Mind the Threat! A Qualitative Case Study on Managing Information Security Awareness Programs in Central and Eastern European Banks.

This study contributes to an ongoing debate on information security compliance and information security awareness (ISA) programs. The research aims to explore the influence of the internal and external organizational context on the characteristics and management of ISA programs in banks. Thereby, it contributes to state-of the art research by revealing tense relationships concerning compliant security behavior from certain stakeholders groups. These conflicts reflect individual aspects, which contradict ISA programs’ efforts and hence affect employees’ compliant information security behavior. Empirically, we utilized an embedded multiple case design to investigate three units of analysis, three banks from Central and Eastern Europe. We conducted in total 37 semi-structured interviews with employees in the mentioned case banks. From a practical perspective, a better understanding of the processes on how awareness programs are managed, might provide some insights to build upon for improving ISA programs in dealing with IS risks and threats. Our findings provide empirical evidence for the consideration of how internal and external factors context in managing ISA programs matter for research and practice. Moreover, the study highlights specific characteristics of ISA programs such as the use of role models or involvement through participation. The research appeals for a more granulated stakeholder concept in ISA programs, which decomposes tense relationships and conflicts.