Measuring employees’ compliance – the importance of value pluralism

Abstract

Purpose This paper aims to investigate two different types of compliance measures: the first measure is a value-monistic compliance measure, whereas the second is a value-pluralistic measure, which introduces the idea of competing organisational imperatives. Design/methodology/approach A survey was developed using two sets of items to measure compliance. The survey was sent to 600 white-collar workers and analysed through ordinary least squares. Findings The results suggest that when using the value-monistic measure, employees’ compliance was a function of employees’ intentions to comply, their self-efficacy and awareness of information security policies. In addition, compliance was not related to the occurrence of conflicts between information security and other organisational imperatives. However, when the dependent variable was changed to a value-pluralistic measure, the results suggest that employees’ compliance was, to a great extent, a function of the occurrence of conflicts between information security and other organisational imperatives, indirect conflicts with other organisational values. Research limitations/implications The results are based on small survey; yet, the findings are interesting and justify further investigation. The results suggest that relevant organisational imperatives and value systems, along with information security values, should be included in measures for employees’ compliance with information security policies. Practical implications Practitioners and researchers should be aware that there is a difference in measuring employees’ compliance using value monistic and value pluralism measurements. Originality/value Few studies exist that critically compare the two different compliance measures for the same population.

You’ve Left Me No Choices: Security Economics to Inform Behaviour Intervention Support in Organizations

“…Security behaviour provisions tend to imply that the decision-maker has resources available to complete training and policies, but in an organization the decision-maker is busy with their paid job. To avoid 'decision fatigue' and the 'hassle factor' [8] of complying with security, we must consider the endowment effect -as also applies to security [35] -and acknowledge that for the busy decision-maker, doing security requires a loss to something else. This requires an institutional view to helping the decision-maker to negotiate where that cost will be borne from.…”

“…A 'security diet' would document perceived occurrence and costs of advocated behaviours (for instance through a typical working day). Questions can then be asked to reconcile these costs with expected behaviour elsewhere in the organization [35], to determine if time for security tasks is being taken from elsewhere.…”

An activity theory approach to information security non-compliance

“…However, policies that do not consider irregular work situations are also likely to motivate employees to engage in non-compliance behaviors. According to Karisson et al (2017), respondents who perceived conflicts between information security and other organizational values in their work were less likely to comply with ISP in the context of such conflicts. For example, when out of their offices, employees may decide to share their passwords with their colleagues if they feel that doing so is the only way to accomplish a particular task (e.g.…”

“…Non-compliant behaviors are considered to be undesirable from an organizational standpoint (Bulgurcu et al , 2010; Myyry et al , 2009), and past research has recommended that sanctions need to be applied to deter them (Aurigemma and Mattson, 2017; D’Arcy and Herath, 2011; D’Arcy et al , 2009). Still, many employees tend to continue to engage in non-compliant behaviors (Vance et al , 2012), and often they do so to accomplish their tasks more efficiently (Karisson et al , 2017). For example, copying confidential data on an insecure USB can enable an employee to work extra hours from home (which is likely to benefit both the employee and the organization).…”

Design and manufacture of umanned aerial vehicles (UAV) wing structure using composite materials

“…Vacuum bagging use atmospheric pressure to hold laminate layers together. By this method it is possible to manufacture composites with high fiber content which translate into higher strength to weight ratios . In order to create structure based on given geometry necessary is, to make mold with exact shape, Figure .…”