Understanding the type of information security culture (ISC) present in organizations is important because it guides how employees navigate the use of technology and information resources. This study aims to develop and evaluate a situational judgment test (SJT) designed to measure the underlying assumptions level of ISC through employee security tendencies. The goal is to determine if this approach could provide an engaging format and useful information on different types of cultures.
A novel ISC-SJT was developed to simultaneously measure cultural alignment and security behavior tendencies as a reflection of ISC. The 24-item ISC-SJT was administered to 330 employees across five US industries: technology, government/military, manufacturing/heavy, health care and education. Analysis included correlations, analysis of variance and post-hoc comparisons. Additional questions assessed participant perspectives on the format and realism of the items.
Results revealed that specific cultural orientations – means-oriented, internally driven, strict work discipline, open system and employee-oriented – are associated with more desirable security behavior tendencies. Significant US industry-level differences were also identified, with education showing an easygoing work discipline culture and the lowest overall security scores. The ISC-SJT was found to be both realistic and engaging, offering contextually grounded insights.
This research utilized a novel methodology and perspective to assess the underlying assumptions level of organizational ISC. It focused on evaluating the type of culture, rather than influencing factors of culture, through the lens of Hofstede’s organizational culture dimensions and security behavior tendencies. The study investigated cultural differences between five US industries and explored differences between cultural orientations.
