As the global cyber threat continues to increase, best practices to form an information security culture are needed. The majority of personal data breaches and cyber incidents result from human error and a lack of awareness. In 2025, this is common knowledge. However, there are still few practical strategies and guides on identifying and implementing security best practices fitted to an organization's specific needs. The main goal of this study is to aid organizations in improving their information security culture. To address this, the study uses a systematic literature review and qualitative semi-structured interviews with experienced professionals in the cybersecurity field. To analyze the gathered data, a manual thematic analysis was performed to give insight into the patterns and themes. While the information security culture topic can seem abstract, there are some concrete solutions to it. Data shows that an open, forgiving, and non-bureaucratic communication combined with personality adaptation and training are fundamental key pillars in shaping a robust information security culture. 

The results suggest that by assessing departments, encouraging direct communication, and allowing informal as well as formal discussions around security, organizations can better identify and implement their needs.