Understanding Employee Information Security Policy Compliance from Role Theory Perspective

Abstract

Previous research indicated security-related stress at the workplace accounts for employee non-compliant behavior with information security policy (ISP). Drawing on the role theory, we investigate stress rooted in employee job role expectations arising from role-ambiguity, role-conflict, and role-overload known as role-stressors. These role-stressors cause employees to endeavor to perform their role tasks and, in turn, provide favorable situations for them to neglect ISP requirements. Using a survey of 350 employees, we found a combination of role-stressors contributes to employees’ ISP violations. Furthermore, we posit that this relationship is partially mediated by organizational commitment. Also, we examined the effect of one mitigating factor: organizational support. However, a statistically significant mitigation effect of organizational support was not found on the relationship between role stress and intention toward ISP compliant behavior. This paper contributes to the behavioral information security literature by demonstrating the importance of role-stressors on employees’ security-related behaviors.