A Composite Framework to Promote Information Security Policy Compliance in Organizations

Aim/Purpose: This paper examines the behavior of financial firm employees with regard to information security procedures instituted within their organization. Furthermore, the effect of information security awareness and its importance within a firm is explored. Background: The study focuses on employees’ attitude toward compliance with information security policies (ISP), combined with various norms and personal abilities. Methodology: A self-reported questionnaire was distributed among 202 employees of a large financial Corporation Contribution: As far as we know, this is the first paper to thoroughly explore employees’ awareness of information system procedures, among financial organizations in Israel, and also the first to develop operative recommendations for these organizations aimed at increasing ISP compliance behavior. The main contribution of this study is that it investigates compliance with information security practices among employees of a defined financial corporation operating under rigid regulatory governance, confidentiality and privacy of data, and stringent requirements for compliance with information security procedures. Findings: Our results indicate that employees’ attitudes, normative beliefs and personal capabilities to comply with firm’s ISP, have positive effects on the firm’s ISP compliance. Also, employees’ general awareness of IS, as well as awareness to ISP within the firm, positively affect employees’ ISP compliance. Recommendations for Practitioners: This study can help information security managers identify the motivating factors for employee behavior to maintain information security procedures, properly channel information security resources, and manage appropriate information security behavior. Recommendation for Researchers: Researchers can see that corporate rewards and sanctions have significant effects on employee security behavior, but other motivational factors also reinforce the ISP’s compliance behavior. Distinguishing between types of corporations and organizations is essential to understanding employee compliance with information security procedures. Impact on Society: This study offers another level of understanding of employee behavior with regard to information security in organizations and comprises a significant contribution to the growing knowledge in this area. The research results form an important basis for IS policymakers, culture designers, managers, and those directly responsible for IS in the organization. Future Research: Future work should sample employees from another type of corporation from other fields and should apply qualitative analysis to explore other aspects of behavioral patterns related to the subject matter.

Securing sensitive and critical information is a significant challenge for many organisations, as leaks can cause financial, reputational, and competitiveness losses. Organisations can implement an Information Security Policy (ISP) that employees must comply with to minimise this risk. However, ensuring compliance with the ISP continues to be a problem. To address this issue, a conceptual model has been proposed that organisations can use to promote ISP compliance behaviour among their employees. The Health Action Process Approach (HAPA) Model is used to derive this model. The model consists of two phases - motivational and volitional which are expected to cover the elements needed to promote behavioural change for ISP compliance. The model's multi-processes approach, covering critical aspects such as risk assessment, self-efficacy, initiation, and maintenance, enables it to serve as a platform for organisations to sustain ISP compliance over the long term. Organisations can conduct employee assessments and provide ISP compliance training and awareness campaigns to implement the model. They can also disseminate cues about information security issues and how the ISP can assist employees in handling them, discourage behaviour that leads to complacency towards ISP compliance, and update the ISP to keep it relevant. The proposed model presents an opportunity for future research to evaluate its applicability in organisational settings.

PurposeThis paper aims to establish that employees’ non-compliance with information security policy (ISP) could be addressed by nurturing ISP compliance culture through the promotion of factors such as supportive organizational culture, end-user involvement and compliance leadership to influence employees’ attitudes and behaviour intentions towards ISP in organizations. This paper also aims to develop a testable research model that might be useful for future researchers in predicting employees’ behavioural intentions.Design/methodology/approachIn view of the study’s aim, a research model to show how three key constructs can influence the attitudes and behaviours of employees towards the establishment of security policy compliance culture (ISPCC) was developed and validated in an empirical field survey.FindingsThe study found that factors such as supportive organizational culture and end-user involvement significantly influenced employees’ attitudes towards compliance with ISP. However, leadership showed the weakest influence on attitudes towards compliance. The overall results showed that employees’ attitudes and behavioural intentions towards ISP compliance together influenced the establishment of ISPCC for ISP compliance in organizations.Practical implicationsOrganizations should influence employees’ attitudes towards compliance with ISP by providing effective ISP leadership, encouraging end-user involvement during the draft and update of ISP and nurturing a culture that is conducive for ISP compliance.Originality/valueThe study provides some insights on how to effectively address the problem of non-compliance with ISP in organizations through the establishment of ISPCC, which has not been considered in any past research.

INTRODUCTION Today, in large part, information security is the implementation of controls and best practices suggested by consultants, standard governing bodies (i.e. National Institute of Standards & Technology) (NIST), International Organization for Standardization / International Electrotechnical Commission (ISO/IEC), etc.), the organization's information security department and, sometimes, the organization's employees. While the use of global standards of practice, top management and the information security department within the organization to guide information security planning and implementations may be useful, existing research consistently shows a positive relationship exists between user involvement in planning and the effectiveness of the information systems function within organizations (Gottschalk, 1999; Sambamurthy et al., 1994; Segars & Grover, 1998). A deliverable of the information security planning process is the organization's information security policies and procedures. Standard governing bodies (NIST, ISO/IEC) and researchers (Bidgoli, 2003; Garrison & Posey, 2006) stress the importance of creating information security policies and provide guidance on the different types of information security policies that an organization may need. This research attempts to examine the impact of end-user involvement and formalized information security policies on the effectiveness of the information security function within organizations. Specifically, this study focuses on two antecedent variables, collaborative exchange and formalization, and how it impacts the effective utilization of the information security strategies of deterrence, detection and recovery. Collaborative exchange is an assessment of the extent of collaboration between upper-level management, end users and the information security function. Formalization is an assessment of the extent of established formal information security policies within an organization. The purpose of this research is twofold. First, this research aims to examine the individual effects of formalization and collaborative exchange on the effectiveness of information security detection, deterrence, and recovery activities. Much of the effort expended in the management of information security is in developing and enforcing information security policies. By examining formalization separately, the impact of information security policy development on effective utilization of information security strategies can be assessed. The second aim of this research is to examine the impact of collaborative exchange and formalization in concert on the effectiveness of information security detection, deterrence, and recovery activities. Evaluating complementary effect of collaborative exchange and formalization on effective utilization of information security strategies provides evidence supporting the importance of establishing information security policies with input and effort from all major constituencies within the organization. This study makes several contributions to the literature and practice. First, this research provides insight into how management choices in regards to establishing formal communication channels and developing information security policies may impact the effectiveness of the information security function. Second, the presence of the dependent variable, effectiveness of detection, deterrence and recovery activities, gives academics and practitioners a success measure which can guide more effective decision making in the information security domain. The remainder of this manuscript is organized as follows. The next section discusses the literature supporting the constructs of interest in this study. The following two sections will present the methodological approach taken in this study and the results of data collection. The next section will present the efforts in data analysis. The last section will present a discussion of the important findings and limitations of this research. …

Information security policy compliance is one concern of organisations to improve information security, including universities. Previous research has shown that factors that influence user compliance can come from user behaviour and from within the organisation. This study aims to explore the factors of organisation and user habits that affect user compliance with information security policies. The research model proposed used organisational commitment, organisational culture, reward, and habit variables—this research conducted with a case study of public universities in Indonesia by using an online survey. The results indicated that the factors derived from organisational commitment established a positive influence on the user’s respectful behaviour. The insignificant organisational culture and reward affected information security policies. User habits also influenced user behaviour in maintaining information security.

Simulation of the role of emphasis on scheduling in the optimal incentive scheme for marine engineering employee's routine job and information security compliance

Information security has become an issue that reaches the organizations, once it puts at risk the continuity of the businesses. On the basis of literature review this research identified six constructs of information security (Integrity, Availability, Confidentiality, Equipment, Policies and Procedures and People). These constructs had been used in a survey electronic questionnaire, where one sample composed by 129 users of accounting information from various Brazilian organizations provided their perceptions regarding information security. These data allowed the realization of a gap analysis which consisted in comparing the means of assessment (how the respondent evaluates information security in your organization) and importance (how much the respondent considers information security important) attributed to each construct of information security. As a result, it was evidenced the existence of statistically significant gap s for all the six constructs of information security checked, showing that the organizations are giving less importance to the matter than expected by respondents. The People construct presented the largest gap of this research, suggesting that the organizations face difficulties to control the human component in information security, and people are not aware of the importance of their role in the effectiveness of information security in the organizations.

Deterrence and leadership factors: Which are important for information security policy compliance in the hotel industry

Social engineering is one of the most common threats to the information security of commercial firms, government and other organisations. Various technical and administrative protection mechanisms can be applied to reduce the risks associated with social engineering. This paper proposes an approach to designing measures to improve information security culture based on employee training and behavioural monitoring. Employees in the financial and IT sectors were tested using the proposed framework. Training and subsequent series of coordinated test attacks were used to simulate the actual activities of the attackers and monitor the employees’ reactions to them. From the test results, it was concluded that the employees tested had a high level of awareness of the attackers' methods and were critical of the information they received. Vulnerable employees were identified who needed additional training and improved information security related skills. In this way, potential threats to user data were identified to be serious, and staff were shown to be more convinced that they must apply the rules and adhere to the organisation's information security policy in their day-to-day practices. Subsequent sharing of experiences and collective reflection, combined with the use of incentives, did have a noticeable impact on information security compliance intentions.

Protection of data and information security are crucial to business processes and include technical, sociological and organizational aspects. The purpose of this paper is to explore the importance of information security policy and organizational compliance within a socio-technical framework. Citing come of the major compliance acts in the United States, this paper examines how the need arose for information security compliance and the antecedents that made compliance mandatory for organizations. This would apply to any organization, in whichever other country, within its legal compliance framework. A discussion follows to help shed light on how both individual employees and the organization as a whole often fail to implement a satisfactory compliance initiative. Finally, the research presents a set of key factors that influence successful implementation of information system security Compliance into the information security policy (ISP), along with what actions should be taken to make compliance a competitive advantage for the organization, taking advantage of the particular relationship between compliance and ISP.KeywordsComplianceinformation security policyISPinformation systems securityISS

Information security policy (ISP) noncompliance is a growing problem that accounts for a significant number of security breaches in organizations. Existing strategies for changing employees' behavior intentions towards compliance have not been effective. It is therefore imperative to identify other effective strategies to address the problem. This article investigates the effect accountability constructs on employees' attitudes and behavior intentions towards establishing ISP compliance as a culture. In addition, the authors validate a testable research model for predicting employees' compliance behavior intentions in a field survey involving 313 employees from selected Ghanaian companies. The overall effect showed that measures of accountability significantly influenced employees' attitudes and behavior intentions to ISP compliance while the establishment of ISP compliance culture largely depended on the existence of a conducive information security culture and positive employee behavior intentions.

Do I really belong?: Impact of employment status on information security policy compliance

According to a review of the literature, Many employees are unaware of information security policies or choose to disregard them, which can lead to non-compliance. Lack of compliance with the intended policy results from a failure to understand the complicated relationships in the design and implementation of information security rules. This paper assesses the gaps in information security policy compliance. The paper aims to assess the existence of any gaps in the compliance and awareness of employees in the company. In this study, A questionnaire method was utilized to provide an understanding of the compliance within the organization. The questions were carefully selected to cover several factors of the subject areas. The outcome of the questionnaire is important to assess any hypothetical noncompliance among employees, and to specify who is more responsible, the management or the employee. The result finds that many employees are unaware of disregarding information security policies, which can lead to security breaches. The results show that employees are often unaware of information security policies and that they may not understand the importance of compliance. The paper concludes with recommendations for improving employee awareness and compliance with information security policies.

Leaders at hotels are keen to learn how to improve staff adherence to their newly implemented information security rules in the wake of a spate of events involving the compromise of sensitive customer data. In this research, we analyze the relationship between workers' compliance intentions and their perceptions of deterrence, and the leadership styles of their bosses. Gender, education, role, tenure based on ethical leadership, and information security policy compliance intention were some of the particular leadership aspects connected to the information security policy that were evaluated in our research. The overall relevance of the standards may be calculated using the average method, which is used in decision-making. The suggested novel version of the MULTIMOORA (Multi-objective Optimization by Ratio Analysis Plus Full Multiplicative Form) approach uses a single-valued neutrosophic set to handle directly with the uncertainty of the starting point. Developing a decision-support system that takes into account the new conceptual composite framework we offer for selecting criteria, alternatives, and other aspects of leadership and information security policy in hotels is a feasible next step.

The evolving sophistication of threats and the impact of security breaches have caused managers to continually grapple with strategies to reduce these risks. One common security control is the adoption of information security policies (ISPs) geared at improving employees’ compliance behaviour. However, there is mounting empirical evidence that shows that ISP compliance is a challenging undertaking with less than satisfactory outcomes. Further, little attention is placed on developing economies in the study of this phenomenon. This research adopts a values-based methodology to determine fundamental and means objectives in maximising employees’ compliance with ISPs in a developing economy context. The research identifies 30 objectives and demonstrates that risk mitigation, people, technical and organisational factors are essential to improving compliance. The results contribute objectives, contextualised to the people for whom the results are relevant, thus promoting deeper understanding. The research offers utility to managers in the design and implementation of InfoSec strategies and policies. The findings can also inform investment decisions regarding compliance tools, methods and technologies. Recognising that security (information and cyber) threats are a global dilemma, we contend that investigating forms of security risks and potential solutions can mitigate the social and economic costs of security incidents.