The article explores how well higher education institutions follow information security policies. It looks at how the culture, awareness, and management of information security affect compliance. The researchers reviewed studies from 2006 to 2016 and found that not many studies focus on the security of universities. They discovered that universities struggle to understand security risks and share security policies with their employees. The study shows that the way universities are governed influences how motivated they are to protect information, which leads to better compliance with security policies.