“…The growth in IT security spending is paralleled with the increasing importance of information security as the result of organisational decision-making and topics such as board of directors' role (Curry, 2017), information security culture (Beaver, 2015), and top management support (Bailey, Kaplan, & Rezek, 2014) are increasingly more debated in practitioners' literature. Despite the acknowledged role of security and privacy in information systems studies (Lowry, Dinev, & Willison, 2017), academic research falls behind, and topics such as managerial approach to information security (Phillips, 2013;Siponen, Adam Mahmood, & Pahnila, 2014;Soomro, Shah, & Ahmed, 2016), information security awareness (Parsons et al, 2017;Siponen et al, 2014), and the role of human factors (Jaeger, 2013;Vance, Lowry, & Eggett, 2013;Yeniman Yildirim, Akalp, Aytac, & Bayram, 2011) have only recently become subjects of scholarly investigation. Overall, in the literature, to complement the traditional, technical approach to information security, calls for further research on its organisational and managerial components have been multiplying (Parsons et al, 2017;Parsons, McCormac, Butavicius, Pattinson, & Jerram, 2014;Phillips, 2013;Siponen et al, 2014;Soomro et al, 2016).…”