Examples of external threats include hacking, espionage, organized crime and terrorism.

New technologies have opened up tremendous opportunities for organizations but have also created potential threats.

Cloud computing is one of the main drivers of the business model innovation. Over the past two years, the number of organizations using cloud-computing services has doubled.

However, 38 percent of respondents to the survey indicated that their organizations have not taken measures to mitigate risks, such as not exercising stronger oversight over the contract management process for cloud-service providers nor using encryption techniques.

In the new area of social media, the survey found that it can quickly build an organization's brand and expand its presence, and it can just as quickly crush it.

Challenges include data security, privacy concerns, regulatory and compliance requirements and the impact on productivity.

"Short-term incremental changes and bolt-on solutions are not sufficient," said Yumin Lin, EY China advisory director.

"By fundamentally transforming their information security management strategy, organizations can respond effectively to existing security threats, as well as to security risks arising from emerging technologies," Lin said.

However, about 63 percent of respondents indicated that their organizations have no formal security architecture framework in place, while only 16 percent of respondents claim their information security functions do meet their business needs.