This article investigates the effect of organizational characteristics on information security practices in Trinidad and Tobago. As a theoretical lens, this study relies on a hypothesized model derived from Chang and Wang (2010) to test 24 hypotheses relating to information security practices. The data was collected using online surveys and was analyzed using factor analysis and structured equation modeling (SEM). Upon final analysis, 8 of the 24 hypotheses were confirmed.