Due to a growing understanding that cybersecurity needs to be addressed also through organizational measures and not by technical measures alone, cybersecurity culture is attracting increasing attention. In this paper, we present findings from a narrative literature review of 69 papers with the purpose to identify the dimensions of cybersecurity culture and how these may be targeted by the organization. The results show that cybersecurity culture is understood as a sub-component of organizational culture comprised of layers that are increasingly more observable. Further, key practices for developing cybersecurity culture resemble those highlighted in the literature on safety culture: management support; policy; awareness and training; involvement and communication; and learning from experience. We conclude with a brief discussion of whether cybersecurity culture and safety culture are two distinct sub-components of organizational culture or can be understood to be overlapping.