational culture
(OC) on employees is significant, many researchers have called for the creation of information security culture (ISC) in
organizations to influence the actions and behaviour of employees towards better organizational information security.
Although researchers have called for the creation of ISC to be embedded in organizations, nonetheless, literature
suggests that little past research examining the relationship between the nature of OC and ISC. This paper seeks to
explore the relationship between the nature of OC and ISC and argues that organizations that have a medium to high
security risk profile need to embed the ISC to influence employee actions and behaviours in relation to information
security practices. In addition, this paper also introduces a framework to assist organizations in determining the extent
to which the desired ISC is embedded into OC.