Personal and Contextual Predictors of Information Security Policy Compliance: Evidence from a Low-Fidelity Simulation - Brooks, Ricardo R.; Williams, Kevin J.; Lee, So-Yun (Journal of business and psychology, 2024)
The objective of this study was to examine the roles that organizational security climate and perceived costs and rewards of compliance play in predicting the extent to which people endorse compliance or violation of specific information security policies (ISP). A low-fidelity simulation placed participants in either a strong or weak information security climate and presented them with four cybersecurity scenarios that assessed their judgments of complying with or violating security policies in those situations. Results indicated that information security climate relates to intent to comply with a company’s security policies via attitudes, subjective norms, and perceived behavioral control, in line with the predictions of the theory of planned behavior (Ajzen, 1991). Strong intentions to comply with policies, in turn, were associated with greater endorsement of compliant behaviors and decreased endorsement of policy violations in the specific scenarios. However, whether or not individuals chose to endorse compliance with or violation of specific policies, after initial intentions were formed, was also influenced by their perceived costs and rewards of compliance. The effects of costs were particularly strong: as perceived costs increased, participants were more likely to endorse ISP violations. Our findings suggest that establishing a strong information security climate may reduce the chances of security breaches, but that organizations should also intervene to reduce the perceived burden and inconvenience of security tasks.