This paper presents challenges in cyber security implementation at organisational level. This research is based on a case study on government sector in Malaysia deploying qualitative approach using semi-structured interviews with key officers in the organization. The data were analysed using Grounded Theory. The findings clustered under three pillars of success namely People, Process and Technology. Under the pillar of People, the challenges are lack of skills, cyber security is everyone's responsibilities and human error, whilst under Process, challenges identified are lack of implementation plan, wrongly placed human resource and lack of budget. The challenge in Technology is that it moves too fast. The findings are useful for the cyber security policy makers and implementers. © 2018 IEEE.