A Composite Framework for Behavioral Compliance with Information Security Policies

TLDR

Organizations use information security policies to guide employee behavior, yet violations are frequent and costly, making users the weakest link in security. The study proposes a composite theoretical framework to explain employee compliance with organizational information security policies. Drawing on the theory of planned benefits, the authors develop a model that integrates prior research strengths, addresses theoretical gaps, and normalizes operational constructs to facilitate comparison and guide future studies.

Abstract

To combat potential security threats, organizations rely upon information security policies to guide employee actions. Unfortunately, employee violations of such policies are common and costly enough that users are often considered the weakest link in information security. This paper presents a composite theoretical framework for understanding employee behavioral compliance with organizational information security policies. Building off of the theory of planned benefits, a composite model is presented that incorporates the strengths of previous studies while minimizing theoretical gaps present in other behavioral compliance models. In building the framework, related operational constructs are examined and normalized to allow better comparison of past studies and help focus future research efforts.