Education institutions within and outside Ghana continue to experience mass information leakages at an alarming rate even with the huge investment made in information technology infrastructure to secure their information assets. The lack of organisational commitment to enhance the non-technical aspects of information security − thus, information security culture (ISC) − largely accounts for the consistent rise of security breaches in institutions like the educational institutions. Securing information assets goes beyond technical controls and encompasses people, technology, policy, and operations. The aim of this paper is to identify a comprehensive list of the factors of ISC and construct a conceptual ISC framework (InfoSeCulF) that can be used to provide guidance for the cultivation of a strong ISC in higher learning institutions to secure information assets. A scoping literature review was conducted to determine what constitutes a comprehensive list of factors for cultivating ISC in higher learning institutions. The study proposes a comprehensive list of factors and provides a conceptual framework (InfoSeCulF) which serves as guide for cultivating a strong ISC in institutions.