Information Security Compliance Research Articles

Impact of information security awareness on information security compliance of academic library staff in Türkiye

Information security compliance means that library staff follows the rules, guidelines, and principles related to information security and implements the security measures provided in the library. This ensures the protection of sensitive information stored and processed in the library environment. This study examined the impact of information security awareness in academic libraries on information security compliance. In a descriptive survey design adopted in the study, the survey data of 136 personnel working in academic libraries in Türkiye were analysed. The findings revealed that information security awareness has a positive and significant impact on information security compliance (R2 = 0.983, β = 0.991, t(136) = 19.267, p < 0.05). The study concluded that information security awareness is necessary to ensure information security compliance in academic libraries. Consequently, there is a clear need for policy and training programs to enhance information security awareness and compliance among academic library staff. The findings of this study will not only contribute to the literature in the field of information security but also provide an important foundation for improving practices in this area. Therefore, it is important for academic libraries to develop effective policies and training programs to increase awareness of information security and promote staff compliance.

Factors Influencing Information Security Policy Compliance Behavior in High Education Institutions: Systematic Literature Review

Information security policies and behaviors play a crucial role in organizations, particularly in higher education institutions. These policies outline guidelines and best practices to protect sensitive data, safeguard privacy, and prevent unauthorized access or misuse of information. In higher education institutions, they help secure research findings, intellectual property, and student records. By fostering a culture of security awareness and encouraging responsible behavior, organizations can safeguard their reputation, instill trust, and meet legal and regulatory requirements. This literature review has revealed challenges and highlighted the current trends of information security policy compliance, as well as the theories used for information security compliance from 2013 to 2023. Out of 50 research papers published on the topic of information security policy compliance, three influencing factors were identified through filtration: behavioral intention, awareness and culture, and human with organizational management. The findings show that there is a lack of information security policies in the higher education sector. This review contributes to the information security literature by providing a fully organized systematic review of conducted research in the last decade.

A field experiment on ISP training designs for enhancing employee information security compliance

ABSTRACT Information security policy (ISP) training plays an important role in enhancing organisational resilience against cyber threats by providing employees with the necessary knowledge and skills to effectively identify, prevent, and respond to security breaches. This research aims to explore how the use of deterrence arguments and threat arguments can enhance the effectiveness of ISP training. We theorise how ISP training affects employees’ ISP compliance behaviour by arguing for a transfer of training lens to study the effectiveness of ISP training. The results of our field experiment with triangulated data suggest that the effect of argumentative-enhanced ISP training is twofold. First, employees who participated in enhanced training sessions with deterrence and threat arguments demonstrated superior training outputs after the training, which, in turn, translated into a sustained training outcome three weeks after the training. Second, we also find evidence that threat arguments can reinforce the application of training outputs in the maintenance stage of learned behaviours. With this applied research study, we contribute to the research and practice by providing empirical evidence of the effectiveness of ISP training designs.

Fostering information security compliance as organizational citizenship behavior

Information security is heightened when employees develop a strong sense of information stewardship for information assets, a form of organizational citizenship behavior, suggesting that compliance should be perceived as a symbiotic relationship between organizations and employees. We conducted a field study by collecting multi-source, match-paired survey data from 487 employees paired with their supervisor's ratings. Results showed that affective commitment, job satisfaction, perceived organizational support, and social influence were positively related to compliance behavior. This research contributes to the information security literature by showing that employees with strong organizational bond are more likely to exhibit higher levels of security policy compliance.

The moderating impact of organizational culture on information security compliance

This research paper investigates the association between organizational culture and employees' compliance with information security policies. Drawing upon rational choice theory (RCT) and the competing values framework (CVF), our study explores the moderating effects of cultural dimensions on information security compliance in a diverse range of organizations. We employ a scenario-based approach and analyze the data using Partial Least Squares Structural Equation Modeling (PLS-SEM). Our findings underscore the robustness of the model and emphasize the pivotal role of cultural dimensions in influencing employees' compliance intentions.&#x0D; The study contributes by synthesizing non-fear-based deterrence theory with organizational culture theory, offering practical insights for information security managers. Recommendations include framing compliance as a moral duty, involving end-users in policy development, utilizing effective communication, implementing monitoring systems, and fostering a consistency culture. For organizations, the research underscores the importance of cultivating an ethical culture, emphasizing moral beliefs, and leveraging cultural dimensions to enhance compliance intentions.&#x0D; Acknowledging limitations related to single-country data collection, a focus on compliance intentions, and the selection of organizations with established policies, this research paves the way for future studies. Future research should aim to replicate this study in diverse cultural settings, consider individual-level culture measurement, and explore additional moderating factors. This research contributes to understanding the intricate relationship between organizational culture and information security compliance, offering actionable insights for practitioners and prospects for further exploration in the information security field.&#x0D;

Pentingnya Kepatuhan Keamanan Informasi Dalam Mengurangi Risiko Data Breach

This research aims to find out how vital information security compliance is in reducing the risk of Data Breach. The method used in this research is Library Research (Library) which is the method used in this writing, and in its use, this method uses books, and journals both in written form and online. Based on the results obtained from this research, it can be concluded that a Data Breach is an incident where sensitive data or important information becomes vulnerable or is accessed by unauthorized parties. To prevent a Data Breach, organizations need to take various security measures, policies, and practices, such as encryption, access management, physical security, network security, security training and awareness, security policies, and monitoring and auditing. Sensitive data protection helps maintain the confidentiality, integrity, and availability of data and protects the reputation and trust of customers and business partners. By implementing good sensitive data protection, organizations can reduce the risk of data breaches which can be financially detrimental and damage the company's image.

Predicting Compliance of Security Policies: Norms and Sanctions

ABSTRACT This paper is motivated by the need to find reasons for the divergent findings reported in many studies that assessed the effects of social norms on IS security policy compliance, and answers multiple calls for additional research on this subject. In doing so, this paper contributes to the existing information security literature by presenting an integrated model that draws from the General Deterrence Theory, the Social Norms, and the Normality perspective. Specifically, this study investigates the effect of formal sanctions on information security policies compliance mediated by subjective, descriptive, and moral norms. The data were collected from the employees of five organizations in the Southern United States using the survey method. Quantitative analysis of the sampled data was conducted by using PLS to assess the various hypotheses. This study shows that descriptive and moral norms mediate the relationships between formal sanctions and information security compliance. The paper highlights the influence of moral norms on how IT users respond to IS security policies.

Understanding extra-role security behaviors: An integration of self-determination theory and construal level theory

Extra-role security behaviors (ERSBs) – spontaneous security behaviors that are not prescribed in organizational security policies – are seen as a useful addition to securing informational assets in organizations. However, this exploratory study, based on findings obtained through 29 in-depth-interviews, challenges this positive perspective and shows that extra-role security behaviors cut both ways: They are either helpful or harmful. In addition, our results suggest that (1) ERSB contributes to varying degrees to the effectiveness of information security compliance, (2) the self-determination theory contributes to understanding the motivators for ERSB, and (3) the construal level theory of psychological distance explains the differential risk evaluation of ERSB. We discuss implications for researchers and practitioners – particularly in terms of promoting the beneficial nature of extra-role security behaviors – and suggest compelling avenues for future research.

Designing an incentive mechanism for information security policy compliance: An experiment

Much information security research focuses on policies firms could adopt to reduce or eliminate employees’ violation behavior. However, current information security policies are based on increasingly outmoded models of compliance behavior. This paper proposes a novel behavioral-based mechanism that offers rewards and punishments to incentivize employees to take the time to protect a company's information assets. This new mechanism is grounded in insights from externality taxes and subsidies, as well as from behavioral economics, that specific incentives operationalized as monetary rewards and punishments effectively improve information security compliance. We also consider the importance of detection in implementing our mechanism. We conduct a set of laboratory experiments to study the impact of the rewards and punishments, as well as the importance of the probability of detection.Our results show clearly that rewards alone or a combination of rewards and punishments are effective in improving information security policy compliance in both high and low-detection environments, but punishments alone are not effective in either of our environments. In addition, a company's information security compensation plan is more likely to be effective in improving compliance if the company can more reliably detect violations. Overall, our study suggests that a compensation structure based on small and predictable financial rewards and punishments is likely more effective than the current punishment-focused approach.

COVID-19 pandemic-induced organisational cultural shifts and employee information security compliance behaviour: a South African case study

PurposeThe purpose of this preliminary empirical research study is to understand how environmental disruption such as brought on by the COVID-19 pandemic induces shifts in organisational culture, information security culture and subsequently employee information security compliance behaviour.Design/methodology/approachA single-organisation case study was used to develop understanding from direct experiences of organisational life. Both quantitative and qualitative data were collected using a sequential mixed methods approach, with the qualitative phase following the quantitative to achieve complementarity and completeness in analysis. For the quantitative phase, 48 useful responses were received after a questionnaire was sent to all 150–200 employees. For the qualitative phase, eight semi-structured interviews were conducted. Statistical software was used to analyse the quantitative data and NVivo software was used to analyse the qualitative data.FindingsThe pandemic-induced environmental disruption manifested as a sudden shift to work-from-home for employees, and relatedly an increase in cybercrime. The organisational response to this gave rise to shifts in both organisational and information security culture towards greater control (rule and goal orientations) and greater flexibility (support and innovation orientations), most significantly with information security culture flexibility. The net effect was an increase in employee information security compliance.Originality/valueThe vast literature on organisational culture and information security culture was drawn on to theoretically anchor and develop parsimonious measures of information security culture. Environmental disruptions such as those caused by the pandemic are unpredictable and their effects uncertain, hence, the study provides insight into the consequences of such disruption on information security in organisations.

How Do Paternalistic Leaders Motivate Employees’ Information Security Compliance? Building a Climate and Applying Sanctions

This paper examines the underlying mechanisms through which paternalistic leadership (PL) motivates employees’ information systems policy (ISP) compliance. We propose that the three dimensions of PL—authoritarian leadership (AL), benevolent leadership (BL), and moral leadership (ML)—influence employees’ ISP compliance by affecting their perceptions of two information security control mechanisms: sanctions and the information security climate. Based on survey data from 760 participants, we found that the impact of AL is partially mediated by employees’ perceptions of sanctions, the impact of BL is partially mediated by employees’ perceptions of the information security climate, and the impact of ML is partially mediated by employees’ perceptions of both sanctions and the information security climate. Our research extends the existing literature by exploring the impact of specific leadership styles on employees’ perceptions of information security control mechanisms and by proposing that perceptions of information security control mechanisms play a mediating role between PL and ISP compliance. The findings suggest that in addition to choosing effective control mechanisms, it is also important for leaders to adjust their leadership style to ensure that employees perceive control mechanisms in the expected manner.

КОМПЛАЕНС В ОБЛАСТИ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The article is about studying the main approaches to the organization of compliance in solving the issues of ensuring information security. It analyzes the concept of compliance and its main components. Considering the system of compliance functions, the author also analyzes the categories of norms and requirements that underlie the implementation of compliance functions, as well as examples of legal and regulatory documents in the field of information security compliance. There are notes on features of the modern development of compliance in Russia in various fields. The main tasks of compliance control in the field of information security in Russian organizations are considered. Areas are identified in which the implementation of compliance functions is especially significant. The article considers that the information protection can be ensured by using compliance techniques, as well as the necessary tools used for that. The author pays special attention to the issues of compliance automation, and the analysis of the tools that can be used for that. The article discusses the advantages of automated compliance over the traditional one, as well as examples of existing developments in the field of compliance automation. The author of the article also considers the factors indicating the presence of a developed compliance system in the company, as well as the importance of those factors in ensuring the information security of organizations

A multi-theory model to evaluate new factors influencing information security compliance

Many organisations recognise that their employees, who are often considered the weakest link in information security, can also be great assets in the effort to reduce risk related to information security. This research identifies the antecedents of employee compliance with the information security policy (ISP) of an organisation. A survey among computer users of organisations in Mauritius which have established information security policy was carried out. A novel multi-theory model is derived from theory of reasoned action, cognitive evaluation theory and hanoo, and that model is presented to evaluate the data gathered through the survey. The results show that an employee's intention to comply is influenced by attitude, security awareness programs and rewards. Intention to comply in turn influences actual compliance to ISP.

An Investigation of Employees’ Intention to Comply with Information Security System—A Mixed Approach Based on Regression Analysis and fsQCA

Employee security compliance behavior has become an important safeguard to protect the security of corporate information assets. Focusing on human factors, this paper discusses how to regulate and guide employees' compliance with information security systems through effective methods. Based on protection motivation theory (PMT), a model of employees' intention to comply with the information security system was constructed. A questionnaire survey was adopted to obtain 224 valid data points, and SPSS 26.0 was applied to verify the hypotheses underlying the research model. Then, based on the results of a regression analysis, fuzzy set qualitative comparative analysis (fsQCA) was used to explore the conditional configurations that affect employees' intention to comply with the information security system from a holistic perspective. The empirical results demonstrated that perceived severity, perceived vulnerability, response efficacy, and self-efficacy all positively influenced the employees' intention to comply with the information security system; while rewards and response costs had a negative effect. Threat appraisal had a greater effect on employees' intention to comply with the information security system compared to response appraisal. The fsQCA results showed that individual antecedent conditions are not necessary to influence employees' intention to comply with an information security system. Seven pathways exist that influence an employees' intention to comply with an information security system, with reward, self-efficacy, and response cost being the core conditions having the highest probability of occurring in each configuration of pathways, and with perceived severity and self-efficacy appearing in the core conditions of configurations with an original coverage greater than 40%. Theoretically, this study discusses the influence of the elements of PMT on employees' intention to comply with an information security system, reveals the mechanism of influence of the combination of the influencing factors on the outcome variables, and identifies the core factors and auxiliary factors in the condition configurations, providing a new broader perspective for the study of information security compliance behavior and providing some theoretical support for strengthening enterprise security management. Practically, targeted suggestions are proposed based on the research results, to increase the intention of enterprise employees to comply with information security systems, thereby improving the effectiveness of enterprise information security management and the degree of information security in enterprises.

Cyber–Information Security Compliance and Violation Behaviour in Organisations: A Systematic Review

Cyber and information security (CIS) is an issue of national and international interest. Despite sophisticated security systems and extensive physical countermeasures to combat cyber-attacks, organisations are vulnerable due to the involvement of the human factor. Humans are regarded as the weakest link in cybersecurity systems as development in digital technology advances. The area of cybersecurity is an extension of the previously studied fields of information and internet security. The need to understand the underlying human behavioural factors associated with CIS policy warrants further study, mainly from theoretical perspectives. Based on these underlying theoretical perspectives, this study reviews literature focusing on CIS compliance and violations by personnel within organisations. Sixty studies from the years 2008 to 2020 were reviewed. Findings suggest that several prominent theories were used extensively and integrated with another specific theory. Protection Motivation Theory (PMT), the Theory of Planned Behaviour (TPB), and General Deterrence Theory (GDT) were identified as among the most referred-to theories in this area. The use of current theories is discussed based on their emerging importance and their suitability in future CIS studies. This review lays the foundation for future researchers by determining gaps and areas within the CIS context and encompassing employee compliance and violations within an organisation.

Information Security Culture Concept towards Information Security Compliance: A Comparison between IT and Non-IT Professionals

This paper examines the factors determining a positive Information Security Culture (ISC) concept and the influence of ISC towards ISP compliance intention (INT) between IT and non-IT professionals in Malaysian public universities. Partial least square structural equation modelling, using PLS MGA, is used to assess the measurement and structural models, and to compare the results between the two groups. Results indicate all factors have significant contribution towards ISC in both groups, with two out of seven ISC factors have significant differences. This study has revealed that although both groups have the same ISC factors, IT and non-IT professionals have significant difference in terms of believe that Top Management Commitment and Information Security Knowledge are required for implementing apositive ISC. In addition, there is a significant difference between these two groups in terms of the influence of ISC towards ISP compliance intention. ISC has less influence towards INT for Non-IT professionals compared to IT professionals within the same ISC. These empirical findings would benefit in formulating better security strategies by providing appropriate efforts for different groups of employees in the organizations. This study also provides a total cyber security solution for improving information security culture and employees’ compliance towards Information Security Policy.

Organizational and team culture as antecedents of protection motivation among IT employees

The rapid development of technology and information systems has led to higher information security-related issues in an organization. The age of remote working (i.e., telecommuting) has further increased information security related incidents that need to be adequately addressed. This paper extends the protection motivation theory by drawing insights from organizational and institutional theory literature to examine how organizational culture and subcultures such as team culture impact information security compliance. The primary objective of this study is to understand the impact of the dimensions of organizational culture and team culture on employees' perceived threats and coping motivation associated with information security compliance. The study applied structural equation modeling to analyze survey responses of 341 IT employees in the United States. The result of the study indicates that both organization and team culture impacts employees' perception to appraise threat and coping, which in turn impacts behavioral intention to comply with information security policies. The findings of this study contribute to the information security compliance research by demonstrating the importance of developing an information security culture within an organization and its subgroups.

Does nationality affect nurses’ information security participation? A comparative study in Iran and Poland

BackgroundConfidential personal data breaches are a serious problem for medical service providers. This may result in high financial costs for medical care facilities and unnecessary stress for patients. Research on information security (IS) in healthcare has been insufficient thus far. International studies may add a new perspective on this issue.Participants and procedureA quantitative approach was assumed to analyse relationships between IS climate and IS indicators in countries with different cultures (Iran and Poland). The Information Security Climate Index developed by Kessler et al. were used in the study. The PLS3 and SPSS 22 software was used for data analysis.ResultsResults showed that the predicted factors of nurses’ IS participation were different in Iran and Poland. In both countries, nurses' perception of the importance of IS had an effect on IS participation, but in Poland, IS compliance had an additional positive effect. In addition, IS compliance moderated the relationship between IS motivation and IS participation.ConclusionsComponents of IS climate have a significant effect on nurses’ IS participation in both Iran and Poland, though nationality can modify this relation. However, in both countries, by linking IS policies with human resource management activities such as performance appraisal and training, nurses’ perception of IS importance can be increased and IS participation can be facilitated.

Simulation of the role of emphasis on scheduling in the optimal incentive scheme for marine engineering employee's routine job and information security compliance

In the organizational context of marine engineering, employee individual often prefers to concentrate herself to the day-to-day routine job, but to shirk the responsibilities of the Information Security Policies (ISPs) compliance, after she has been delegated by the employer to perform the two different tasks in the same time period. This would lead to negative influences on the security of marine information systems and the employee's routine job performance. In view of the task structures of employee's routine job and marine ISPs compliance, the variables of emphasis on scheduling are incorporated into a multi-task principal-agent model to explore the optimal incentive scheme to motivate and control the employees to select appropriate effort levels for conducting the two highly structured tasks. The role of emphasis on scheduling on the incentive intensities for the two tasks have been clarified through modeling and simulation, and the corresponding incentive tactics are suggested. The new two-task incentive scheme is expected to provide useful insight for understanding and controlling marine engineering employee's routine job and ISPs compliance behavior.

Factors affecting information security compliance intention of military officer

The purpose of this study is to analyze the factors that influence the information security compliance intention of Korean military officers. For this purpose, a research model was constructed focusing on information security compliance attitude and perceived control, which are the main variables of the theory of planned behavior. In addition, security sensitivity, organization trust, information security work impediment, and sanction, were selected as independent variables. The research model was analyzed through a survey targeting Korean army officers, and the results are as follows. First, security sensitivity, organization trust, and sanctions had a significant effect on information security compliance attitude. However, the effect of information security work impediment had not been identified. Second, it was analyzed that security sensitivity and organization trust had a positive effect on perceived information security compliance control, but the effect of information security work impediment and sanction had not been verified. Third, it was confirmed that the information security compliance attitude and perceived control affect the information security compliance intention, which reconfirmed the results of previous studies. This study is meaningful in that it can improve the information security level of the military organization by suggesting a way to manage these factors.