The University of SydneyPage 10Security Culture (cont’d)–Weak security culture arise because of a lack of integrity of rules and controls at Formal, Informal and Technical levels–Weak security culture also arise because of lack of institutionalisationof control structures–Security culture should be considered at the logical design phase of systems development–Security culture depends on the degree to which all employees voluntarily follow guidelines