The role of organizational and social factors for information security in a nuclear power industry

Abstract

PurposeThe aim of this study was to explore the organizational and social prerequisites for employees' participative and rule-compliant information security behaviour in Swedish nuclear power production and its related industry. These industries are high-risk activities that must be meticulously secured. Protecting the information security in the related organizations is an essential aspect of this.Design/methodology/approachIndividual in-depth interviews were conducted with 24 employees in two organizations within the nuclear power industry in Sweden.FindingsWe found that prerequisites for employees' participative and rule-compliant information security behaviour could be categorized into structural, social and individual aspects. Structural aspects included well-adapted rules, knowledge support and resources. Social aspects included a supportive organizational culture, collaboration and adequate resources, and individual aspects included individual responsibility.Originality/valueThe qualitative approach of the study provided comprehensive descriptions of the identified preconditions. The results may thus enable organizations to better promote conditions important for information security in a high-risk industry.

Value conflicts and information security – a mixed-methods study in high-risk industry

“…In addition to this, users’ participatory information security behaviour, taking extended responsibility to protect and further develop the information security, is important for foreseeing and detecting new threats, and managing complex situations. A better understanding of how contextual organisational factors influence these types of human behaviour is, therefore, a vital part of information security (Gyllensten and Torner, 2021).…”