The Effect of Perceived Organizational Culture on Employees’ Information Security Compliance

Jul 18, 2026

Uploaded by Aurelia

This paper investigates how employees’ perceived organizational cultures relate to information security policy compliance among white-collar workers. A survey of 674 respondents in Sweden used the Organizational Culture Assessment Instrument, grounded in the Competing Values Framework, distinguishing clan, adhocracy, market, and bureaucracy cultures. Results show that internal-focus cultures are positively associated with compliance, while control and flexibility differences matter less. Bureaucratic culture is identified as especially effective for fostering compliance.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages20

Reading Time50 min

AccessFree to download

Introduction

Information security as a strategic and operational issue

Employees as the first line of defense

Research motivation and individual-related factors

Research purpose and approach

Survey design and sample

Organizational Culture Assessment Instrument and Competing Values Framework

Findings

Internal-focus cultures and compliance

Effects of control and flexibility

Bureaucratic culture as most fruitful

Implications

Research limitations and future investigation

Practical implications for organizations

The current issue and full text archive of this journal is available on Emerald Insight at: [https://www.emerald.com/insight/2056-4961.htm](https://www.emerald.com/insight/2056-4961.htm) ICS 30,3 382 Received 1 June 2021 Revised 14 October 2021 Accepted 24 November2021 Information & Computer Security Vol. 30 No. 3, 2022 pp. 382-401 Emerald Publishing Limited 2056-4961 DOI 10.1108/ICS-06-2021-0073 The eﬀect of perceived organizational culture on employees’ information security compliance Martin Karlsson Department of Political Science, Örebro University, Örebro, Sweden Fredrik Karlsson Department of Informatics, CERIS, Örebro University, Örebro, Sweden, and Joachim Åström and Thomas Denk Department of Political Science, Örebro University, Örebro, Sweden Abstract Purpose – This paper aims to investigate the connection between different perceived organizational cultures and information security policy compliance among white-collar workers. Design/methodology/approach – The survey using the Organizational Culture Assessment Instrument was sent to white-collar workers in Sweden (n = 674), asking about compliance with information security policies. The survey instrument is an operationalization of the Competing Values Framework that distinguishes between four different types of organizational culture: clan, adhocracy, market and bureaucracy. Findings – The results indicate that organizational cultures with an internal focus are positively related to employees’ information security policy compliance. Differences in organizational culture with regards to control and ﬂexibility seem to have less effect. The analysis shows that a bureaucratic form of organizational culture is most fruitful for fostering employees’ information security policy compliance. Research limitations/implications – The results suggest that differences in organizational culture are important for employees’ information security policy compliance. This justiﬁes further investigating the mechanisms linking organizational culture to information security compliance. Practical implications – Practitioners should be aware that the different organizational cultures do matter for employees’ information security compliance. In businesses and the public sector, the authors see a development toward customer orientation and marketization, i.e. the opposite an internal focus, that may have negative ramiﬁcations for the information security of organizations. Originality/value – Few information security policy compliance studies exist on the consequences of different organizational/information cultures. Keywords Organizational culture, Information security policy compliance, Competing values framework, Information security policy, Information security culture, Bureaucratic culture Paper type Research paper © Martin Karlsson, Fredrik Karlsson, Joachim Åström and Thomas Denk. Published by Emerald Publishing Limited. This article is published under th

FAQs

What is the purpose of the study on perceived organizational culture and information security compliance?

The study examines the relationship between different perceived organizational cultures and information security policy compliance among white-collar workers.

How was information security policy compliance measured in the research?

Compliance was assessed using a survey sent to white-collar workers in Sweden, asking about adherence to information security policies.

Which organizational culture type was found to be most effective for improving compliance?

The analysis indicates that a bureaucratic form of organizational culture is most fruitful for fostering employees’ information security policy compliance.

Jul 18, 2026

Uploaded by Aurelia