  While the creation of a strong security culture has been researched and
discussed for decades, it continues to elude many businesses. Part of the
challenge faced is distilling pertinent, recent academic findings and research
into useful guidance. In this article, we aim to tackle this issue by
conducting a state-of-the-art study into organisational cyber security culture
research. This work investigates four questions, including how cyber security
culture is defined, what factors are essential to building and maintaining such
a culture, the frameworks proposed to cultivate a security culture and the
metrics suggested to assess it. Through the application of the PRISMA
systematic literature review technique, we identify and analyse 58 research
articles from the last 10 years (2010-2020). Our findings demonstrate that
while there have been notable changes in the use of terms (e.g., information
security culture and cyber security culture), many of the most influential
factors across papers are similar. Top management support, policy and
procedures, and awareness for instance, are critical in engendering cyber
security culture. Many of the frameworks reviewed revealed common foundations,
with organisational culture playing a substantial role in crafting appropriate
cyber security culture models. Questionnaires and surveys are the most used
tool to measure cyber security culture, but there are also concerns as to
whether more dynamic measures are needed. For practitioners, this article
highlights factors and models essential to the creation and management of a
robust security culture. For research, we produce an up-to-date
characterisation of the field and also define open issues deserving of further
attention such as the role of change management processes and national culture
in an enterprise's cyber security culture.
