Anonymised dataset for cybersecurity study survey

Cybersecurity awareness, practice and institutional provision among university end-users DOI: 10.5281/zenodo.22955139 Licence: CC BY 4.0 Version: 1.0 Survey data from 459 third- and fourth-year undergraduate end-users of a public university's information systems in southern Ethiopia, collected April–May 2026. The dataset supports an article examining whether the constraint on protective security behaviour in an organisational population lies with users or with institutional provision. Files File Description cybersecurity_survey_anonymised.xlsx Full package: data, codebook, instrument, anonymisation log cybersecurity_survey_anonymised.csv Data sheet only, UTF-8, for direct import Both data files contain identical records. The CSV is provided for software that handles Excel poorly. Data 459 rows, 49 variables, one row per respondent. No missing values on any analysis variable. Identifiers and demographics: respondent_id (R001–R459), age_band, sex, college, year_of_study, collection_week. Scales (all items retained unaltered): Scale Items Response anchors Cronbach's α Security awareness 7 1 = Strongly Disagree … 5 = Strongly Agree .850 Protective practice 7 1 = Never … 5 = Always .807 Risk perception 6 1 = Strongly Disagree … 5 = Strongly Agree .709 Other variables: formal training received, self-study, willingness to attend training, exposure to institutional campaigns, perceived peer influence, internet use purposes, cybersecurity information sources, and an optional free-text comment (280 non-empty responses). Multi-select questions appear as a combined string column plus one binary column per option (1 = selected). These binary columns are the ones to use for analysis. Composition: 251 men, 208 women; 358 in year 3, 101 in year 4. Institute of Technology 135, Medicine and Health Sciences 110, Natural and Computational Sciences 82, Agriculture 80, Business and Economics 52. Collection Self-administered online survey built in KoboToolbox, distributed as an open link through official university and college Telegram channels and the Student Union, 22 April – 8 May 2026. Target population: third- and fourth-year undergraduates in five of the university's eight colleges (N = 5,304 per registrar records). Three colleges outside the main city were not covered. Participation was voluntary and self-initiated with no sampling frame, so this is a self-selected convenience sample stratified post hoc by college. 461 responses were received; 2 were removed for failing embedded logic checks. The achieved sample departs from proportional allocation: the College of Business and Economics is under-represented by 24.2 percentage points, women are over-represented by 11.5 points, and third-year students by 9.4 points. Post-stratification weighting by college population share changes composite estimates by less than 0.01 scale points. Anonymisation Applied before deposit. Full log in the anonymisation sheet. Removed: deviceid (device fingerprint, 419 distinct values), _id, _uuid, meta/rootUuid, _index, _submitted_by, and other platform metadata. Dropped: Department/Program (populated for one college only, categories as small as n = 3); Disability status (special-category data with cells of n = 1 and n = 2; not used in any analysis). Generalised: exact age → three bands; submission timestamp → collection week. Retained unaltered: all scale items, so published analyses reproduce exactly. Free-text comments were screened for names, email addresses, phone numbers, social handles and URLs; none were found. Residual risk. Six records fall in cells smaller than five on the sex × college × year combination. Strict k ≥ 5 was not achievable without suppressing variables required by the published analysis. The data contain no health, financial, criminal, political or other sensitive attributes, and were collected anonymously from a population of 5,304, so residual re-identification risk was judged low and disproportionate to the analytic cost of further suppression. Users requiring a k ≥ 5 file should contact the authors. Reproduction The following reproduce from this file: awareness M = 3.646 (SD 0.678); practice M = 3.123 (SD 0.830); perception M = 3.516 (SD 0.595); r(awareness, practice) = .508; practice by sex 3.32 vs 2.89; formal training received 21.1%; would attend training 86.3%. Composite scores are unweighted item means after mapping agreement anchors 1–5 and frequency anchors 1–5. Ethics Institutional permission Ref. ODTTVD/56/18, 21 April 2026, authorising distribution through college administrations and the Student Union. At the time of the study the institution did not operate a formally constituted research ethics committee with jurisdiction over minimal-risk social research. The study followed the principles of the Declaration of Helsinki. Participants consented electronically before any item was displayed; participation was voluntary and could be discontinued without consequence. No identifying information was collected at source. Citation Yimmam. A, Bati. Tesfaye, Kebede. T (2026), Cybersecurity awareness, practice and institutional provision among university end-users dataset, Zenodo, doi: 10.5281/zenodo.22955139.