The critical success factors for Security Education, Training and Awareness (SETA) program effectiveness: a lifecycle model

Abstract

PurposeThis study explores the critical success factors (CSFs) for Security Education, Training and Awareness (SETA) program effectiveness. The questionable effectiveness of SETA programs at changing employee behavior and an absence of empirical studies on the CSFs for SETA program effectiveness is the key motivation for this study.Design/methodology/approachThis exploratory study follows a systematic inductive approach to concept development. The methodology adopts the “key informant” approach to give voice to practitioners with SETA program expertise. Data are gathered using semi-structured interviews with 20 key informants from various geographic locations including the Gulf nations, Middle East, USA, UK and Ireland.FindingsIn this study, the analysis of these key informant interviews, following an inductive open, axial and selective coding approach, produces 11 CSFs for SETA program effectiveness. These CSFs are mapped along the phases of a SETA program lifecycle (design, development, implementation and evaluation) and nine relationships identified between the CSFs (within and across the lifecycle phases) are highlighted. The CSFs and CSFs' relationships are visualized in a Lifecycle Model of CSFs for SETA program effectiveness.Originality/valueThis research advances the first comprehensive conceptualization of the CSFs for SETA program effectiveness. The Lifecycle Model of CSFs for SETA program effectiveness provides valuable insights into the process of introducing and sustaining an effective SETA program in practice. The Lifecycle Model contributes to both theory and practice and lays the foundation for future studies.

Cloud leakage in higher education in South Africa: A case of University of Technology

“…To protect their information systems and assets from security risks, organisations employ a variety of tactics. Nonetheless, many experts advise implementing a Security Education, Training, and Awareness (SETA) programme as part of the organisation's overall IS/cyber security strategy as it is one of the most well-known tactics for reducing IS threats and safeguarding information assets (Alyami et al 2023).…”

Enhancing awareness of cyber crime: a crucial element in confronting the challenges of hybrid warfare In Indonesia

“…The importance of cyber security awareness arises from the enormous growth of cybercrime, where cyber attacks pose financial risks and disruption to businesses and individuals, recognizing the human factor as a significant vulnerability, businesses must address potential employee errors and knowledge gaps that can expose organizations to cyber threats, regularly promoting a culture of conversation and awareness through end-user security awareness training ensures that employees stay informed about the steps necessary to secure personal and business information [27].…”