Variables influencing information security policy compliance

Abstract

Purpose: To identify variables that influence compliance with information security policies of organizations and to identify how important these variables are. Design/methodology/approach: A systematic review of empirical studies described in extant literature is performed. This review found 29 studies meeting its inclusion criterion. The investigated variables in these studies and the effect size reported for them were extracted and analysed. Findings: In the 29 studies more than 60 variables have been studied in relation to security policy compliance and incompliance. Unfortunately, no clear winners can be found among the variables or the theories they are drawn from. Each of the variables only explain a small part of the variation in people's behaviour and when a variable has been investigated in multiple studies the findings often show a considerable variation. Research limitations/implications: It is possible that the disparate findings of the reviewed studies can be explained by the sampling methods used in the studies, the treatment/control of extraneous variables and interplay between variables. These aspects ought to be addressed in future research efforts Practical implications: For decision makers who seek guidance on how to best achieve compliance with their information security policies should recognize that a large number of variables probably influence employees' compliance. In addition, both their influence strength and interplay is uncertain and largely unknown. Originality/value: This is the first systematic review of research on variables that influence compliance with information security policies of organizations.

Information Security and People: A Conundrum for Compliance

“…Communicating the certainty and severity of sanctions for security non-compliance has been considered as an effective management strategy to prevent security non-compliance. However, inconsistent findings of the impact of sanctions have been reported (Sommestad et al 2014). For example, fear of penalties for noncompliance has been found to have a significant impact on security behaviour Rao 2009a, Kankanhalli et al 2003).…”

“…These theories have been found to affect security compliance to some extent in the aggregate. However, most quantitative studies did not examine whether average end-users and security experts/managers complied differently (Sommestad et al 2014). In this case aggregate data cannot adequately inform management decision making because the aggregate user is a nonexistent artefact of statistics, such as is derived when gender results are averaged to produce a mean that is neither male nor female.…”

“…Earlier quantitative studies often employed well-founded behavioural theories to explain security compliance (Sommestad et al 2014). Behavioural theories are widely applied to the information security context.…”

“…There have also been inconsistent results regarding the effect of rewards on compliance. Rewards were not considered a good predictor of intention to comply (Sommestad et al 2014). For instance, Bulgurcu et al (2010) found rewards, as a part of compliance's benefits, could influence employees' intention to comply.…”

“…Security compliance researchers have conducted quantitative studies to evaluate the impact of specified factors on compliance (Crossler et al 2013, Sommestad et al 2014. However, there has been a paucity of qualitative studies designed to increase understanding of how users experience security-related issues.…”