Protective Measures and Security Policy Non-Compliance Intention
- 1 January 2019
- journal article
- research article
- Published by IGI Global in Journal of Organizational and End User Computing
- Vol. 31 (1), 1-21
- https://doi.org/10.4018/joeuc.2019010101
Abstract
Internal vulnerabilities and insider threats top the list of information security (InfoSec) incidents; prompting organizations to establish InfoSec policy (ISP). Yet, mitigating user's ISP non-compliance is still an arduous task. Hence, this study aims to minimize user's ISP non-compliance intention by investigating their perception and attitude toward ISP non-compliance. Specifically, protective measures drawing upon the protection motivation theory - perceived severity of ISP non-compliance, rewards and familiarity with ISP - analyze users' attitude toward ISP non-compliance. Further, the new construct, information technology (IT) vision conflict, is the mismatch between the values that users hold and those embedded in the ISP. The misalignment of the two conflicting values moderates the relationship between the protective measures and attitude toward ISP non-compliance. Findings show that IT vision conflict weakens the negative relationship between perceived severity of ISP non-compliance and attitude toward ISP non-compliance; indirectly affecting ISP non-compliance intention.Keywords
This publication has 49 references indexed in Scilit:
- Don't make excuses! Discouraging neutralization to reduce IT policy violationComputers & Security, 2013
- Organizations' Information Security Policy Compliance: Stick or Carrot Approach?Journal of Management Information Systems, 2012
- What is Information Security?Published by Elsevier BV ,2011
- Information Security Policy Compliance: An Empirical Study of Rationality-Based Beliefs and Information Security AwarenessMIS Quarterly, 2010
- The information security digital divide between information security managers and usersComputers & Security, 2009
- If someone is watching, I'll do what I'm asked: mandatoriness, control, and information securityEuropean Journal of Information Systems, 2009
- Perceptions of Information Security in the Workplace: Linking Information Security Climate to Compliant BehaviorJournal of Information Privacy and Security, 2005
- Deviance Regulation: A Theory of Action and IdentityReview of General Psychology, 2003
- Measuring User Participation, User Involvement, and User AttitudeMIS Quarterly, 1994
- Development of a Tool for Measuring and Analyzing Computer User SatisfactionManagement Science, 1983