Developing a cybersecurity culture framework: a case study of Namibia’s telecommunications sector

Abstract

In today's digital environment, where cyber threats are on the rise, organisations face cyber risks that extend beyond technical vulnerabilities. A lack of a cybersecurity culture is often the primary reason why organisational resilience is compromised, as employees' attitudes and behaviours significantly affect the effectiveness of security measures. This study addresses the problem that cybersecurity initiatives in Namibia’s telecommunications sector remain largely technical and compliance-driven, while behavioural, organisational and cultural factors that shape secure employee practices are insufficiently understood. Based on these insights, the study seeks to develop a cybersecurity culture framework comprising of six key elements: leadership commitment and support; policy reviews and communication; a Security Education, Training and Awareness (SETA) programme; collaboration and feedback; security champions and ambassadors; and a rewards scheme. A qualitative case study was conducted in a Namibian telecommunications organisation, involving 25 participants purposively selected from across management levels and from IT and non-IT departments. The data were gathered during semi-structured interviews and were analysed thematically. The study's findings reveal key gaps in existing practices, including leaders' passive involvement, inadequate continuous and role-specific training, weak awareness initiatives, and poor reinforcement mechanisms, that impede the development of a proactive security culture. Participants highlighted incentive-based recognition, gamified and tailored training, and security champions as critical enablers of behavioural change. The study contributes to the body of knowledge on organisational cybersecurity by providing context-specific insights to strengthen human-centred defences and by outlining implications for extending this approach to other critical infrastructure sectors that adopt emerging technologies.