The information security culture was assessed by means of a quantitative staff survey one year after a large-scale awareness campaign. The goal of the assessment was to get an initial status quo measurement and also to measure the reception of the previous awareness campaign.