Published Paper Details:

Despite assertion by many scholars that IT security is instrumental in the management of system security, existing studies hardly delve into the adoption, sensitization and implementation IT security policy in organizations. This survey conducted in the context of universities in Kenya aimed to assess the availability of IT security policy, IT security training and policy sensitization, and levels of implementation of IT security policys KPIs. Questionnaires were used to collect data from university staff members, then the data was analyzed using Microsoft Excel to yield frequencies which were expressed into percentages for ease of understanding. Results showed that while IT security policy is vital in system security management, many universities have not adopted it. Further, many staff members are neither trained, nor sensitized on IT security policy. Therefore, it is recommended that IT security policy with relevant KPIs ought to be adopted in all universities, staff trained and sensitized on the security policy for better information systems security management.