A Conceptual Model for Promoting Information Security Policy Compliance Behaviour at Workplace

Aim/Purpose: This paper examines the behavior of financial firm employees with regard to information security procedures instituted within their organization. Furthermore, the effect of information security awareness and its importance within a firm is explored. Background: The study focuses on employees’ attitude toward compliance with information security policies (ISP), combined with various norms and personal abilities. Methodology: A self-reported questionnaire was distributed among 202 employees of a large financial Corporation Contribution: As far as we know, this is the first paper to thoroughly explore employees’ awareness of information system procedures, among financial organizations in Israel, and also the first to develop operative recommendations for these organizations aimed at increasing ISP compliance behavior. The main contribution of this study is that it investigates compliance with information security practices among employees of a defined financial corporation operating under rigid regulatory governance, confidentiality and privacy of data, and stringent requirements for compliance with information security procedures. Findings: Our results indicate that employees’ attitudes, normative beliefs and personal capabilities to comply with firm’s ISP, have positive effects on the firm’s ISP compliance. Also, employees’ general awareness of IS, as well as awareness to ISP within the firm, positively affect employees’ ISP compliance. Recommendations for Practitioners: This study can help information security managers identify the motivating factors for employee behavior to maintain information security procedures, properly channel information security resources, and manage appropriate information security behavior. Recommendation for Researchers: Researchers can see that corporate rewards and sanctions have significant effects on employee security behavior, but other motivational factors also reinforce the ISP’s compliance behavior. Distinguishing between types of corporations and organizations is essential to understanding employee compliance with information security procedures. Impact on Society: This study offers another level of understanding of employee behavior with regard to information security in organizations and comprises a significant contribution to the growing knowledge in this area. The research results form an important basis for IS policymakers, culture designers, managers, and those directly responsible for IS in the organization. Future Research: Future work should sample employees from another type of corporation from other fields and should apply qualitative analysis to explore other aspects of behavioral patterns related to the subject matter.

Information security policy (ISP) noncompliance continue to impede information security in organizations. This paper consolidates the strength of previous studies into an effective single solution. The paper, first, synthesizes the existing literature and groups relevant ISP compliance factors into user involvement, personality types, security awareness and training, behavioral factors, and information security culture. Secondly, a generic framework that guides the development of frameworks for ISP compliance in organizations was developed based on the literature review. The generic framework categorized elements required for developing an ISP compliance framework into structure, content and outcome elements. Thirdly, the generic framework was applied to develop a composite ISP compliance framework that proposes the establishment of ISP compliance as a culture in organizations. Finally, the results of the expert review assessment showed that the proposed composite ISP framework was suitable, structurally sound and fit for purpose.

Simulation of the role of emphasis on scheduling in the optimal incentive scheme for marine engineering employee's routine job and information security compliance

BackgroundInterventions that use the Health Action Process Approach (HAPA) model show promise for increasing PA frequency, duration, and intensity. However, there is limited understanding of how HAPA model variables have been operationalized for PA interventions in chronic disease to promote behavior change and sustained PA or whether the phase or continuous form of the HAPA model was used. The aim of this scoping review is to describe how the HAPA model variables for PA interventions were operationalized and provide details of implementation.MethodWe searched five databases to identify studies published between January 1992 and March 2024. We aimed to describe (1) the characteristics of interventions including setting, delivery mode, duration, and content; (2) which HAPA variables were operationalized and the strategies used; and (3) the physical activity measures and outcome effects.ResultsThe search identified 23 interventions in 30 papers (12 protocols, 3 quasi-experimental studies, and 15 randomized controlled trials (RCTs)). Seven of the 15 RCTs reported significant positive effects of the HAPA model on PA behavior outcomes. Interventions operationalized between three and nine HAPA constructs showed significant variability in how the HAPA model is used in intervention research. PA measures varied from self-report to validated objective instruments.ConclusionWe found a lack of clarity in decisions about which HAPA constructs were included in interventions. The wide variability in operationalized HAPA constructs made it challenging to compare interventions. Researchers should provide more detail about intervention design and implementation procedures to enhance transparency.

PurposeThis paper aims to establish that employees’ non-compliance with information security policy (ISP) could be addressed by nurturing ISP compliance culture through the promotion of factors such as supportive organizational culture, end-user involvement and compliance leadership to influence employees’ attitudes and behaviour intentions towards ISP in organizations. This paper also aims to develop a testable research model that might be useful for future researchers in predicting employees’ behavioural intentions.Design/methodology/approachIn view of the study’s aim, a research model to show how three key constructs can influence the attitudes and behaviours of employees towards the establishment of security policy compliance culture (ISPCC) was developed and validated in an empirical field survey.FindingsThe study found that factors such as supportive organizational culture and end-user involvement significantly influenced employees’ attitudes towards compliance with ISP. However, leadership showed the weakest influence on attitudes towards compliance. The overall results showed that employees’ attitudes and behavioural intentions towards ISP compliance together influenced the establishment of ISPCC for ISP compliance in organizations.Practical implicationsOrganizations should influence employees’ attitudes towards compliance with ISP by providing effective ISP leadership, encouraging end-user involvement during the draft and update of ISP and nurturing a culture that is conducive for ISP compliance.Originality/valueThe study provides some insights on how to effectively address the problem of non-compliance with ISP in organizations through the establishment of ISPCC, which has not been considered in any past research.

Deterrence and leadership factors: Which are important for information security policy compliance in the hotel industry

Information security policy compliance is one concern of organisations to improve information security, including universities. Previous research has shown that factors that influence user compliance can come from user behaviour and from within the organisation. This study aims to explore the factors of organisation and user habits that affect user compliance with information security policies. The research model proposed used organisational commitment, organisational culture, reward, and habit variables—this research conducted with a case study of public universities in Indonesia by using an online survey. The results indicated that the factors derived from organisational commitment established a positive influence on the user’s respectful behaviour. The insignificant organisational culture and reward affected information security policies. User habits also influenced user behaviour in maintaining information security.

The evolving sophistication of threats and the impact of security breaches have caused managers to continually grapple with strategies to reduce these risks. One common security control is the adoption of information security policies (ISPs) geared at improving employees’ compliance behaviour. However, there is mounting empirical evidence that shows that ISP compliance is a challenging undertaking with less than satisfactory outcomes. Further, little attention is placed on developing economies in the study of this phenomenon. This research adopts a values-based methodology to determine fundamental and means objectives in maximising employees’ compliance with ISPs in a developing economy context. The research identifies 30 objectives and demonstrates that risk mitigation, people, technical and organisational factors are essential to improving compliance. The results contribute objectives, contextualised to the people for whom the results are relevant, thus promoting deeper understanding. The research offers utility to managers in the design and implementation of InfoSec strategies and policies. The findings can also inform investment decisions regarding compliance tools, methods and technologies. Recognising that security (information and cyber) threats are a global dilemma, we contend that investigating forms of security risks and potential solutions can mitigate the social and economic costs of security incidents.

ABSTRACTThe purposes of the current study were to explore the applicability of the Health Action Process Approach (HAPA) model for interpreting changes in physical exercise behavior and to examine the key determinants of changes in physical exercise. The participants were 639 rural middle school students in Sichuan province, China, who did not perform physical exercise. Three surveys and two interventions were completed in the same participants within 1.5 years. The HAPA model elements and physical exercise were estimated by a self-reported questionnaire. The results showed that 158 students (24.7%) formed a habit of physical exercise. The structural equation model for the pre-intention stage and behavior stage showed acceptable goodness of fit. Outcome expectancies (β=0.136, P=0.014) and action self-efficacy (β=0.314, P=0.001) directly predicted intention of physical exercise, the latter directly predicted physical exerciseplanning (β=0.537, P<0.001), andplanning subsequently predicted physical exercise (β=0.324, P<0.001). Maintenance self-efficacy indirectly predicted physical exercise through planning (95%CI: 0.014, 0.053). The findings suggested that the HAPA model was a very useful tool for predicting changes in physical exercise behavior, as this model explains the process of changing physical exercise habits and reveals the weak link in such behavioral changes among Chinese rural adolescents.

Information security policy (ISP) noncompliance is a growing problem that accounts for a significant number of security breaches in organizations. Existing strategies for changing employees' behavior intentions towards compliance have not been effective. It is therefore imperative to identify other effective strategies to address the problem. This article investigates the effect accountability constructs on employees' attitudes and behavior intentions towards establishing ISP compliance as a culture. In addition, the authors validate a testable research model for predicting employees' compliance behavior intentions in a field survey involving 313 employees from selected Ghanaian companies. The overall effect showed that measures of accountability significantly influenced employees' attitudes and behavior intentions to ISP compliance while the establishment of ISP compliance culture largely depended on the existence of a conducive information security culture and positive employee behavior intentions.

Objective: To analyze the value of a multidisciplinary collaborative nutrition management system based on the Health Action Process Approach (HAPA) model in stroke patients with dysphagia. Methods: A total of 94 stroke patients with dysphagia admitted to our hospital were enrolled and divided into two groups according to admission time. The control group (n = 47, admitted between January 2024 and June 2024) received routine care, while the observation group (n = 47, admitted between January 2025 and June 2025) received a multidisciplinary collaborative nutrition management system based on the HAPA model. The intervention effects of the two groups were evaluated according to swallowing function, self-efficacy, nutritional indicators, and complications. Results: After intervention, the observation group showed significantly higher scores than the control group on both the Chinese version of the Gugging Swallowing Screen (GUSS) and the General Self-Efficacy Scale (GSES) (P P P Conclusion: The application of the HAPA model-based multidisciplinary collaborative nutritional management system for stroke patients with dysphagia can improve swallowing function, self-efficacy, and nutritional status and reduce the risk of complications.

Do I really belong?: Impact of employment status on information security policy compliance

According to a review of the literature, Many employees are unaware of information security policies or choose to disregard them, which can lead to non-compliance. Lack of compliance with the intended policy results from a failure to understand the complicated relationships in the design and implementation of information security rules. This paper assesses the gaps in information security policy compliance. The paper aims to assess the existence of any gaps in the compliance and awareness of employees in the company. In this study, A questionnaire method was utilized to provide an understanding of the compliance within the organization. The questions were carefully selected to cover several factors of the subject areas. The outcome of the questionnaire is important to assess any hypothetical noncompliance among employees, and to specify who is more responsible, the management or the employee. The result finds that many employees are unaware of disregarding information security policies, which can lead to security breaches. The results show that employees are often unaware of information security policies and that they may not understand the importance of compliance. The paper concludes with recommendations for improving employee awareness and compliance with information security policies.

Determining factors affecting daily salt intake in adults based on the health action process approach model.

Leaders at hotels are keen to learn how to improve staff adherence to their newly implemented information security rules in the wake of a spate of events involving the compromise of sensitive customer data. In this research, we analyze the relationship between workers' compliance intentions and their perceptions of deterrence, and the leadership styles of their bosses. Gender, education, role, tenure based on ethical leadership, and information security policy compliance intention were some of the particular leadership aspects connected to the information security policy that were evaluated in our research. The overall relevance of the standards may be calculated using the average method, which is used in decision-making. The suggested novel version of the MULTIMOORA (Multi-objective Optimization by Ratio Analysis Plus Full Multiplicative Form) approach uses a single-valued neutrosophic set to handle directly with the uncertainty of the starting point. Developing a decision-support system that takes into account the new conceptual composite framework we offer for selecting criteria, alternatives, and other aspects of leadership and information security policy in hotels is a feasible next step.