Countries in the Gulf represent thriving, globally important commercial centres. They have embraced technology and modern management methods, often originating in the western countries. In adapting to quite different cultures these do not always operate as successfully. The adoption and practices of the Information Security Risk Management (ISRM) frameworks are an example. Although ISRM has become a standard in information security for much of the world, its uptake in the Gulf countries has been poor. This study tests the possibility that this may be due to cultural "biases" built into the operation and structure of the framework. Using a Design Science approach it aims to develop a modified ISRM framework that incorporates a cultural dimension. This will lead to an increased acceptance of ISRM in Gulf countries, and also to allowing it to be used in other non-western cultures. Centring on Saudi Arabia as a typical example of a Gulf culture, a qualitative approach will be adopted. Data will be collected through structured interviews with information security experts in Saudi Arabian organisations, system integrators and vendors. These will focus on cultural dimensions of parts of the ISRM framework and business responses that result. The modified framework developed through this method will be confirmed using focus groups. [For full proceedings, see ED571459.]