Information Security Subcultures of Professional Groups in Organizations: A Conceptual Framework Abstract

The need for a strong security culture in organizations has been emphasized by many researchers. Cultures in some organizations are known to be differentiated, i.e., there may be variations in cultures across professional groups within a single organization. The (sub)culture of a professional group in an organization is influenced by many factors. In the current article, we propose a theory-based conceptual framework for security subcultures of professional groups in organizations. The framework relates security subcultures to its antecedents. We emphasize the importance of examining security culture at the subculture level, the need to consider the security-based beliefs (espoused security subculture) separately from the security-based behaviors (enacted security subculture), and, to account for the conflicts between security and performance expectations.