Peers matter: The moderating role of social influence on information security policy compliance

TLDR

Information security in organizations largely depends on employee compliance with information security policy, yet prior research has focused on command‑and‑control and self‑regulatory approaches while overlooking how social influence at individual and organizational levels affects their effectiveness. This study proposes a social contingency model to examine how an organizational rules‑oriented ethical climate and individual susceptibility to peer influence interact with command‑and‑control and self‑regulatory approaches to shape information security policy compliance. The model posits that a rules‑oriented ethical climate and interpersonal influence susceptibility jointly moderate the impact of command‑and‑control and self‑regulatory strategies on employee compliance. Survey data reveal that both social influence factors weaken the effects of command‑and‑control and self‑regulatory approaches on compliance, underscoring the need to account for social dynamics in policy design.

Abstract

Abstract Information security in an organization largely depends on employee compliance with information security policy (ISP). Previous studies have mainly explored the effects of command‐and‐control and self‐regulatory approaches on employee ISP compliance. However, how social influence at both individual and organizational levels impacts the effectiveness of these two approaches has not been adequately explored. This study proposes a social contingency model in which a rules‐oriented ethical climate (employee perception of a rules‐adherence environment) at the organizational level and susceptibility to interpersonal influence (employees observing common practices via peer interactions) at the individual level interact with both command‐and‐control and self‐regulatory approaches to affect ISP compliance. Using employee survey data, we found that these two social influence factors weaken the effects of both command‐and‐control and self‐regulatory approaches on ISP compliance. Theoretical and practical implications are also discussed.