Security Resources, Capabilities and Cultural Values: Links to Security Performance and Compliance

This study examines how security resources, capabilities, and cultural values influence security performance and perceived regulatory compliance. Using binomial and multinomial logit models, we analyze qualitative and quantitative survey data collected from 250 healthcare organizations. The results show that security resources and security capabilities are positively associated with compliance and security performance. Further, resources and capabilities complement each other, improving both compliance and performance. We also find that security audit capabilities are associated with increased breach disclosures, likely because such auditing helps organizations find, disclose and fix breach-related problems. In terms of cultural values, we find that top management support and expertise are significantly linked to compliance and security performance. Lastly, we find that collaborative cultures appear to foster compliance yet experience the same level of breaches. These results provide policy insight on effective security programs that harness resources, capabilities, and culture.