Information security culture assessment of small and medium-sized enterprises in Tanzania

Zainab Ruhwanya, Jacques Ophoff

Research output: Chapter in Book/Report/Conference proceedingChapter

4 Citations (Scopus)
147 Downloads (Pure)


This study explores the status of information security culture (ISC) of small and medium-sized enterprises (SMEs) in sub-Saharan Africa (SSA) using Tanzania as a case. To assess the ISC of SMEs, measurement criteria from organizational and environmental dimensions were compiled from the literature. A combination of quantitative and qualitative methods was employed to collect data. The ISC dimensions were assessed using surveys collected using both paper and online sources, from 39 SMEs in the roundtable and five focus group discussions. The findings indicated lack of information security policy, absence of security education, training and awareness (SETA) programs, lack of human resource, poor risk assessment, and management and lack of national information security culture initiatives. These findings show the immaturity of ISC in SMEs in Tanzania. The results and implications of these findings suggest further research and intervention is necessary to institutionalize ISC in the SME environment.
Original languageEnglish
Title of host publicationInformation and communication technologies for development
Subtitle of host publicationstrengthening southern-driven cooperation as a catalyst for ICT4D, 15th IFIP WG 9.4 International conference on social implications of computers in developing countries, ICT4D 2019, Dar es Salaam, Tanzania, May 1-3, 2019 : proceedings
EditorsPetter Nielsen, Honest Christopher Kimaro
Place of PublicationCham
Number of pages13
ISBN (Electronic)9783030184001
ISBN (Print)9783030183998
Publication statusPublished - 4 Jun 2019
Externally publishedYes
Event15th International Conference on Social Implications of Computers in Developing Countries - Dar es Salaam, Tanzania, United Republic of
Duration: 1 May 20193 May 2019

Publication series

NameIFIP Advances in Information and Communication Technology (IFIP AICT)
ISSN (Print)1868-4238
ISSN (Electronic)1868-422X


Conference15th International Conference on Social Implications of Computers in Developing Countries
Country/TerritoryTanzania, United Republic of
CityDar es Salaam
Internet address


  • Information security culture
  • Information security
  • Security
  • Culture
  • Small and medium-sized enterprises
  • Tanzania
  • Sub-Saharan Africa

Cite this