Motivating IS security compliance: Insights from Habit and Protection Motivation Theory

被引：470
作者：
Vance, Anthony [1 ]
Siponen, Mikko [2 ]
Pahnila, Seppo [2 ]
机构：
[1] Brigham Young Univ, Marriott Sch Management, Dept Informat Syst, Provo, UT 84602 USA
[2] Univ Oulu, Dept Informat Proc Sci, IS Secur Res Ctr, FIN-90014 Linnanmaa, Finland
来源：
INFORMATION & MANAGEMENT | 2012年 / 49卷 / 3-4期
关键词：
Information security policy compliance; Protection Motivation Theory; Habit theory; Information security; Scenario methodology; INFORMATION; DETERRENCE; MODEL;
D O I：
10.1016/j.im.2012.04.002
中图分类号：
TP [自动化技术、计算机技术];
学科分类号：
0812 ;
摘要：
Employees failure to comply with IS security procedures is a key concern for organizations today. A number of socio-cognitive theories have been used to explain this. However, prior studies have not examined the influence of past and automatic behavior on employee decisions to comply. This is an important omission because past behavior has been assumed to strongly affect decision-making. To address this gap, we integrated habit (a routinized form of past behavior) with Protection Motivation Theory (PMT), to explain compliance. An empirical test showed that habitual IS security compliance strongly reinforced the cognitive processes theorized by PMT, as well as employee intention for future compliance. We also found that nearly all components of PMT significantly impacted employee intention to comply with IS security policies. Together, these results highlighted the importance of addressing employees' past and automatic behavior in order to improve compliance. (C) 2012 Elsevier B.V. All rights reserved.
引用
收藏
页码：190 / 198
页数：9
相关论文
共 22 条
[1]  
[Anonymous], 40 ANN HAW INT C SYS
[2]  
Bagchi K., 2003, COMMUN ASSOC INF SYS, V12, P684
[3]  
Cenfetelli RT, 2009, MIS QUART, V33, P689
[4]  
de Guinea AO, 2009, MIS QUART, V33, P433
[5]   A PRACTICAL GUIDE TO FACTORIAL VALIDITY USING PLS-GRAPH: TUTORIAL AND ANNOTATED EXAMPLE [J].
Gefen, David ;
Straub, Detmar .
COMMUNICATIONS OF THE ASSOCIATION FOR INFORMATION SYSTEMS, 2005, 16 :91-109
[6]   Protection motivation and deterrence: a framework for security policy compliance in organisations [J].
Herath, Tejaswini ;
Rao, H. Raghav .
EUROPEAN JOURNAL OF INFORMATION SYSTEMS, 2009, 18 (02) :106-125
[7]   Applying an extended model of deterrence across cultures: An investigation of information systems misuse in the US and South Korea [J].
Hovav, Anat ;
D'Arcy, John .
INFORMATION & MANAGEMENT, 2012, 49 (02) :99-110
[8]  
Johnston AC, 2010, MIS QUART, V34, P549
[9]   Why there aren't more information security research studies [J].
Kotulic, AG ;
Clark, JG .
INFORMATION & MANAGEMENT, 2004, 41 (05) :597-607
[10]   An integrative model of computer abuse based on social control and general deterrence theories [J].
Lee, SM ;
Lee, SG ;
Yoo, S .
INFORMATION & MANAGEMENT, 2004, 41 (06) :707-718
123