Why not comply with information security? An empirical approach for the causes of non-compliance

Abstract

Purpose The purpose of this paper is to empirically investigate the negative casual relationships between organizational security factors (security systems, security education, and security visibility) and individual non-compliance causes (work impediment, security system anxiety, and non-compliance behaviors of peers), which have negative influences on compliance intention. Design/methodology/approach Based on literature review, the authors propose a research model together with hypotheses. The survey questionnaires were developed to collect data, which then validated the measurement model. The authors collected 415 responses from employees at manufacturing and service firms that had already implemented security policies. The hypothesized relationships were tested using the structural equation model approach with AMOS 18.0. Findings Survey results validate that work impediment, security system anxiety, and non-compliance peer behaviors are the causes of employee non-compliance. In addition, the authors found that security systems, security education, and security visibility decrease instances of non-compliance. Research limitations/implications Organizations should establish a mixture of security investment in their systems, education, and visibility in order to effectively reduce employees’ non-compliance. In addition, organizations should recognize the importance of minimizing the particular causes of employees’ non-compliance to positively increase intentions to comply with information security. Originality/value An important issue in information security management is employee compliance. Understanding the reasons behind employees’ non-compliance is a critical issue. This paper investigates empirically why employees do not comply, and how organizations can induce employees to comply by a mixture of investments in security systems, education, and visibility.

Published incidents and their proportions of human error

“…It is widely accepted that security incidents related to human perpetrators from internal sources are the most difficult to prevent (Hwang et al, 2017) and not an easy task (McLeod and Dolezel, 2018). A fundamental challenge in complex sociotechnical systems is that of relying upon humans to achieve reliable operations (Kyriakidis et al, 2018) and it is difficult to integrate the human factor in to a plan-do-check-act cycle of an effective Information Security Management System (ISMS) (Frangopoulos, Eloff and Venter, 2014).…”

Cognitive‐affective drivers of employees' daily compliance with information security policies: A multilevel, longitudinal study

“…1 Regarding TPB, although its core relationships have been established for ISP compliance, the conceptualisation of its normative-influence component in this context provides a basis for additional inquiry. Descriptive norms would seem particularly germane to ISP compliance given the evidence that employees establish security routines based on the activities of their co-workers (Hwang, Kim, Kim, & Kim, 2017). Yet the TPB literature (Ajzen, 1991;Ajzen & Fishbein, 2005) offers an expanded view of normative influences that includes both subjective and descriptive norms.…”

“…Accounting for both subjective and descriptive norms appears particularly germane to ISP compliance, because this behaviour is often viewed by employees as onerous (D'Arcy et al, 2014;Posey et al, 2014;Puhakainen & Siponen, 2010). Indeed, there is evidence that employees establish security routines based on the activities of their co-workers (Hwang et al, 2017). Indeed, there is evidence that employees establish security routines based on the activities of their co-workers (Hwang et al, 2017).…”

“…Yet the TPB literature (Ajzen, 1991;Ajzen & Fishbein, 2005) offers an expanded view of normative influences that includes both subjective and descriptive norms. Descriptive norms would seem particularly germane to ISP compliance given the evidence that employees establish security routines based on the activities of their co-workers (Hwang, Kim, Kim, & Kim, 2017). As has been the case with other behaviours (Rivis & Sheeran, 2003;Sheeran & Orbell, 1999), applications of TPB to ISP compliance might achieve greater explanatory power by including descriptive norms.…”

“…It follows that both the social pressure exerted by co-workers towards ISP compliance and whether co-workers themselves engage in this largely unappealing behaviour are salient drivers of compliance. Indeed, there is evidence that employees establish security routines based on the activities of their co-workers (Hwang et al, 2017). We thus adopt subjective and descriptive norms for our model.…”