Human‐related problems of information security in East African cross‐cultural environments

Purpose The purpose of this paper is to find what kinds of problems, while implementing information security policy, may take place in foreign companies in the East African Community (EAC) because of cultural differences, and to suggest supplemental countermeasures in international frameworks such as Committee of Sponsoring Organizations of the Treadway Commission and ISO/IEC27001. Design/methodology/approach Setting potential problems based on Hofstede's scores of cultural dimensions and the authors' experience, this paper predicts potential problems first by using the theory of level of potential. Local employees working for foreign companies were polled to evaluate the severity of the problems. Based on the survey results, the paper finds which problems may take place, what triggers them and how severe they are. Finally, it finds countermeasures to prevent the problems. Findings Overall, British, US and Japanese companies are found to have higher potential of facing problems in the EAC. The problem of “using a previous company's confidential information” has been found to have the highest severity. British, US and Belgian companies have individualism‐originated problems. Japanese companies have the highest potential of facing problems due to masculinity. Chinese companies have the highest potential of facing problems due to long‐term orientation. In addition, a list of countermeasures is proposed to protect business information. Originality/value The paper has identified information security management (ISM)‐related problems with their severities for each of the selected investing countries in the EAC, applying a new method to predict potential problems concerning ISM in foreign companies. It has recommended practical countermeasures against the six serious problems identified.