Security breaches have attracted attention from corporations and scholars alike. The major organisations are determined to stop security breaches as they are detrimental to their success. Arguably the most common factor contributing to these breaches is employee behaviour, which suggests that changes in employee behaviour can have an impact on improving security. This research aims to study the critical factors (CFs) that impact on employee behaviours toward compliance with their organisation's information security policy. This investigation will focus on the various critical success factors based on their grouping into one of the following three major categories, namely: organisational factors, behavioural factors and training factors. Each of these categories affects a different aspect of information security and the objective is to not only understand the interaction of different factors but also to study further the aims in order to provide practical recommendations for improving organisational information security management. This study has utilised empirical research through the use of both qualitative and quantitative methodologies to inform each stage of the research. This study focused on the health, business and education sectors by empirically evaluating the obstacles and success factors that affect employee compliance to organisational security policies. In addition, this study also evaluated the affect of the socio-technical impact on organisational information security management. The final stage of the research focused on developing an effective training and awareness programme. This training programme was constructed by incorporating the techniques that were identified as enhancing employee perceptions, attitudes and motivations, in order to facilitate a better transference of skills and more sustainable and appropriate behaviours to improve organisational information security management in the workplace. The techniques utilised included: effective communication, knowledge reinforcement, pre- and post-assessment and motivational techniques.

L'ère industrielle et la formation des premiers systèmes socio-techniques modernes a conduit à l'irruption du risque dans le champ social. Le concept de risque a connu à cette occasion une évolution de son contenu : pensé, avant la Révolution Industrielle, d'un point de vue théologique, la nouveauté du risque industriel a imposé une nouvelle approche scientifique pour en décrire la réalité. D'abord focalisées sur l'aspect technique, les premières approches ont évolué vers une prise en compte des dimensions humaines et organisationnelles des organisations sous la pression de catastrophes majeures. Cette thématique du risque concerne très directement GrDF en raison de la nature dangereuse du gaz naturel. Cette entreprise est une organisation récente mais héritière d'une histoire importante où la volonté de maîtriser et réduire les risques est un élément clé de l'éthique de l'entreprise. Des accidents récents ont cependant souligné l'atteinte d'une asymptote dans ce domaine, suscitant une volonté managériale de changement majeur. Plusieurs démarches ont ainsi été lancées, avec pour point commun l'intégration du paradigme des facteurs humain et organisationnel de la sécurité. Les démarches de renouvellement du retour d'expérience et de création d'un simulateur à destination des responsables opérationnels de l'exploitation du réseau de distribution de gaz font l'objet de ce manuscrit. Les premiers résultats collectés montrent un changement en profondeur des comportements managériaux et de terrain. Cependant, des limites persistent et illustrent le conflit suscité par l'insertion dans une organisation structurée autour des principes de l'organisation scientifique du travail et du paradigme de la sûreté de fonctionnement d'une nouvelle approche de la sécurité. Ce cas d'étude vise ainsi, par la présentation des compromis opérationnels et managériaux observés, à proposer une meilleure compréhension des déterminants de la réussite d'un tel projet dans le cadre d'une opposition forte entre différentes conceptions de la sécurité. / The industrial era and the subsequent development of the first modern socio-technical systems led to the necessity of taking risk into account. This concept, thought before the French Revolution on a theological basis, had to evolve in a more scientific direction. If the technical aspect focused interest at first, the human and organizational dimension had to be integrated, following major accidents. Risk management is a major concern for GrDF due to the nature of natural gas. Created recently, this company inherited a strong preoccupation for the reduction of risks. However, recent events demonstrated the existence of a threshold in this progression. The need for change led to the development of two important projects concerning the learning from past experience process and the formation process. First results show that a major evolution is reshaping managerial and field behaviors. Some perduring limits illustrates however that this change process faces strong resistance from an organization structured around the paradigm of technical safety. This case study first aims at identifying the key factors of success in such a process by developing a better understanding of managerial and operational trade-offs through observation.