Information security policies are formalized employee guidelines for the use of IT. Organizations rely on these policies as employees account for a large percentage of security incidents. Current literature lacks consensus regarding key drivers of policy compliance and is uncertain as to how they perform under different conditions. This study aims to holistically investigate the findings of prior research in order to clarify what is important for security policy compliance.
Cram et al. conducted an analysis of 95 research papers, classifying them into 17 distinct categories. They then determined which of the categories were most strongly predictive of security policy compliance. Conference papers, dissertations and unpublished papers were all included in the studies collection. Four factors explaining inconsistencies within the literature were identified:
1) studies measuring compliance vs others measuring policy violation, which are not necessarily opposites
2) studies measuring actual compliance vs others measuring intended compliance
3) studies concerned with general security policies vs others concerned with specific policies (e.g. antivirus software and data backups)
4) the location and national culture of the participants
Three of the top five strongest categories in explaining policy compliance are all oriented around employee values: attitude, personal norms and ethics, normative beliefs. In comparison, the categories that are generally seen as being more easily manipulated by management, such as punishment and rewards, are among the weakest in predicting security policy compliance. Activities related to perceptions of security policy usefulness and training present a mid-range importance in predicting policy compliance. The analysis of factors of inconsistency in current literature revealed that:
This study presents practical insights for the management of security policy. For instance, managers may benefit in hiring employees with attitudes and beliefs consistent with organizational objectives, rather than focusing on punishment and rewards. Convincing employees of the value of policies is especially important, for example by sharing anecdotal evidence of how they have mitigated security incidents in the past. Managers can also assign a security champion to each project team to provide accessible training and increase team security effectiveness.
Security policy compliance is motivated more by employee values than punishement and rewards.
Financé par : 
Hébergé par : 
© 2019 SERENE-RISC, Tous droits réservés. Conditions d'utilisation