Predicting information security policy compliance intentions and behavior for six employee-based risks. Issue 4 (2nd October 2017)

• Record Type: Journal Article
• Authors: Ryutov, Tatyana; Sintov, Nicole; Zhao, Mengtian; John, Richard S.
• Is Part Of: Journal of information privacy & security. Volume 13:Issue 4(2017)
• Page Start: 260
• Page End: 281
• Publication Date: 2017-10-02
• Subjects: Information security policy -- security policy compliance -- behavioral factors; Privacy, Right of -- Periodicals; Data protection -- Periodicals; Computer security -- Periodicals; Computer security; Data protection; Privacy, Right of; Periodicals; 005.8
• DOI: 10.1080/15536548.2017.1418632
• Languages: English
• ISSNs: 1553-6548

Abstract

ABSTRACT: Employees' non-compliance with organizational information security policies poses a significant threat to organizations. Enhancing our understanding of compliance behavior is crucial for improving security. Although research has identified numerous psychological factors that affect intentions to comply with security policies, how such intentions map onto actual compliance behavior is not well understood. Building on a well-supported model of security policy compliance intentions, we evaluate compliance with each of six types of information security policies using decision vignettes, and compare parameters across models. The study contributes to information security compliance research by examining each risk separately and exploring heterogeneity across risk types.