Measuring the security culture in organizations: a systematic overview of existing tools

There has been an increase in research into the security culture in organizations in recent years. This growing interest has been accompanied by the development of tools to measure the level of security culture in order to identify potential threats and formulate solutions. This article provides a systematic overview of the existing tools. A total of 16 are identifed, of which six are studied in detail. This exploration reveals that there is no validated and widely accepted tool that can be used in diferent sectors and organizations. The majority of the tools reviewed use only a quantitative method; however, security culture includes very diferent domains and therefore a mixed-method approach should be used. In contrast to security culture, instruments for measuring safety culture are widely available, and with many similarities between these two domains it is possible that well-established tools for measuring safety culture could be adapted to a security environment