Information Security: Still Not my Job!

The research presented in this paper is based on interviews with 51 employees from 51 different organizations (including private and public sectors). Employees were interviewed more than once, over a period of 6 months, each interview lasted between 30 min to 1 h. The discussion in this paper is based on interviews during sessions which were explicitly dedicated to Information Systems and Cybersecurity as themes and focus. The majority of the interviewees were professionals who were not IT people [four interviewees had IT-related jobs]. The interviewees were all employees who, according to their own description, handle sensitive data and therefore, should take security considerations into account while doing their job. The research findings put some doubt both on whether or not security is seen as part of non-IT professionals’ job responsibility, or even if it is possible for non-IT professionals to take responsibility in the context of their actual work practices. This suggests that information security is, according to employees in many organizations, still viewed as an overlay on top of other tasks and responsibilities.