The Effect of Information Security Awareness, Subjective Norms and Shared Tacit Assumptions on Information Security Culture

Financial services institutions are one of the prime targets of information security breaches because of the potential of the attackers to reap financial rewards from launching the attacks. Information security culture which is a collection of socio-cultural processes implemented by firms, is forecast to forestall the scourge of information security breaches. Information security culture targets to safeguard the information assets of firms through influencing employees to conduct themselves in a manner that is compatible with the protection of firms’ assets. Information security awareness, subjective norms and shared tacit assumptions are proposed as some of the main determinants of information security culture in the financial services. Therefore, this paper investigates the impact that information security awareness, subjective norms and shared tacit assumptions exert on financial services firms’ information security culture. This paper is a quantitative case study of four financial services firms in Zimbabwe. The results of this study show that information security awareness and subjective norms are predictors of information security culture in the financial services. Conversely, the study established that shared tacit assumptions are not related to information security culture in the financial services.