Institutional Pressures and the Adoption of Information Security Strategies in Ugandan Commercial Banks

This paper examines how coercive, normative, and mimetic institutional pressures influence the adoption of information security strategies (ISS) in Ugandan commercial banks. (DiMaggio & Powell, 1983) Using a quantitative cross-sectional survey of 142 professionals across IT/security, risk/compliance, operations and related functions, we apply descriptive statistics, Pearson correlations, and multiple regression to test three hypotheses derived from institutional theory. Coercive (M=4.25, SD=0.67) and normative (M=4.12, SD=0.72) pressures are positively and significantly associated with ISS adoption, whereas mimetic pressures (M=3.42, SD=0.86) are not. (DiMaggio & Powell, 1983) Regression results show coercive and normative factors jointly explain 46.4% of variance in adoption (Adjusted R²=.464), with normative the strongest predictor (β=.556, p<.01). Findings indicate that regulatory oversight and professional standards, more than peer imitation, catalyse substantive security practices. We discuss implications for risk-based regulation, sector coordination, and capability building to strengthen cybersecurity resilience in African banking.