Understanding employees’ information security–related stress and policy compliance intention: the roles of information security fatigue and psychological capital

Abstract

Purpose This study aims to explore the emotion-based mediator of information security fatigue in the relationship between employees’ information security–related stress (SRS) and information security policy (ISP) compliance intention and the effects of psychological capital (PsyCap) on relieving SRS and promoting compliance. Design/methodology/approach The authors tested a series of hypotheses by applying partial least squares–based structural equation modeling to survey data from 488 employees in Chinese enterprises. Findings The results suggest that the relationship between SRS and ISP compliance intention is fully mediated by information security fatigue. Employees’ SRS promotes their information security fatigue, which reduces their intention to follow ISPs. In addition, employees with high PsyCap may experience low levels of SRS and information security fatigue, which promotes their willingness to comply with ISPs. Originality/value This study extends knowledge by introducing information security fatigue and PsyCap to the field of information security management, and it calls attention to the effects on information security behaviors of employee emotions and positive psychological resources in an organization. The authors reveal the emotion-based mediating effect of information security fatigue and the positive influence of PsyCap in information security management.

Information systems security resilience as a dynamic capability

“…Our study differs from the extant literature in proposing ISSR as a dynamic capability, which provides a basis to focus on the role of human factors in enabling and hampering an organization’s security posture. Factors such as IS fatigue and psychological capital (Chen et al ., 2022) have only recently emerged in related literature and, as far as we are aware, have not been explicitly considered as important in an organization’s ability to the resilient.…”

“…, 2021; Tu et al ., 2021). A few studies discuss the role of employees within organizations (Chen et al ., 2022; Jansen van Rensburg, 2021), firm characteristics (Tayaksi et al. , 2022), technology infrastructure of the firm, industry network features and characteristics of the security threat (Donalds and Osei-Bryson, 2020).…”

“…Almomani et al, 2021;de Moura et al, 2021;Tu et al, 2021). A few studies discuss the role of employees within organizations (Chen et al, 2022;Jansen van Rensburg, 2021), firm characteristics (Tayaksi et al, 2022), technology infrastructure of the firm, industry network features and characteristics of the security threat (Donalds and Osei-Bryson, 2020). The literature, while providing an understanding of the relevant factors that affect security breaches, stops short of the security incident and rarely considers the capability of a firm to respond to or continue operations and thrive after the event.…”

“…However, more and more, it has been realized that the socio part of the socio-technical systems is more important (Shih et al ., 2021; Stanton et al ., 2005; Yu et al ., 2021). Aspects relating to user behavior, mistakes and misuse often lead to security breaches more often than IT failures (Chen et al ., 2022; Crossler et al ., 2013; Evans et al ., 2019; Juma’h and Alnsour, 2021). Equally as important as prevention is an organization’s capability to react proactively to a breach and recover from it (Lee, 2021).…”

The influence of organizational values on employee attitude and information security behavior: the mediating role of psychological capital

“…Table A1 shows that there are only a few studies that have investigated psychological capital in the information security context. Out of five studies, only two have identified a negative relationship between psychological capital and ISP compliance intention (Chen et al , 2022) and protection-motivated behaviors (Burns et al , 2017). In addition, no study has investigated factors that can improve psychological capital.…”