Information security policy noncompliance: An integrative social influence model. (13th August 2019)

• Record Type: Journal Article
• Authors: Gwebu, Kholekile L.; Wang, Jing; Hu, Michael Y.
• Is Part Of: Information systems journal. Volume 30:Number 2(2020)
• Page Start: 220
• Page End: 269
• Publication Date: 2019-08-13
• Subjects: ethical climate -- information security management -- IS Security -- security policy violation; Information technology -- Periodicals; Management information systems -- Periodicals; 303.4833
• DOI: 10.1111/isj.12257
• Languages: English
• ISSNs: 1350-1917

Abstract

Abstract: Despite the significant advancements made in understanding the factors that drive employees' compliance and noncompliance behaviours with information security policy (ISP), less is known about how different factors interact to impact such behaviours. Having been drawn on the social information processing theory, this research develops an integrative model that investigates how ethical work climate, beliefs, and neutralization interact to jointly explain ISP noncompliance. The model is tested via a survey of a broad cross section of employees. Neutralization, perceived cost of compliance, and perceived cost of noncompliance are found to significantly impact ISP noncompliance. Egoistic, benevolent, and principled climates are found to differentially influence neutralization and individuals' cognitive beliefs about the cost and benefit of ISP compliance versus noncompliance. Neutralization appears to be a more important moderator of the belief‐noncompliance relationship than the principled climate.