Information system vulnerabilities are often introduced due to human and organizational factors. Previous research in this field has either focused on the human/organizational variables that cause flaws or the flaws per se. However, the relationship between these types of variables has not been researched in quantitative studies. This study shows that domain experts in the field of information system deployment have a general opinion on how different variables relate and how important they are. The domain experts used in this study were able to agree on both with respect to the definition of variables and their conceptual relationship to each other. Also, when assigning quantitative parameters to these relationships an agreement among the respondents can be found.
With this data as a basis, this study confirms the notion that human, organizational, cultural and policy factors influence the information security in organizations. In particular, this study confirms that these factors have a substantial influence on the presences of flaws in an organization's information systems. The context of this study was deployments of industrial control and SCADA systems. As these systems often operate critical infrastructures, it is notable that flaws due to mistakes is common this context.