Title
Employees' Adherence to Information Security Policies: An Exploratory Field Study,
Publication Date
8-15-2013
Document Type
Article
Abstract
The key threat to information security comes from employees who do not comply with information security policies. We developed a new multi-theory based model that explained employees’ adherence to security policies. The paradigm combines elements from the Protection Motivation Theory, the Theory of Reasoned Action, and the Cognitive Evaluation Theory. We validated the model by using a sample of 669 responses from four corporations in Finland. The SEM-based results showed that perceived severity of potential information security threats, employees’ belief as to whether they can apply and adhere to information security policies, perceived vulnerability to potential security threats, employees’ attitude toward complying with information security policies, and social norms toward complying with these policies had a significant and positive effect on the employees’ intention to comply with information security policies. Intention to comply with information security policies also had a significant impact on actual compliance with these policies. High level managers must warn employees of the importance of information security and why it is necessary to carry out these policies. In addition, employees should be provided with security education and hands on training.
Comments
Information & Management Volume 51, Issue 2, March 2014, Pages 217-224 Received 21 August 2009, Revised 19 March 2013, Accepted 15 August 2013, Available online 21 December 2013. https://doi.org/10.1016/j.im.2013.08.006