Assessing the Moderating Effect of Security Technologies on Employees Compliance with Cybersecurity Control Procedures

Abstract

The increase in cybersecurity threats and the challenges for organisations to protect their information technology assets has made adherence to organisational security control processes and procedures a critical issue that needs to be adequately addressed. Drawing insight from organisational theory literature, we develop a multi-theory model, combining the elements of the theory of planned behaviour, competing value framework, and technology—organisational and environmental theory to examine how the organisational mechanisms interact with espoused cultural values and employee cognitive belief to influence cybersecurity control procedures. Using a structured questionnaire, we deployed structural equation modelling (SEM) to analyse the survey data obtained from public sector information technology organisations in Nigeria to test the hypothesis on the relationship of socio-organisational mechanisms and techno-cultural factors with other key determinants of employee security behaviour. The results showed that knowledge of cybersecurity and employee cognitive belief significantly influence the employees’ intentions to comply with organisational cybersecurity control mechanisms. The research further noted that the influence of organisational elements such as leadership on employee security behaviour is mediated by espoused cultural values while the impact of employee cognitive belief is moderated by security technologies. For effective cybersecurity compliance, leaders and policymakers are therefore to promote organisational security initiatives that ensure incorporation of cybersecurity principles and practices into job descriptions, routines, and processes. This study contributes to behavioural security research by highlighting the critical role of leadership and cultural values in fostering organisational adherence to prescribed security control mechanisms.

A repurchase intention model of Indonesian herbal tea consumers: integrating perceived enjoyment and health belief

“…Compared to the findings from other fields of study, the insignificant effect of cognitive belief was rare (e.g. Verbeke, 2005;Tolma et al, 2006;Onumo et al, 2021) but not unheard of. There are two main reasons behind this finding.…”

A repurchase intention model of Indonesian herbal tea consumers: integrating perceived enjoyment and health belief

“…Compared to the findings from other fields of study, the insignificant effect of cognitive belief was rare (e.g. Verbeke, 2005;Tolma et al, 2006;Onumo et al, 2021) but not unheard of. There are two main reasons behind this finding.…”

Building a thematic framework of cybersecurity: a systematic literature review approach

“…A search for keywords was conducted on Scopus, a prominent database offering extensive search options, user-friendly searching and analytical tools and a global subject scope with daily updates to ensure the quality of published papers. The development of keywords is based on the research question, following the guidance of Okoli (2015), and relies on various sources, including online thesauruses, keywords used in previous studies and input from experts. The study used the keywords “cybersecurity,” “cyber security,” “information security,” “information system security,” “information technology security,” “internet of things security,” “digital security,” “policy,” “risk,” “framework,” “management” and “risk management.” The combinations of these terms were analyzed through search functions, including field code functions, phrase searching and Boolean operators within Scopus databases (refer to Table 1 for details).…”

“…(2009). Okoli (2015) recommended that researchers should select a time frame for their study. For this study, the time frame between 2014 and 2023 was selected as the first inclusion criterion.…”

“…In Ifinedo's (2014) research, attitude was identified as having the greatest impact on compliance intention. An individual's habits (Aigbefo et al, 2022) and cognitive beliefs (Onumo et al, 2021) also strongly influence his intention to comply with an organization's cybersecurity policy requirements. Meanwhile, behavior intention is significantly influenced by attitudes toward a particular behavior (Tam et al, 2022).…”

“…Skilled employees in managing cybersecurity are strong predictors of an organization's readiness to combat cyberattacks (Hasan et al, 2021). Employees with knowledge of their company's information security policies and procedures are better equipped to handle cybersecurity tasks (Li et al, 2019) and comply with organizational cybersecurity control mechanisms (Onumo et al, 2021). Table 2.…”

A repurchase intention model of Indonesian herbal tea consumers: integrating perceived enjoyment and health belief

“…Compared to the findings from other fields of study, the insignificant effect of cognitive belief was rare (e.g. Verbeke, 2005;Tolma et al, 2006;Onumo et al, 2021) but not unheard of. There are two main reasons behind this finding.…”

Building a thematic framework of cybersecurity: a systematic literature review approach

“…A search for keywords was conducted on Scopus, a prominent database offering extensive search options, user-friendly searching and analytical tools and a global subject scope with daily updates to ensure the quality of published papers. The development of keywords is based on the research question, following the guidance of Okoli (2015), and relies on various sources, including online thesauruses, keywords used in previous studies and input from experts. The study used the keywords “cybersecurity,” “cyber security,” “information security,” “information system security,” “information technology security,” “internet of things security,” “digital security,” “policy,” “risk,” “framework,” “management” and “risk management.” The combinations of these terms were analyzed through search functions, including field code functions, phrase searching and Boolean operators within Scopus databases (refer to Table 1 for details).…”

“…(2009). Okoli (2015) recommended that researchers should select a time frame for their study. For this study, the time frame between 2014 and 2023 was selected as the first inclusion criterion.…”

“…In Ifinedo's (2014) research, attitude was identified as having the greatest impact on compliance intention. An individual's habits (Aigbefo et al, 2022) and cognitive beliefs (Onumo et al, 2021) also strongly influence his intention to comply with an organization's cybersecurity policy requirements. Meanwhile, behavior intention is significantly influenced by attitudes toward a particular behavior (Tam et al, 2022).…”

“…Skilled employees in managing cybersecurity are strong predictors of an organization's readiness to combat cyberattacks (Hasan et al, 2021). Employees with knowledge of their company's information security policies and procedures are better equipped to handle cybersecurity tasks (Li et al, 2019) and comply with organizational cybersecurity control mechanisms (Onumo et al, 2021). Table 2.…”

A repurchase intention model of Indonesian herbal tea consumers: integrating perceived enjoyment and health belief

“…Compared to the findings from other fields of study, the insignificant effect of cognitive belief was rare (e.g. Verbeke, 2005;Tolma et al, 2006;Onumo et al, 2021) but not unheard of. There are two main reasons behind this finding.…”

Building a thematic framework of cybersecurity: a systematic literature review approach

“…A search for keywords was conducted on Scopus, a prominent database offering extensive search options, user-friendly searching and analytical tools and a global subject scope with daily updates to ensure the quality of published papers. The development of keywords is based on the research question, following the guidance of Okoli (2015), and relies on various sources, including online thesauruses, keywords used in previous studies and input from experts. The study used the keywords “cybersecurity,” “cyber security,” “information security,” “information system security,” “information technology security,” “internet of things security,” “digital security,” “policy,” “risk,” “framework,” “management” and “risk management.” The combinations of these terms were analyzed through search functions, including field code functions, phrase searching and Boolean operators within Scopus databases (refer to Table 1 for details).…”

“…(2009). Okoli (2015) recommended that researchers should select a time frame for their study. For this study, the time frame between 2014 and 2023 was selected as the first inclusion criterion.…”

“…In Ifinedo's (2014) research, attitude was identified as having the greatest impact on compliance intention. An individual's habits (Aigbefo et al, 2022) and cognitive beliefs (Onumo et al, 2021) also strongly influence his intention to comply with an organization's cybersecurity policy requirements. Meanwhile, behavior intention is significantly influenced by attitudes toward a particular behavior (Tam et al, 2022).…”

“…Skilled employees in managing cybersecurity are strong predictors of an organization's readiness to combat cyberattacks (Hasan et al, 2021). Employees with knowledge of their company's information security policies and procedures are better equipped to handle cybersecurity tasks (Li et al, 2019) and comply with organizational cybersecurity control mechanisms (Onumo et al, 2021). Table 2.…”