SME executives’ perceptions and the information security preparedness model

• Published in: Information and computer security Vol. 29; no. 2; pp. 263 - 282
• Main Authors: Saban, Kenneth Albert, Rau, Stephen, Wood, Charles A.
• Format: Journal Article
• Language: English
• Published: Bingley Emerald Group Publishing Limited 03.08.2021
• Subjects: Cybersecurity; Data integrity; Employee attitude; Employees; Executives; Influence; Network security; Perceptions; Security; Security management; Self-efficacy; Small & medium sized enterprises-SME; Small business; Threats; United States > US
• ISSN: 2056-4961; 2056-497X
• DOI: 10.1108/ICS-01-2020-0014

PurposeInformation security has increasingly been in the headlines as data breaches continue to occur at alarming rates. This paper aims to propose an Information Security Preparedness Model that was developed to examine how SME executives’ perceptions of security importance, implementation challenges and external influences impact their awareness and commitment to security preparedness.Design/methodology/approachFunded by the Department of Justice, a national survey of SME executives’ perceptions of information security preparedness was conducted. Using PLS-SEM, the survey responses were used to test the proposed Information Security Preparedness Model.FindingsThe results indicate that as perceptions of security importance and external influences increase, SME executives’ awareness and commitment to information security also increases. In addition, as implementation challenges increase, awareness and commitment to information security decreases. Finally, as security importance and awareness and commitment to information security increases, executives’ perception of security preparedness also increases.Research limitations/implicationsExecutive perceptions of information security were measured and not the actual level of security. Further research that examines the agreement between executive perceptions and the true state of information security within the organization is warranted.Originality/valuePrior information security studies using Roger’s (1975, 1983) Protection Motivation Theory have produced mixed results. This paper develops and tests the Information Security Preparedness Model to more fully explain SME executive’s perceptions of information security.