A taxonomy of factors that contribute to organizational Cybersecurity Awareness (CSA)

Abstract

Purpose

Developing cybersecurity awareness (CSA) is becoming a more and more important goal for modern organizations. CSA is a complex sociotechnical system where social, technical and organizational aspects affect each other in an intertwined way. With the goal of providing a holistic representation of CSA, this paper aims to develop a taxonomy of factors that contribute to organizational CSA.

Design/methodology/approach

The research used a design science approach including a literature review and practitioner interviews. A taxonomy was drafted based on 71 previous research publications. It was then updated and refined in two iterations of interviews with domain experts.

Findings

The result of this research is a taxonomy which outline six domains for importance for organization CSA. Each domain includes several activities which can be undertaken to increase CSA within an organization. As such, it provides a holistic overview of the CSA field.

Practical implications

Organizations can adopt the taxonomy to create a roadmap for internal CSA practices. For example, an organization could assess how well it performs in the six main themes and use the subthemes as inspiration when deciding on CSA activities.

Originality/value

The output of this research provides an overview of CSA based on information extracted from existing literature and then reviewed by practitioners. It also outlines how different aspects of CSA are interdependent on each other.

Citation

Kävrestad, J., Burvall, F. and Nohlberg, M. (2024), "A taxonomy of factors that contribute to organizational Cybersecurity Awareness (CSA)", Information and Computer Security, Vol. ahead-of-print No. ahead-of-print. https://doi.org/10.1108/ICS-11-2023-0209

1. Introduction

The world is now in a state where technology is tightly incorporated into almost everything we do. That is positive in numerous ways, but the downside is that people are now exposed to countless security threats they would not have encountered previously. However awareness of digital threats does not seem to increase at the same pace as adoption of new technology (Zwilling et al., 2022). While users are often experts on how to use IT, they are unaware of many related security issues. Subsequently, the average user has little or no awareness of how to protect their devices and data against unauthorized access or attack (Kovačević et al., 2020). For instance, users may have some knowledge from stories of cyberattacks and comprehend that security issues threaten the confidentiality of their data. However, many of these users remain uncertain of how to keep their data secure and are unaware of how their behavior can contribute to a systems compromise (Korovessis et al., 2017).

Cybersecurity awareness (CSA) is defined by Shaw et al. (2009) as:

the degree of understanding of users about the importance of information security and their responsibilities and acts to exercise sufficient levels of information security control to protect the organization’s data and networks(p1).

National Institute of Standards and Technology (NIST) further describes that awareness-raising activities intend to change individuals’ and organizations’ attitudes and empower individuals to identify security concerns and respond to them appropriately (NIST, 2023). As such, CSA is an all-encompassing term referring to the culture within an organization as well as to the skills, attitudes, and practices of individuals. CSA is often described as the first line of defense of information systems and networks (Tasevski, 2016). Lack of CSA exposes vulnerabilities that adversaries can exploit for whatever nefarious purposes they have and attackers often focus their attention on humans rather than on technology (Kovačević et al., 2020). Attacks targeting people are constantly evolving and increasing in frequency (Abawajy, 2014). Because of this, organizations are beginning to increase their efforts into CSA (Abawajy, 2014).

CSA is a complex domain dependent on individuals, organizations, technology and the interplay between those. Nevertheless, understanding what contributes to CSA is vital for future CSA practices. Consequently, this research aims to develop a taxonomy of factors that contribute to organizational CSA.

The result of this research is an overview of the CSA domain in the form of a taxonomy. The taxonomy outlines activities that can increase CSA organizations and is practically useful for those organizations. For example, the taxonomy can be used as a tool when developing internal CSA strategies.

2. Methodology

With the goal of creating a taxonomy that is useful for practitioners, this project adopted a Design Science Research (DSR) approach. DSR is characterized as a research approach where the current theory base is used to design artifacts of practical use in a certain domain (Gregor and Hevner, 2013; Hevner, 2007). The artifact design is central to the research and often iterative. Further, existing theory is used to inform the design process, while the design process, or output thereof, should contribute to the theory base (Hevner et al., 2004). The DSR process in this research was influenced by the framework by Peffers et al. (2007) and included two design cycles. In short, the first design cycle began with a literature review, which was used to draft a taxonomy. The draft taxonomy was then evaluated in interviews with practitioners from large public sector organizations in Sweden and updated based on the data from the interviews. Finally, another round of interviews was conducted, and the final taxonomy was created. Figure 1 provides an overview of the research process. Detailed methodological considerations are discussed throughout the upcoming results chapter.

3. Results

This section will describe the activities and results of each design cycle before ending with a section describing the resulting taxonomy. A draft taxonomy was created at the start of the first design cycle and then continuously updated during the research process. For the sake of brevity, only the final taxonomy is presented in detail.

3.1 Design cycle 1

The first design cycle began with a rapid literature review with the purpose of identifying research on CSA. The data generated from the review was used to draft a taxonomy which was evaluated in interviews with six practitioners. The review is detailed next before the sections ends with a presentation of the expert interviews.

3.1.1 Drafting the taxonomy.

A literature review was conducted using a rapid review methodology. A rapid review emphasizes quick collection of relevant literature on a subject while sacrificing completeness, compared to a structured literature review (Grant and Booth, 2009). In this case, it was used to efficiently gather existing knowledge about awareness raising and was considered sufficient to create a draft taxonomy. The databases and search terms listed in Figure 2 were used to identify potentially relevant publications. The selection process outlined in Figure 3 is used to identify 71 publications relevant to the study.

The included publications were analyzed using a thematic approach (Braun and Clarke, 2006). First, all included publications were reviewed and all mentions of CRA raising activities were marked. The activities were then extracted and combined into themes. Eight themes were identified in this step, each reflecting a domain of importance for CSA. The themes, and publications relating to the respective themes are outlined below. Note than one publication may be relevant for several themes:

• Top management support (Aldawood and Skinner, 2019; Alshaikh et al., 2021; Arbanas et al., 2021; Bakari et al., 2007; Caldwell, 2016; Dahabiyeh, 2021; Drevin et al., 2007; Grassegger and Nedbal, 2021; Jouaibi et al., 2022; Kemper, 2019; Khando et al., 2021; Mansfield-Devine, 2017; Renaud, 2018; Tonkin et al., 2022; Trim and Lee, 2019; Uchendu et al., 2021).

• User participation and engagement (Abawajy and Kim, 2010; Alahmari and Duncan, 2020; Alahmari et al., 2022; Albrechtsen and Hovden, 2010; Alshaikh et al., 2021; Bada and Nurse, 2019; Caldwell, 2016; Cone et al., 2006, 2007; Dahabiyeh, 2021; Drevin et al., 2007; Haney and Lutters, 2018; Jouaibi et al., 2022; Kalhoro et al., 2021; Kemper, 2019; Khando et al., 2021; Ki-Aries and Faily, 2017; Li et al., 2016; Ruighaver et al., 2007; Safa et al., 2015; Safa and Maple, 2016; Sardar and Wahsheh, 2020; Stahl, 2006; Trim and Lee, 2019).

• Interest and motivation (Alanazi et al., 2022; Albrechtsen and Hovden, 2010; Alshaikh et al., 2021; Caldwell, 2016; De Bruijn and Janssen, 2017; Drevin et al., 2007; Furnell and Rajendran, 2012; Haney and Lutters, 2018; Kemper, 2019; Ki-Aries and Faily, 2017; Parsons et al., 2014; Rohan et al., 2021; Ruighaver et al., 2007; Tolah et al., 2021; Trim and Lee, 2019; Uchendu et al., 2021).

• Cybersecurity policies (Ahlan and Lubis, 2011; Alshaikh et al., 2021; Alzubaidi, 2021; Bakari et al., 2007; Cone et al., 2006; De Bruijn and Janssen, 2017; Fielding, 2021; Georgiadou et al., 2023; Parsons et al., 2014; Rohan et al., 2021, 2023; Tirumala et al., 2019; Tolah et al., 2021; Uchendu et al., 2021; Whitman, 2004; Wong et al., 2022).

• Cybersecurity education, training and awareness (Abawajy and Kim, 2010, 2010; Abu-Amara and Tamimi, 2021; Adelola et al., 2015; A. Alahmari and Duncan, 2020; S. Alahmari et al., 2022; Aldawood and Skinner, 2019, 2019; Alshaikh et al., 2021; Alzubaidi, 2021; Amjad et al., 2016; Arbanas et al., 2021; Bada and Nurse, 2019; Caldwell, 2016; Chang and Coppel, 2020; Chaudhary et al., 2022; Chung, 2020; Cone et al., 2006, 2007; Fielding, 2020; Filipczuk et al., 2019; Furnell and Vasileiou, 2017; Grassegger and Nedbal, 2021; Hart et al., 2020; Jouaibi et al., 2022; Kemper, 2019; Khando et al., 2021; Ki-Aries and Faily, 2017; Mansfield-Devine, 2017; Parsons et al., 2014; Quayyum et al., 2021; Reeves et al., 2021; Renaud, 2018; Rohan et al., 2021, 2023; Safa et al., 2015; Safa and Maple, 2016; Sardar and Wahsheh, 2020; Scholefield and Shepherd, 2019; Solomon et al., 2022; Stahl, 2006; Tonkin et al., 2022; Trim and Lee, 2019; Tschakert and Ngamsuriyaroj, 2019; Uchendu et al., 2021; Wang et al., 2018; Whitman, 2004; Wong et al., 2022).

• Attitudes and perceptions of cybersecurity (Abawajy and Kim, 2010; Ahlan and Lubis, 2011; A. Alahmari and Duncan, 2020; Alanazi et al., 2022; Albrechtsen and Hovden, 2010; Aldawood and Skinner, 2018, 2019; AL-Nuaimi, 2022; Alshaikh et al., 2021; Bakari et al., 2007; Caldwell, 2016; Chumaera and Ayu, 2022; Chung, 2020; Furnell and Rajendran, 2012; Furnell and Vasileiou, 2017; Georgiadou et al., 2023; Grassegger and Nedbal, 2021; Hall, 2016; Hart et al., 2020; Jouaibi et al., 2022; Kalhoro et al., 2021; Khando et al., 2021; Ki-Aries and Faily, 2017; Kovačević et al., 2020; Parsons et al., 2014; Rohan et al., 2021; Safa et al., 2015; Safa and Maple, 2016; Tariq et al., 2014; Tolah et al., 2021; Wang et al., 2018; Wong et al., 2022).

• Cybersecurity culture (Abawajy and Kim, 2010; Aldawood and Skinner, 2019; AL-Nuaimi, 2022; Amjad et al., 2016; Arbanas et al., 2021; Bakari et al., 2007; Caldwell, 2016; Chung, 2020; Fielding, 2020, 2021; Furnell and Rajendran, 2012; Furnell and Vasileiou, 2017; Georgiadou et al., 2023; Hall, 2016; Kalhoro et al., 2021; Kemper, 2019; Khando et al., 2021; Kovačević et al., 2020; Parsons et al., 2014; Power and Forte, 2006; Rohan et al., 2021, 2023; Ruighaver et al., 2007; Safa et al., 2015; Safa and Maple, 2016; Stahl, 2006; Tolah et al., 2021; Trim and Lee, 2019; Uchendu et al., 2021, 2021).

• Cybersecurity advocates (Arbanas et al., 2021; Bada and Nurse, 2019; Caldwell, 2016; Chang and Coppel, 2020; Hall, 2016; Haney and Lutters, 2018; Kalhoro et al., 2021; Power and Forte, 2006; Stahl, 2006; Trim and Lee, 2019; Uchendu et al., 2021).

The included publications were analyzed in a second round, and subthemes were identified for all eight themes. The coding process is exemplified in Table 1 which illustrates how activities extracted from included sources formed themes, and how sub-themes were then formed.

The themes and subthemes were used to create the draft taxonomy used in the expert interviews. The taxonomy presented to interviewees was in the same format as the final taxonomy which is outlined in Appendix.

3.1.2 Interviews with practitioners.

The taxonomy was evaluated using semi-structured interviews. The purpose of the interviews was to collect data from practitioners with experience of working with CSA in large public sector organizations. The rationale for focusing on participants in large public sector organization was that those organizations are expected to have more resources to put toward CSA and practitioners in those organizations will therefore provide more valuable responses. As such, a purposeful sampling strategy was used with the intention of recruiting participants who met those criteria (Marshall, 1996). The sampling criteria were:

• Should currently be working in a cybersecurity related position in a large public sector organization.

• Should have experience of working with CSA in large public sector organizations for several years.

Six participants, from different large public sector organizations in Sweden, were included in the research.

During the interviews, the participants were first asked about what they perceived to be good CSA practises. The taxonomy was then shown to the participants, and the participants were asked about their perception of it. The rationale for first asking questions about CSA was to allow participants to express their thoughts freely without being influenced by the taxonomy. The interviews were transcribed and analyzed using closed thematic coding (Braun and Clarke, 2006). The purpose of the analysis was to summarize the participants' perception of the taxonomy, identify if they described aspects that were missing and identify if they thought that some parts of the taxonomy could be removed. The analysis followed these steps and resulted in a table which is partially presented in Table 2:

1. Transcription of the interview recordings

2. Mark quotes which…

   • …commented on the current taxonomy.

   • …suggested modifications to the taxonomy.

   • …suggested to remove something from the taxonomy.

   • …suggested to add something to the taxonomy.

3. Similar quotes from different participants were collected in themes.

4. Quotes within the same theme was reviewed and the general opinion was identified.

5. The interview results were summarized, and the summaries are presented in this article.

The general opinion was that the taxonomy was extensive, well-designed and summarized the main topics of the CSA in a way that would be practically useful. While they found that the taxonomy was accurate, several participants thought that it was too extensive and thatsome themes and subthemes could be combined to make it easier to get an overview of the taxonomy. All participants expressed that there was a significant overlap between “User Participation\& Engagement” and “Interest\& Motivation”, one participant also expressed that “Cybersecurity Culture” was unnecessary, as cybersecurity culture is a goal of CSA rather than a part of it. Furthermore, it was expressed that “Cybersecurity Policies” was a too narrow topic for a main theme since laws and regulations are omitted by that term. Finally, one participant expressed a need to measure the effects of CSA activities as very important but lacking from the proposed taxonomy. Two participants also noted that that the taxonomy was not specific for public sector organizations and argued that it could be applied to any organization.

3.2 Design cycle 2

In the second design cycle, the taxonomy was revised and further evaluated. The modifications made are presented next.

3.2.1 Taxonomy development.

Following the evaluation in design cycle 1, the following changes were made to the taxonomy:

• The number of themes was reduced from eight to six to make the taxonomy easier to overview, and to limit overlap between the themes. As a result, two changes were made. First, “User Participation and Engagement” and “Interest and Motivation” were combined into one theme named “User Participation, Engagement and Motivation”. Second, “Cybersecurity Culture” was removed following the rationale that building a cybersecurity culture is the goal of everything in the taxonomy and therefore it does not require to be a theme.

• The second change was to rename the theme “Cybersecurity Policy” to “Governance of Information.” The rationale was that the new name better includes laws and regulations. Three new subthemes were created to highlight the impact of laws on CSA.

• The last change was to add a subtheme called “measure effects of cybersecurity awareness work” to “Top Management Support” to ensure that measuring the effects of CSA activities is included in the taxonomy.

3.2.2 Practitioner interviews.

The updated taxonomy was evaluated using the same process and participants as in design cycle 1. The interviews in this cycle focused on the changes made to the taxonomy and additional updates that were needed. The rationale for including the same participants again was that the time that passed since the first interviews could allow them to express ideas that they had thought about since then, in addition to any ideas that came up during the second interview. The interviews were again transcribed and analyzed using thematic coding (Braun and Clarke, 2006). The results of the interviews are summarized below.

The general perception was that the changes made the taxonomy more comprehensible without reducing its value. All participants expressed that it was now easier to get an overview of the taxonomy and that it could be a valuable tool for working with CSA within public sector organizations. Additionally, the addition of a subtheme to address measurability was considered positive by all participants. Several participants discussed the removal of “Cybersecurity Culture” as a theme. Although they agreed that it was not needed as a theme, since it is the implicit goal of everything in the taxonomy, they still argued that it needed to be highlighted in some way. Participants also suggested small changes that could be made to the taxonomy in two broad categories. First, it was suggested that some themes and subthemes could be renamed, and some subthemes combined to further limit the number of themes and subthemes. The second category contained suggestions on the addition of subthemes to show that it is important to provide users with time to participate in CSA activities.

3.2.3 Finalizing the taxonomy.

The taxonomy was further revised following the input from the interviews. The changes were as follows:

• Emphasize the importance of cybersecurity culture by adding an overarching blue layer titled “Cybersecurity Culture” to the taxonomy.

• The names of all the subthemes were reviewed to ensure that they were accurately and precisely described. The language of several subthemes was updated in this process.

• The theme “Governance of Information” was renamed to “Governance”.

• The subthemes “Allocate time to cybersecurity awareness training” and “incentives” were added to the theme “User Participation, Engagement and Motivation” to highlight the importance of allowing time for CSA activities.

4. The taxonomy of factors that contribute to organizational CSA

It consists of six themes which reflect different areas of CSA practise. There are several sub-themes for each theme and those are suggestions for what could be included in the different areas of CSA practise. Cybersecurity culture is incorporated in the taxonomy as a blue box placed underneath to emphasize that cybersecurity culture is the goal of all CSA activities. The rest of this section will describe the six themes of the final taxonomy. The full taxonomy is visualized in Appendix.

4.1 Top management support

It well established that support from top management is essential to promote positive CSA behavior in organizations (Jouaibi et al., 2022). Top management are able to allocate resources for CSA (Khando et al., 2021). As leaders within the organization, managers can also act as role-models and thereby promote CSA activities. Khando et al. (2021) reinforces the importance of managers who show leadership because it is important to be a role model to motivate, engage and raise employees' CSA. Khando et al. (2021) mentions that managerial security participation has one of the strongest effects on employees' awareness. If managers are not engaged, nor will other members of the organization. Khando et al. (2021) continues by saying that top management support is critical for making cultural changes possible. Finally, this theme also highlights that the management has a large strategic responsibility to create strategies for CSA. The Top Management Support section of the taxonomy is displayed in Figure 4.

4.2 User attitudes and perceptions of cybersecurity

How humans interact with systems and processes needs to be acknowledged and understood if CSA in an organization is to be effectively addressed. Therefore, user-centred approaches must be integrated into organizations' CSA programs to identify user needs, goals and capabilities as part of CSA efforts. The integration of strategies that aim to understand the human factor helps organizations reduce the risk of human errors and build a more positive cybersecurity culture (Ki-Aries and Faily, 2017). It is uncommon for organizations to have delved into what their users might need to raise their CSA based on their predisposition to cybersecurity. Consequently, these user-centred approaches must consider the user's predisposition to cybersecurity when tailoring CSA for an individual's needs and goals. These predispositions generally involve users' individual attitudes and perceptions of cybersecurity, which are influenced by the organizations' existing cybersecurity culture. For example, organizations need to reflect whether users want to comply with policies or not, if they are risk-tolerant or risk-averse and if they are accepting or resistant to cybersecurity. Understanding users feelings toward cybersecurity is essential to raise their CSA (Furnell and Vasileiou, 2017). Consequently, organizations should take user's prior knowledge and experiences, user competencies, user learning style, user barriers, user knowledge retention, user habit, user personality, etc., into account. Understanding personalities is also important (Tolah et al., 2021). Organizations can, for instance, identify users that may be at risk of committing insider incidents through personality traits. The User Attitudes and Perceptions of Cybersecurity section of the taxonomy is displayed in Figure 5.

4.3 Cybersecurity advocates

Cybersecurity advocates encourage and facilitate the adoption of CSA best practices in organizations by advocating for beneficial security behaviors (Haney and Lutters, 2018). The taxonomy reflects traits that cybersecurity advocates often possess. Haney and Lutters (2018) highlights those traits by stating that it is essential for advocates to establish trust and be seen as reliable sources of information. Without having the ability to build trust and instill confidence in users, changing negative perceptions will not work. Additionally, advocates must have strong interpersonal skills to build relationships with managers and other users. Advocates can help to create a good understanding between departments. For example, the language used between technical and non-technical users can differ drastically and advocates can bridge the gap and translate concepts into words that various audiences can understand (Haney and Lutters, 2018). The Cybersecurity Advocates section of the taxonomy is displayed in Figure 6.

4.4 User participation, engagement and motivation

Reaching a state with an open and ongoing dialogue about cybersecurity is highly sought-after property for a security-aware organization. Such an environment requires the engagement and motivation of users. There are countless options for how to work toward that; for instance, organizations can provide users with the skills to increase self-efficacy with respect to CSA because users with higher self-efficacy are more motivated to participate in CSA initiatives and engage in positive security behaviors (Haney and Lutters, 2018). The sub-themes also demonstrate the importance of job satisfaction, a collaborative environment and peer learning are important factors for CSA. Furnell and Rajendran (2012) reinforces that job satisfaction is an important factor that influences cybersecurity behavior at work. For example, if users dislike their workplace, their interest in keeping it secure is reduced. The User Participation, Engagement and Motivation section of the taxonomy is displayed in Figure 7.

4.5 Governance

Governance is included in this taxonomy to highlight that regulatory requirements influence the CSA work of public sector organizations. Public organizations' governance differs from private organizations with public organizations' governance being more rigid. Governance in public organizations includes laws and regulations external to the organization that must be adhered to, and internal regulations such as policies, procedures, standards, best practices, programs and operating agreements related to the specific organization. The Governance section of the taxonomy is displayed in Figure 8.

4.6 Cybersecurity education, training and awareness

Employing cybersecurity education, training and awareness programs in organizations is essential since they provide users with competencies and knowledge about cybersecurity (Khando et al., 2021; Reeves et al., 2021). CSA education, training and awareness programs aim to help users improve their ability to mitigate cybersecurity threats and become more aware of security (Abawajy, 2014). Without users who have this knowledge, fostering CSA is difficult. Education, training and awareness is frequently discussed in research and is a multifaceted topic. The many aspects of this theme are reflected in the various subthemes. Paterson (2021) reinforces the need to have tailored training and education within an organization and argues that choosing a one-size-fits-all approach is ineffective. This is because an organization needs to adjust its education and training to current threat conditions, the organizations current goals and the users’ predispositions. Furthermore, training should be provided continuously and based on examples the users can relate to. To further respond to the heterogeneous nature of users, training should ideally be provided using different delivery methods such as game-based, simulation-based and online-based. For instance, game-based methods are typically highly interactive methods that challenge users and keep them interested and engaged, while simulation-based include simulations to assess users' susceptibility to different cyberattacks (Abawajy, 2014). The User Participation, Engagement and Motivation section of the taxonomy is displayed in Figure 9.

5. Conclusions

The aim of this study was to develop a taxonomy of factors that contribute to organizational CSA. A design science approach was adopted with the goal of developing a taxonomy that could be used by practitioners. The taxonomy was first drafted using a literature review in which factors that contributed to CSA were identified from 71 existing research articles. The taxonomy was evaluated and refined in two rounds of semi-structured interviews with practitioners from large public organizations in Sweden. The final taxonomy is presented in Appendix and the section above. It presents six main themes representing different areas that impact organizational CSA. Furthermore, each main theme has several subthemes which represent possible processes and goals within the themes.

The primary outcome of this research is the developed taxonomy. Organizations can adopt it to create a roadmap for internal CSA practices. For example, an organization could assess how well it performs in the six main themes and use the subthemes as inspiration when deciding on CSA activities. The subthemes can be viewed as good practices where an organization may choose to adopt all or settle with adopting a subset. Similarly, different organizations may have different needs which may influence how they could use the taxonomy. The taxonomy developed in this research is based on a literature review and input from participants in large public organization. The taxonomy is, however, likely to be applicable for other types of organizations as well. That was also stated by several interview participants.

A second and more theoretical contribution of this research is that it highlights that CSA is a complex sociotechnical system where social, technical and organizational aspects affect each other in an intertwined way. For example, training is only effective when the material presented is easy to understand. To make the material easy to understand, technical prerequisites may have to be in place which require strategical decisions. On top of that, finding ways to measure CSA while maintaining the privacy of users, and avoiding sensitive usage information leaking to attackers, is sought after. In conclusion, this research demonstrates that CSA cannot be achieved with any silver bullet. Rather, it requires continuous and synchronized efforts in technology development, organizational culture, communication and promoting job satisfaction.

Regarding the limitations of this work, the first limitation is imposed by the selection of participants for this research, which included practitioners in large public organizations. First, large organizations are certainly more able to have large organizations around CSA (and cybersecurity in general) as opposed to smaller organizations. That was also the rationale for selection participants from those organizations. The developed taxonomy is extensive, and it is unseasonable to believe that it is a perfect fit for small and medium size organizations. All participants are also from Sweden which imposes another limitation. Regulations may differ between countries and the taxonomy may not be fully compatible with organizations in other countries. Owning to the fact that the purpose of the interviews was to refine a taxonomy based on the existing body of literature, the impact of the sampling frame limitations can be assumed to be small. Further, the themes and subthemes are generally framed to increase the applicability elsewhere. A further limitation is knowing to what extent the taxonomy is complete. While efforts have been made to ensure the completeness of this work, through the integration of previous research and practitioner interviews, it is possible that some aspects of CSA are missed. Furthermore, it is perhaps even possible that future research will uncover more aspects of CSA. This leaves a need for continuous revision of the taxonomy, but that will have to be left for future work.

The participants this research represent large public sector organizations in Sweden and the results should be interpreted with that in mind. As discussed during the interviews in this research it is, however, likely that other organizations can benefit from this research. To what extent the results applicable in other domains, and how the taxonomy needs to be modified to fit those domains are natural directions for future work. Further, this research presents a birds-eye view of CSA practise. Every subtheme can be implemented in different ways and there are different considerations that can be made. As such, future research focusing on detailing the optimal practises in the subthemes is reasonable.

Figures

Figure 1.

Research process overview

Figure 2.

Databases and search terms used in the literature review

Figure 3.

Literature review selection process

Figure 4.

Top management support section of the taxonomy

Figure 5.

User attitudes and perceptions of cybersecurity section of the taxonomy

Figure 6.

Cybersecurity advocates section of the taxonomy

Figure 7.

User participation, engagement and motivation section of the taxonomy

Figure 8.

Governance section of the taxonomy

Figure 9.

Cybersecurity education, training and awareness section of the taxonomy

Figure A1.

Final taxonomy

Table 1.

Visualization of the coding process exemplifying how activities in included publications formed themes and sub-themes

Source	Activity	Theme	Sub-theme	Comment
Khando et al., 2021	Resources provided by management	Top management support	Allocate resources to governance	Presents a literature review on how organizations work with enhancing staff security awareness. Describes resources as crucial for development of CSA, and that managers are responsible for allowing the resources
Alshaikh et al., 2021	Support and resources provided by management	Top management support	Allocate resources to governance	Develops a process for cybersecurity training of employees and reports that support and resources allocated by the management are crucial for a cybersecurity training strategy
Arbanas et al., 2021	Include security management as a part of overall organizational management	Top management support	Establish clear visions and achievable goals	Presents a framework for evaluating information security culture based on a multi-stage methodology combining literature review and data collected from experts. Describes that support from the management is central and that security management should be included in the management of the organization so that security and business goals can be aligned
Kemper, 2019	The importance of cybersecurity should be emphasized by managers	Top management support	Establish clear visions and achievable goals	A feature article that argues that CSA starts from the top of an organization by the development of a policy where goals are outlined
Trim and Lee, 2019	Promote awareness increasing efforts	Top management support	Prepare a structured & organized CSA education plan	Employs group interviews to research the possible role of B2B marketers in cybersecurity awareness programs. They describe such programs as important for CSA and that awareness increasing activities should be promoted by senior management

Source: Created by the authors

Table 2.

Visualization of the coding of the first round of interviews (Quotes are translated from Swedish)

Quote	Type	Theme	General opinion
It includes all the parts relevant for cybersecurity culture	Comment	Extensive taxonomy	The participants describe the taxonomy as extensive and includes what they perceived as the core topics for CSA. The taxonomy was described as containing too much information and reducing it would make it easier to comprehend
It could contain fewer factors to make it easier to absorb	Suggestion
I recognize everything, but to see it so put together and compiled on a single page as this is fantastic	Comment
There are a lot of things on one page that makes it very compact and a tad bit intimidating to grasp at first glance and some sub-factors are merely synonyms or examples of another so those could be combined with others, so focus on condensing and reducing the number of boxes without reducing the clarity and meaning of the guideline	Suggestion

Source: Created by the authors