The fourth column demonstrates the probable consequences that organizations facing depending on their current position
in Table 2. Those organizations where ISC is separated from OC may have lowest costs in implementing security
measures, but, at the same time they are facing highest vulnerability. On the other hand, organizations where ISC is
completely embedded into OC may have the lowest risk vulnerability, and involving high costs in implementing security
measures.
Theoretically, in order to embed ISC in OC in Table 2, all the organizations members must accept the importance of ISC.
If these values are proven to be able to guide employees’ actions and behaviours in relation to information security
practices then it will strengthen organizational values and became an integral part of work practices in protecting
organizations’ information. Tipton (2007) also argued that with the proper focus, organizations can move quickly from
low to high security cultural levels.
However, this is not the case from the past literature which found that information security is still not an integral part of
OC (Knapp et al., 2006). Also, there is none of the firms had reached the institutionalization wave of the information
security during information security assessments in Small Medium Enterprises in Tampere region in Finland
(Helokunnas & Kuusisto, 2003). Question remains why ISC still not completely embedded into organizations.