With the recent proliferation of information technology, almost all users of technology, no matter the field, profession, or status, have experienced a commensurate increase in information security threats. This, in turn, creates a significant concern in higher institutions of public learning. Information Security Officers in public higher education institutions are not applying the Risk Management Framework defined by the National Institute of Standards and Technology (NIST). This in turn begs the question of what strategies are needed by information security managers and officers to implement an industry-standard, best practice cybersecurity framework. Using the diffusion of innovation theory, the purpose of this phenomenological study was to explore strategies used by information security managers at higher education institutions to conform to information security best practices. Data collected through interviews were coded using and analyzed using NVivo revealing that portions of best practices were in use at the subjects' institutions. To deter this phenomenon, recommendations to the higher education institutions include choosing a best practice framework that contains security controls best suited for the information to be protected, and implementing the controls via high-level policies and procedures. [The dissertation citations contained here are published with the permission of ProQuest LLC. Further reproduction is prohibited without permission. Copies of dissertations may be obtained by Telephone (800) 1-800-521-0600. Web page: http://www.proquest.com.bibliotheek.ehb.be/en-US/products/dissertations/individuals.shtml.]