Högskolan i Skövde

Implementing information security measures across geographically dispersed units depends heavily on human factors dictating employee security practices and organizational readiness. This research investigates how human factors affect an organization’s readiness to implement information security measures in a multi-site SME context.

The study employs a cybersecurity cultural framework, specifically focusing on its individual level, encompassing four key dimensions: knowledge, awareness, attitudes, and behavior. The S-HAIS-Q instrument was utilized to assess these dimensions, measuring individual security practices across six critical focus areas: password management, email use, internet use, social media use, mobile device security, and incident reporting. Empirical data was collected through surveys (52 participants) and interviews (three managers) across three locations.

Statistical analysis revealed strong correlations between all human factor dimensions (r = 0.824∗∗ to 0.953∗∗, p < 0.01), demonstrating their interconnected roles in determining organization readiness for information security. While most dimensions showed consistency across locations, the knowledge dimension scores varied significantly by location.

The results show that human factors operate as an integrated system, where improvements in one dimension positively influence others. The study recommends a Human-Centric Security Readiness Model focused on systematic assessment, communication, and integrated training to enhance organizational readiness to implement information security measures.