Establishing information security policy compliance culture in organizations

Abstract

Purpose This paper aims to establish that employees’ non-compliance with information security policy (ISP) could be addressed by nurturing ISP compliance culture through the promotion of factors such as supportive organizational culture, end-user involvement and compliance leadership to influence employees’ attitudes and behaviour intentions towards ISP in organizations. This paper also aims to develop a testable research model that might be useful for future researchers in predicting employees’ behavioural intentions. Design/methodology/approach In view of the study’s aim, a research model to show how three key constructs can influence the attitudes and behaviours of employees towards the establishment of security policy compliance culture (ISPCC) was developed and validated in an empirical field survey. Findings The study found that factors such as supportive organizational culture and end-user involvement significantly influenced employees’ attitudes towards compliance with ISP. However, leadership showed the weakest influence on attitudes towards compliance. The overall results showed that employees’ attitudes and behavioural intentions towards ISP compliance together influenced the establishment of ISPCC for ISP compliance in organizations. Practical implications Organizations should influence employees’ attitudes towards compliance with ISP by providing effective ISP leadership, encouraging end-user involvement during the draft and update of ISP and nurturing a culture that is conducive for ISP compliance. Originality/value The study provides some insights on how to effectively address the problem of non-compliance with ISP in organizations through the establishment of ISPCC, which has not been considered in any past research.

Information privacy behavior in the use of Facebook apps: A personality-based vulnerability assessment

“…(2015) , who confirmed the behavioral influence of attitude on the intention of employees to comply with information security policies, albeit qualitatively. Both Ifinedo (2014) and Amankwa et al. (2018) found that attitude displayed the most significant effect size on complying with information security policies.…”

A Model of Information Security Policy Compliance for Public Universities: A Conceptual Model

“…Likewise, the research conducted by Arage [37], states that national culture has an impact on information security compliance. Another factor within the organization is user involvement and leadership, this potential was seen by Amankwa [38] in his research on Establishing information security policy compliance culture in organizations using the theory of organizational behavior and organization culture. However, differences in results found by Sommestad [36] investigated the relationship between individual intentions in social groups rather than the workplace and the effects of this group by using the theory of planned behavior and information security culture.…”

“…In a company with a stable culture, the appropriate policies and procedures, including sanctions and education programs regarding the policy, will be well implemented. Employee non-compliance with information security policies (ISP) can be overcome by maintaining an ISP compliance culture through organizational culture [38]. Further studies are needed to find out factors such as organizational culture to find out the involvement of organizational culture can influence compliance with security policies.…”

Assessment of Employees Level of Awareness in the Aspect of Information Security

“…A frequently encountered statement, both in the literature of the subject and also among specialists dealing with data protection, the weakest element of information security is the human factor. It is the human inclination to make mistakes and adulteration and abuse that may result in the loss or disclosure of company information (Amankwa, Loock, Kritzinger, 2018;Pałęga, 2015;Palega, Knapinski, 2017). Nevertheless, in the belief of the authors of this publication, it is also the potential of human skills, capabilities, ideas, commitment and motivation of employees can be an effective defense against the failure of technical security.…”