Cognitive‐affective drivers of employees' daily compliance with information security policies: A multilevel, longitudinal study

Abstract

We present a model of employee compliance with information security policy (ISP) that (1) explicates stable, cognitive beliefs regarding the consequences of compliance and noncompliance as well as state‐based affective constructs, namely, positive and negative mood states and episodic, security‐related work‐impediment events, and (2) provides an expanded conceptualisation of moral considerations and normative influences regarding employees' ISP compliance. Because affect is central to this theorisation, we ensure that the model captures and explains differences in day‐to‐day affective constructs to account for the often fleeting nature of affective states. We test our multilevel model using an experience‐sampling methodology design, in which employees completed daily surveys over a 2‐week period, followed by a hierarchal linear modelling statistical assessment. Our contribution to theory is a unique account of ISP compliance that integrates affective factors with constructs from rational choice theory and theory of planned behaviour and that diverges from prior conceptualisations of ISP compliance as a purely stable and reason‐based phenomenon. For practitioners, our results suggest that a combination of cognitive and affective influences may produce discrete episodes of ISP compliance that do not coincide with prior behavioural trends.

Seeing the Forest and the Trees: A Meta-Analysis of the Antecedents to Information Security Policy Compliance

“…Our results align with this view as the effect size for detection certainty was .10 larger than that of punishment expectancy (see Table 3) and exhibited stronger relative importance (Table 7). (b) A small number of studies combined the measurement items for punishment certainty and punishment severity into a single construct D'Arcy and Lowry 2019;Hovav and Putri 2016). In these cases, we did not code the variable into either the punishment certainty of punishment severity category; it was ungrouped for our analysis.…”

The impact of leadership on employees' intended information security behaviour: An examination of the full‐range leadership theory

“…In our research model, the behavioural intention outcome measure is actual, self‐reported security participation behaviour as opposed to security participation intention. According to D'Arcy and Lowry (), and based on the fact that security participation behaviour is self‐reported, it is similar to an intention measure and not an unbiased intention measure of actual information security participation. Hence, we view our behavioural outcome variable (security participation) as conceptually similar to the intention portion of theory of planned behaviour.…”

“…Furthermore, we argue that employees' information security behaviour is a bidimensional construct that is composed of 2 behavioural dimensions, namely, in‐role and extra‐role behaviour, which have been considered in previous studies (eg, Guo, 2013; Hsu, Shih, Hung, & Lowry, ). Although academic research should strive to investigate employees' actual behaviour, certain obstacles in real‐life organizational settings can make this undertaking impossible, thereby providing justification for assessing behavioural intentions as approximations of actual behaviour (D'Arcy & Lowry, ; Hu et al, ; Lowry et al, ; Mehri & Ahluwalia, ; Vroom & Von Solms, ). It is commonly argued that the relationship between behavioural intention and actual behaviour is grounded in the theory of planned behaviour by Ajzen () (eg, Anderson & Agarwal, ; Siponen & Vance, ) and several researchers demonstrated a strong correspondence between the 2 constructs (D'Arcy & Lowry, ; Herath et al, ; Li, Sarathy, Zhang, & Luo, ; Webb & Sheeran, ).…”

“…It is commonly argued that the relationship between behavioural intention and actual behaviour is grounded in the theory of planned behaviour by Ajzen () (eg, Anderson & Agarwal, ; Siponen & Vance, ) and several researchers demonstrated a strong correspondence between the 2 constructs (D'Arcy & Lowry, ; Herath et al, ; Li, Sarathy, Zhang, & Luo, ; Webb & Sheeran, ). This is especially true when there is a short time gap between the stated intention and actually performing behaviour (Ajzen, , ; D'Arcy & Lowry, ). The reviewed information security literature provides evidence that intention is a behavioural action tendency.…”

The Relationship of Collaboration Technologies and Cognition and Affect

“…[7] with a research agenda for the information systems (IS) domain) and continue to be of focal interest today (e.g. [8,9]). Initially, while decision-making aspects and cognitive facets were in the main focus of research, like the design of decision rooms (e.g.…”