This study explores the role of norms in employees' compliance with an organizational information security policy (ISP). Drawing upon norm activation theory, social norms theory, and ethical climate literature, we propose a model to examine how ISP-related personal norms are developed and then activated to affect employees' ISP compliance behavior. We collected our data through Amazon Mechanical Turk for hypothesis testing. The results show that ISP-related personal norms lead to ISP compliance behavior, and the effect is strengthened by ISP-related ascription of personal responsibility. Social norms related to ISP (including injunctive and subjective norms), awareness of consequences, and ascription of personal responsibility shape personal norms. Social norms related to ISP are the product of principle ethical climate in an organization.

Information security in an organization largely depends on employee compliance with information security policy (ISP). Previous studies have mainly explored the effects of command-and-control and self-regulatory approaches on employee ISP compliance. However, how social influence at both individual and organizational levels impacts the effectiveness of these two approaches has not been adequately explored. This study proposes a social contingency model in which a rules-oriented ethical climate (employee perception of a rulesadherence environment) at the organizational level and susceptibility to interpersonal influence (employees observing common practices via peer interactions) at the individual level interact with both command-and-control and self-regulatory approaches to affect ISP compliance. Using employee survey data, we found that these two social influence factors weaken the effects of both command-and-control and self-regulatory approaches on ISP compliance. Theoretical and practical implications are also discussed.

No abstract

No abstract

No abstract