The investigation in this paper takes a social and organizational approach to information systems security management and proposes a framework which illustrates three important issues in the process of security management through goal setting, these are: trust, culture, and risk communication. Three case studies show evidence that there is a chain reaction among these issues with a subsequent effect on the level of security goal setting. Ultimately, the paper identifies the determinants of trust within the IT departments of three financial institutions in Greece and provides also a discussion regarding the research methods that were used to obtain the results.