CONCLUSION
Each organization has different priorities, and the current organizational culture may decide the desired level of ISC
(Fitzgerald, 2007). However, real security culture lies in the security related beliefs, values, which manifest in
employee’s actions and behaviours towards information security problems (Stan, 2007). Therefore, organizations need to
carefully think about the desired level of ISC to influence their employees’ behaviour to protect organizational
information. The effectiveness of an information security program has to depend on the behaviour of people (Stan, 2007).
This paper explored the nature of relationship between OC and ISC and conceptually developed a framework of the
relationship between ISC and OC. It focused on how organizations should increase the embedding of ISC into OC. The
ISC and OC relationship framework may assist organizations in determining the extent to which ISC is embedded into
OC. This framework offer suggestions for organizations moving to the desired level of ISC to enhance employees’
security related actions and behaviours in protecting organizational information according to organizations’ priorities.
Nonetheless, one must also remember that ISC is always regarded as a complex system and it take times to develop. It
can only be developed over time by influencing employees’ related beliefs, values and behaviours.
Theoretically, we believe that this paper has provided better understanding of the relationship between OC and ISC and
contributed to existing ISC knowledge and research. Practically, the framework of relationship between OC and ISC
offer suggestions for organizations moving to the desired level of ISC to influence employees’ related security actions
and behaviours in protecting organizational information.