Key drivers of information security culture: A survey and exploratory factor analysis in an energy retail organization

The energy retail sector is foundational to the energy industry value chain, making the strengthening of its information security culture an organizational necessity. This study examines the factors that influence information security culture in European energy retail businesses, based on a survey developed from insights gained through a narrative literature review and conducted within an energy retail organization. A total of 610 employees completed the survey, resulting in a 29% response rate, and an Exploratory Factor Analysis (EFA) was subsequently performed to identify the underlying key drivers of information security culture. These include: (1) Management engagement in information security, (2) Inclusion of information security in formal performance appraisal and (3) Assignment of responsibility for information security reporting. Theoretically, this study contributes to the field of IT Governance, Risk Management, and Compliance (IT-GRC) within the critical energy sector, while its findings provide a practical executive summary for strengthening information security culture strategies within energy retail organizations.