The effect of organizational factors on cyber security awareness with the mediating role of information security knowledge sharing attitude

Aziziyn, Siroos; Parhamnia, Farshad

doi:10.22055/slis.2026.47681.1971

The effect of organizational factors on cyber security awareness with the mediating role of information security knowledge sharing attitude

Document Type : Original Article

Authors

Siroos Aziziyn ¹

Farshad Parhamnia ²

¹ MBA Student in Information Systems and Information Technology, Department of Business Management, Kermanshah Branch, Islamic Azad University, Kermanshah, Iran.

² Associate Professor, Department of Knowledge and Information Science, Kermanshah Branch, Islamic Azad University, Kermanshah, Iran.

https://doi.org/10.22055/slis.2026.47681.1971

Abstract

Abstract
Background and Objectives: Cybersecurity awareness is essential for organizational resilience because employees’ knowledge, attitudes, and routine actions can either strengthen or weaken the protection of information assets. This issue is particularly important in banks, where financial data and digital services make the consequences of security incidents especially serious. Previous research suggests that organizational culture, formal information security policies, and organizational support and training may shape employees’ security-related behavior. These factors may also influence cybersecurity awareness indirectly by improving employees’ attitudes toward sharing information security knowledge. However, the combined effects of these organizational factors and the mediating role of knowledge-sharing attitudes have received limited attention in Iranian banking. Therefore, this study examined the effects of organizational culture, organizational policy, and organizational support and training on employees’ cybersecurity awareness, with attitude toward information security knowledge sharing as the mediating variable.
Methodology: This applied study used a descriptive-survey design. The statistical population consisted of 270 employees working in branches of Agricultural Bank in Kermanshah, Iran. The study described the sampling procedure as simple random sampling, and the sample size was estimated at 147 using Cochran’s formula. Questionnaires were distributed and collected in person at employees’ workplaces; 126 usable questionnaires were included in the final analysis. The instrument comprised 22 items measuring five constructs: organizational culture (six items), organizational policy (three items), organizational support and training (four items), attitude toward information security knowledge sharing (four items), and cybersecurity awareness (five researcher-developed items). Items for the first four constructs were adapted from Chen et al. (2015), Safa and Von Solms (2016), and Ma (2022). Face validity was assessed by four experts. Content validity was then examined by eight experts using the content validity ratio and content validity index; the final 22 items met the stated acceptance thresholds. Descriptive statistics were used to summarize the data, and partial least squares structural equation modeling was performed in SmartPLS to evaluate the measurement and structural models. The reported factor loadings, Cronbach’s alpha coefficients, composite reliability values, average variance extracted values, and discriminant-validity results supported the adequacy of the measurement model.
Findings: Organizational culture did not have a significant effect on attitude toward information security knowledge sharing (β = 0.057, t = 0.625, p = 0.532). In contrast, organizational policy had a positive and significant effect on knowledge-sharing attitude (β = 0.367, t = 4.064, p < 0.001), as did organizational support and training (β = 0.481, t = 6.392, p < 0.001). Attitude toward information security knowledge sharing also had a positive and significant effect on cybersecurity awareness (β = 0.496, t = 6.020, p < 0.001). The indirect effect of organizational policy on cybersecurity awareness through knowledge-sharing attitude was significant (β = 0.182, t = 3.444, p = 0.001), and the corresponding indirect effect of organizational support and training was also significant (β = 0.238, t = 4.436, p < 0.001). The indirect effect of organizational culture was not significant (β = 0.028, t = 0.595, p = 0.552). The structural model explained 67.2% of the variance in attitude toward information security knowledge sharing and 24.6% of the variance in cybersecurity awareness. Predictive-relevance values were 0.430 and 0.173, respectively. The reported model-fit indices (SRMR = 0.062 for the saturated model and 0.063 for the estimated model; NFI = 0.815) indicated an acceptable fit, while the reported overall goodness-of-fit value was 0.612.
Discussion: The findings indicate that formal information security policies and tangible organizational support and training are more influential than general organizational culture in shaping employees’ willingness to share security-related knowledge. In turn, a favorable knowledge-sharing attitude is associated with greater cybersecurity awareness and transmits part of the effects of policy, support, and training to awareness. The nonsignificant cultural path suggests that broad organizational values alone may be insufficient unless they are translated into clear rules, accessible guidance, practical training, and visible managerial support. Banks should therefore develop and clearly communicate information security policies, provide continuous skills-based cybersecurity training, establish accessible advisory channels for reporting and resolving security problems, and encourage employees to exchange experiences about threats and protective practices. Because the data were collected from employees of one bank in one city and at a single point in time, the findings should be generalized cautiously. Future studies could test the model in other organizational settings and use longitudinal designs to examine whether improvements in policy implementation, training, and knowledge sharing produce changes in cybersecurity awareness.

Keywords

Cyber security awareness

Information security

Organizational culture

Organizational policy

Organizational support and training

Subjects

Knowledge Management

Ahlan, A. R. & Lubis, M. & Lubis, A. (2015). Information Security Awareness at the Knowledge-Based Institution: Its Antecedents and Measures. Procedia Computer Science. 72. 361-373. https://doi.org/10.1016/j.procs.2015.12.151

Al-Kurdi, O., El-Haddadeh, R., & Eldabi, T. (2018). Knowledge sharing in higher education institutions: a systematic review. Journal of Enterprise Information Management, 31(2), 226–246. https://doi.org/10.1108/JEIM-09-2017-0129

Akter, S. et al. (2022). Reconceptualizing cybersecurity awareness capability in the data-driven digital economy. Annals of Operations Research, 2:1-26. https://doi.org/10.1007/s10479-022-04844-8

Akturan, A. and Çekmecelioglu, H.G. (2016). The effects of knowledge sharing and organizational citizenship behaviors on creative behaviors in educational institutions. Procedia – Social and Behavioral Sciences, 235, 342-350, https://doi.org/10.1016/j.sbspro.2016.11.042

Alhassan, M.M. & Adjei-Quaye, A. (2017). Information security in an organization. International Journal of Computer (IJC), 24(1), 100-116.

AlHogail, A. (2015). Design and validation of information security culture framework. Computers in Human Behavior, 49, 567-575. https://doi.org/10.1016/j.chb.2015.03.054

Allen, J.H. et al. (2015). Structuring the chief information security officer organization. Carnegie Mellon University.

Alzahrani, L. & Seth, K.P. (2021). The Impact of organizational practices on the information security management performance. Information, 12 (398), 1-16. https:// doi.org/10.3390/info12100398

Azar, D. and Mahdavipur, M. (2022). I.R.I Army cybersecurity effective factors. (Case study: I.R.I Army general staff ). Military Science and Tactics, 18 (60), 103-123. [In Persian]

Cabrera, A. & Cabrera, E.F. (2002). Knowledge-sharing dilemmas. Organization Studies, 23(5), 687-710. https://doi.org/10.1177/01708406022350

Cavusoglu, H., Cavusoglu, H., Son, J.-Y., & Benbasat, I. (2015). Institutional pressures in security management: direct and indirect influences on organizational investment in information security control resources. Information & Management, 52(4), 385-400. http://dx.doi.org/10.1016/j.im.20 14.12.004.

Chen, Y., Ramamurthy, K.(Ram) & Wen, K-W. (2013). Organization’s information security policy compliance: Stick or carrot approach? Journal of Management Information Systems (29:3), 163-195. https://doi.org/10.2753/MIS0742-1222290305

Chen, Y., Ramamurthy, K.(Ram). & Wen, K.-W. (2015). Impacts of Comprehensive Information Security Programs on Information Security Culture. Journal of Computer Information Systems, 55(3), 11–19. https://doi.org/10.1080/08874417.2015.11645767

Da Veiga, A. (2016). Comparing the information security culture of employees who had read the information security policy and those who had not. Information & Computer Security, 24(2), 139 – 151. https://doi.org/10.1108/ICS-12-2015-0048

Da Veiga, A. & Eloff, J.H.P. (2010). A framework and assessment instrument for information security culture. Computers & Security, 29 (2), 196-207. https://doi.org/10.1016/j.cose.2009.09.002

Diesch, R., Pfaff, M. & Krcmar, H. (2020). A comprehensive model of information security factors for decision-makers. Computer Security, 92, 101747. https://doi.org/10.1016/j.cose.2020.101747

Feledi, D., Fenz, S. & Lechner, L. (2013). Toward web-based information security knowledge sharing. Information Security Technical Report, 17(4), 199-209. https://doi.org/10.1016/j.istr.2013.03.004

Flores, W.R., Antonsen, E., & Ekstedt, M. (2014). Information security knowledge sharing in organizations: Investigating the effect of behavioral information security governance and national culture. Computers & Security, 43, 90-110. https://doi.org/10.1016/j.cose.2014.03.004

Fornell, C., & Larcker, D. (1981). Evaluating structural equation models with unobservable variables and measurement error. Journal of Marketing Research, 18 (1), 39–50. https://doi.org/10.2307/3151312

Gcaza, N., von Solms, R., Grobler, M.M. & van Vuuren, J.J. (2017). A general morphological analysis: delineating a cyber-security culture. Information and Computer Security, 25(3), 259-278. https://doi.org/10.1108/ICS-12-2015-0046

Hellriegel, D., Slocum, J.W. Jr & Woodman, R.W. (1998). Organizational behavior. 8th ed. South-Western College Publishing, PA.

Islam, M.S., Kunifuji, S., Hayama, T. & Miura, M. (2013). Knowledge sharing practices among doctoral students in JAIST to enhance research skills. Knowledge Management and ELearning, 5(2), 170-185. https://www.kmel-journal.org/ojs/index.php/online-publication/article/view/202

Karlsson, M., Karlsson, F., Åström, J. & Denk, T. (2022). The effect of perceived organizational culture on employees’ information security compliance. Information and Computer Security, 30(3), 382-401. https://doi.org/10.1108/ICS-06-2021-0073.

Khan, N.F., Ikram, N., Saleem, S. & Zafar, S. (2023). Cyber-security and risky behaviors in a developing country context: a Pakistani perspective. Security Journal, 36, 373–405 (2023). https://doi.org/10.10 57/s41284-022-00343-4.

Kiashmeshki , M.A. & Daneshvar, A. (2022). Use of Structural Equation Modeling for Agent-based Modeling and Simulation in the Analysis of Information Security Knowledge Sharing. Scientific Journal Of Organizational knowledge Management, 5 (18), 151-199. [In Persian]

Kim, H.L., Choi, H.S. & Han, J. (2019). Leader power and employees’ information security policy compliance. Security Journal, 32, 391–409. https://doi.org/ 10.10 57/s41284-019-00168-8.

Lawshe, C. H. (1975). A quantitative approach to content validity. Personnel Psychology, 28(4), 563–575. https://doi.org/10.1111/j.1744-6570.1975.tb01393.x

Ma, X. (2022). Is professionals’ information security behaviors in Chinese IT organizations for information security protection. Information Processing & Management, 59(1), 102744, 1-14. doi.org/10.1016/j.ipm.2021.102744

Mejias RJ. (2012). An integrative model of information security awareness for assessing information systems security risk. InSystem Science (HICSS), 2012 45th Hawaii International Conference on 2012 Jan 4 (pp. 3258-3267). IEEE. DOI: 10.1109/HICSS.2012.104

Mirzaei Ahranjani, H. (1998). In search of a theoretical plan to recognize and analyze the factors affecting work conscience and social discipline, the collection of articles of the second meeting of examining the practical ways of governance of work conscience and social discipline, Islamic Azad University, Qazvin branch. [In Persian]

Narain Singh, A., Gupta, M.P. & Ojha, A. (2014). Identifying factors of organizational information security management. Journal of Enterprise Information Management, 27(5), 644-667. https://doi.org/10.1108/JEIM-07-2013-0052.

Nielsen, C. & Cappelen, K. (2014). Exploring the mechanisms of knowledge transfer in universityindustry collaborations: a study of companies, students and researchers. Higher Education Quarterly, 68(4), 375-393, doi: 10.1111/hequ.12035.

Parsons, K., McCormac, A., Butavicius, M., Pattinson, M. & Jerram, C. (2014). Determining employee awareness using the human aspects of information security questionnaire (HAIS-Q). Compuer. Security, 42, 165–176. https://doi.org/10.1016/j.cose.2013.12.003

Obitade, P.O. (2019). Big data analytics: a link between knowledge management capabilities and superior cyber protection. Journal of Big Data, 6(71). https://doi.org/10.1186/s40537-019-0229-9

Safa, N.S. & Ismail, M.A. (2013). A customer loyalty formation model in electronic commerce. Economic Modelling,35(0):559e64. https://doi.org/10.1016/j.econmod.2013.08.011

Safa, N.S., & Von Solms, R. (2016). An information security knowledge sharing model in organizations. Computers in Human Behavior, 57(442e451), 442-451. doi.org/ 10.1016/j.chb.2015.12.037

Safa, N.S., Von Solms, R. & Furnell, S. (2016). Information security policy compliance model in organizations. Computers & Security, 56, 1–13. https://doi.org/10.1016/j.cose.2015.10.006

Schlienger, T. & Teufel, S. (2003). Analyzing information security culture: increased trust by an appropriate information security culture. 14th International Workshop on Database and Expert Systems Applications (DEXA’03), Prague, Czech Republic, 2003. DOI:10.1109/DEXA.2003.1232055

Shah Bahrami, A., Rafizadeh Kasani, R. & Poriosofi Dargah, H. (2017). Identifying and prioritizing parameters affecting the information security management system (case study: social security branches of Gilan province). Journal of Information and Communication Technology, 10 (35-36), 57-74. [In Persian]

Shropshire, J., Warkentin, M., & Sharma, S. (2015). Personality, attitudes, and intentions: predicting initial adoption of information security behavior. Computers & Security, 49(0), 177e191. https://doi.org/10.1016/j.cose.2015.01.002

Straub, D., Boudreau, M-C & Gefen, D. (2004). Validation guidelines for is positivist research. Communications of the AIS, (13), 380-426. https://doi.org/10.17705/1CAIS.01324

Taghipoor, R. & Esmaeili, A. (2019). Designing a conceptual model of the cyber defense model of the Islamic Republic of Iran. Journal of National Security, 8 (31), 181-202. [In Persian]

Tamjidyamcholo, A., Bin Baba, M.S., Tamjid, H., & Gholipour, R. (2013). Information security – Professional perceptions of knowledge-sharing intention under self-efficacy, trust, reciprocity, and shared-language. Computers & Education, 68, 223–232. doi: 10.1016/j.compedu.2013.05.010.

Tang, M., Li, M. & Zhang, T. (2016). The impacts of organizational culture on information security culture: a case study. Information Technology and Management, 1-8. https://doi.org/10.1007/s10799-015-0252-2

Van Niekerk, J.F. & Von Solms, R. (2010). Information security culture: A management perspective. Computers & Security, 29(4), 476-486. https://doi.org/10.1016/j.cose.2009.10.005

Von Solms, R. & Van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. https://doi.org/10.1016/j.cose.2013.04.004

Waltz, CF., & Bausell, RB. (1981). Nursing Research: Design, Statistics, and Computer Analysis. Philadelphia: W.B. Saunders Co; P. 45.

Wang, S. & Noe, R.A. (2010). Knowledge sharing: a review and directions for future research. Human Resource Management Review, 20(2), 115-131. https://doi.org/10.1016/j.hrmr.2009.10.001

Warner, M. (2012). Cybersecurity: A Pre-history. Intelligence and national security, 27 (5), 781-799. DOI: 10.1080/02684527.2012.708530

Wilson, M. & Hash, J. (2003). Building an Information Technology Security Awareness and Training Program. NIST Special Publication 800-50, National Institute of Standards and Technology, U.S. Department of Commerce. https://doi.org/10.6028/NIST.SP.800-50

Wu, I.-L., Chuang, C.-H., & Hsu, C.-H. (2014). Information sharing and collaborative behaviors in enabling supply chain performance: A social exchange perspective. International Journal of Production Economics, 148, 122-132. doi.org/10.1016/j.ijpe.2013.09.016

Yesil, S., Koska, A. & Büyükbese, T. (2013). Knowledge sharing process, innovation capability and innovation performance: an empirical study. Procedia –Social and Behavioral Sciences, 75, 217-225, doi: 10.1016/j.sbspro. 2013.04.025.

Yi, J. (2009). A measure of knowledge sharing behavior: scale development and validation. Knowledge Management Research & Practice, 7(1), 65-81. https://doi.org/10.1057/kmrp.2008.36