Evaluating Information Security Awareness and Compliance in Sub-Saharan Africa: An Interpretivist Perspective

Summary

Nasir and Vajjhala (2020) set out the design of an interpretivist, qualitative, multisite exploratory case study to identify the social, cultural, organisational and behavioural factors that influence the adoption of, and compliance with, information security policies in small and medium-sized enterprises (SMEs) in Nigeria. The design draws on audio-recorded in-depth interviews with 50 managers in 20 medium-sized Nigerian companies, two from each of ten key economic sectors. The four-page paper presents the research design and rationale, and its abstract is written prospectively and reports no interview findings.

Practical implication. Organisational leaders could use an understanding of the human and organisational factors behind non-compliance to maintain higher information security and avoid breach-related loss of brand equity and revenue.

The Problem

Information security awareness and compliance are low in sub-Saharan Africa, and the behavioural, social, cultural and organizational causes in African SMEs are largely ignored by a literature centred on developed countries.

The Methodology

Research design paper for an interpretivist, qualitative, multisite exploratory case study: audio-recorded in-depth personal interviews with 50 managers across 20 medium-sized companies in Nigeria (two per sector across ten key economic sectors).

The Core Finding

The paper establishes an interpretivist, multisite case-study design — in-depth interviews with 50 managers in 20 medium-sized Nigerian companies across ten economic sectors — for identifying the non-technical drivers of information security compliance in SMEs.

The Citation

Nasir, S., & Vajjhala, N. R. (2020). Evaluating Information Security Awareness and Compliance in Sub-Saharan Africa: An Interpretivist Perspective. In M. B. Nunes, P. Isaías, P. Powell, & B. Bontchev (Eds.), Proceedings of the 13th IADIS International Conference Information Systems 2020 (IS 2020) (pp. 187–190). IADIS Press. https://www.iadisportal.org/digital-library/evaluating-information-security-awareness-and-compliance-in-sub-saharan-africa-an-interpretivist-perspective Copy APA

The summary, key findings, methods, implications and relevance notes on this page are this website’s own description of the paper, written from the published abstract and text. The official abstract and citation details are given further down.

The study in detail

What question does this paper answer?

What social, cultural, organisational and behavioural factors influence the adoption of, and compliance with, information security policies in small and medium-sized enterprises in Nigeria, the most populous sub-Saharan African country?

What did the study find, in detail?

This short paper sets out an interpretivist, qualitative, multisite exploratory case study designed to identify the significant information security awareness and compliance challenges facing Nigerian SMEs. It argues that low awareness is only partly explained by Internet penetration, infrastructure, literacy and technology costs, and that behavioural, social, cultural and organisational issues are often ignored, especially for SMEs in sub-Saharan Africa. The design draws on audio-recorded in-depth interviews with 50 managers in 20 medium-sized Nigerian companies, two from each of ten key economic sectors.

Why does it matter?

Most information security awareness and compliance literature comes from developed countries or from Asia and the Middle East; evidence on African SMEs is scarce. Understanding the human and organisational factors behind non-compliance could help leaders avoid the loss of brand equity and revenue that follows security breaches.

Methods and data

Abstract

Information security awareness and compliance are at low levels in Sub-Saharan African countries. The low level of awareness is partly because of several factors, including low Internet penetration rates, lack of adequate technological infrastructure, low levels of literacy, and high costs of acquiring new technology. However, there are other issues, including behavioral, social, cultural, and organizational issues that are often ignored. Most of the current literature on information security awareness and compliance is centered in developed countries and, to some extent, developing countries in Asia and the Middle East. There is limited literature on information security awareness and compliance, especially in Small and Medium-Sized Enterprises (SMEs) in Africa, and in particular in Sub-Saharan African countries. The purpose of this interpretivist study is to identify the significant challenges that SMEs in Nigeria, the most populous Sub-Saharan African country face concerning information security awareness and compliance. The purpose of this qualitative, multisite, exploratory case study will be to identify and explore the various social, cultural, organizational, and behavioral factors that influence the adoption and compliance with the information security policies in Nigerian SMEs. Results of this study could assist organizational leaders with maintaining higher levels of information security in their organizations and avoiding loss of brand equity and revenue because of information security breaches. Observations from audio recorded, in-depth personal interviews with 50 managers working in different departments in 20 different medium-sized companies in Nigeria will be used in this case study. The 20 medium-sized companies included two companies each from the ten key economic sectors forming the core of Nigerian economy.

Abstract as published in Proceedings of the 13th IADIS International Conference Information Systems 2020 (IS 2020).

Keywords: Information Security; Awareness; Africa; Interpretivist; Compliance

Limitations

• A four-page conference paper presenting the research design and rationale; the abstract is written prospectively and reports no interview findings.
• No DOI is registered for this paper; the record is indexed in Scopus and available in the IADIS Digital Library.

Practical implications

• The interview study of Nigerian SMEs is intended to help organisational leaders maintain higher levels of information security and avoid loss of brand equity and revenue because of information security breaches.
• The paper argues that low information security awareness in sub-Saharan Africa is only partly explained by Internet penetration, infrastructure, literacy and technology costs, and that behavioural, social, cultural and organisational issues are often ignored, especially for SMEs there.
• Researchers studying information security awareness and compliance have scarce evidence on African SMEs to draw on; most of the literature is centred on developed countries and, to some extent, developing countries in Asia and the Middle East.

Drawn from Nasir & Vajjhala (2020), Proceedings of the 13th IADIS International Conference Information Systems 2020 (IS 2020), pp. 187–190, IADIS Press.

When this research may be relevant

This paper may be relevant to researchers studying information security awareness, security policy compliance and the human factors of cybersecurity in SMEs, particularly in Nigeria and sub-Saharan Africa, and to those designing interpretivist or multisite case-study research on organisational security behaviour.

Research topics addressed: information security awareness; information security compliance; security policy compliance; SMEs; Nigeria; sub-Saharan Africa; interpretivist research; qualitative case study; organisational culture; behavioural information security

How to cite

APA 7

Nasir, S., & Vajjhala, N. R. (2020). Evaluating Information Security Awareness and Compliance in Sub-Saharan Africa: An Interpretivist Perspective. In M. B. Nunes, P. Isaías, P. Powell, & B. Bontchev (Eds.), Proceedings of the 13th IADIS International Conference Information Systems 2020 (IS 2020) (pp. 187–190). IADIS Press. https://www.iadisportal.org/digital-library/evaluating-information-security-awareness-and-compliance-in-sub-saharan-africa-an-interpretivist-perspectiveCopy APA citation

MLA 9

Nasir, Sadiq, and Narasimha Rao Vajjhala. “Evaluating Information Security Awareness and Compliance in Sub-Saharan Africa: An Interpretivist Perspective.” Proceedings of the 13th IADIS International Conference Information Systems 2020 (IS 2020), edited by Miguel Baptista Nunes et al., IADIS Press, 2020, pp. 187–90. https://www.iadisportal.org/digital-library/evaluating-information-security-awareness-and-compliance-in-sub-saharan-africa-an-interpretivist-perspective.Copy MLA citation

IEEE

S. Nasir and N. R. Vajjhala, “Evaluating Information Security Awareness and Compliance in Sub-Saharan Africa: An Interpretivist Perspective,” in Proceedings of the 13th IADIS International Conference Information Systems 2020 (IS 2020), M. B. Nunes, P. Isaías, P. Powell, and B. Bontchev, Eds. IADIS Press, 2020, pp. 187–190. [Online]. Available: https://www.iadisportal.org/digital-library/evaluating-information-security-awareness-and-compliance-in-sub-saharan-africa-an-interpretivist-perspectiveCopy IEEE citation

@inproceedings{nasir2020information,
  title = {Evaluating Information Security Awareness and Compliance in Sub-Saharan Africa: An Interpretivist Perspective},
  author = {Nasir, Sadiq and Vajjhala, Narasimha Rao},
  booktitle = {Proceedings of the 13th IADIS International Conference Information Systems 2020 (IS 2020)},
  editor = {Nunes, Miguel Baptista and Isaías, Pedro and Powell, Philip and Bontchev, Boyan},
  pages = {187--190},
  year = {2020},
  publisher = {IADIS Press},
  url = {https://www.iadisportal.org/digital-library/evaluating-information-security-awareness-and-compliance-in-sub-saharan-africa-an-interpretivist-perspective}
}

TY  - CPAPER
TI  - Evaluating Information Security Awareness and Compliance in Sub-Saharan Africa: An Interpretivist Perspective
AU  - Nasir, Sadiq
AU  - Vajjhala, Narasimha Rao
ED  - Nunes, Miguel Baptista
ED  - Isaías, Pedro
ED  - Powell, Philip
ED  - Bontchev, Boyan
T2  - Proceedings of the 13th IADIS International Conference Information Systems 2020 (IS 2020)
PY  - 2020
DA  - 2020
SP  - 187
EP  - 190
PB  - IADIS Press
SN  - 978-989-8704-15-3
UR  - https://www.narasimharao.net/research/information-security-awareness-compliance-sub-saharan-africa-smes/
LA  - en
ER  - 

Links and files

• Publisher’s page: https://www.iadisportal.org/digital-library/evaluating-information-security-awareness-and-compliance-in-sub-saharan-africa-an-interpretivist-perspective
• Scopus record: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85086586473&partnerID=40&md5=dc868a22d9138213335f63e3dcd1fbf9
• This page as text: https://www.narasimharao.net/research/information-security-awareness-compliance-sub-saharan-africa-smes/paper.md
• Permanent address of this page: https://www.narasimharao.net/research/information-security-awareness-compliance-sub-saharan-africa-smes/