Table 2 is the framework derived from the past literature and cultural views by (Fitzgerald, 2007) . Basically, first
column shows that it contains three natures of relationships and its relationship can be considered continuum ranging
from ISC not part of OC to ISC embedded completely into OC.
Second column of Table 2 shows the organizational culture towards information security practices in organizations.
Again, the level of management participation and supports in terms of setting up security strategy, assignment of
responsibility, participation, provision of training, and establishment of budget can be ranged from low to high.
Third column indicates the employees’ action and behaviours in relation to information security practices. At the level
where ISC is separated from OC, employees do not care and responsible towards security matters. Employees do not
involved in security matters and they always leave the security issues to IT department. They do not know how to do and
what to do when facing with security issues. At the opposite extreme where ISC is completely embedded into OC, the
employees always adhere to information security policies, and procedures. Employees undergo periodic security training
programme. They feel responsible and ownership of information and committed toward security matters. They know
what to do and whom to report to when facing security problems.