Understanding Compliance with Bring Your Own Device Policies Utilizing Protection Motivation Theory: Bridging the Intention-Behavior Gap

Abstract

The purpose of this study is to examine the factors that determine whether employees follow Bring Your Own Device (BYOD) policies through the lens of the Protection Motivation Theory. BYOD is rapidly becoming the norm rather than the exception. As a result, firms are establishing BYOD policies to address the risk inherent in allowing individuals to use their own devices to access or store company data. This paper reports the results of a survey of accounting students, non-accounting students, and full-time employees. Results demonstrate that participants' intentions to comply with a BYOD policy were primarily motivated by Self Efficacy and Response Efficacy. Further, Threat Severity was more salient for accountants than non-accountants, perhaps due to their sensitivity to confidential data. Finally, when actual compliance behavior was considered, costs to comply were much more salient to employees and could be strong deterrents to full compliance. These findings have important theoretical and practical implications.

So Much Promise, So Little Use: What is Stopping Home End-Users from Using Password Manager Applications?

“…This is primarily due to decades of research that has empirically demonstrated that there is generally a fairly strong correlation between behavioral intentions and actual behaviors across a variety of actions [1,3,22]. However, more recent studies have started to evaluate both security intent and actual behaviors [15,44,7], but none have specifically explored factors that inhibit or support the transition from intent to actual behavior.…”

Bring Your Own Device: An overview of risk assessment

“…The best defence in response to litigation arising from a data breach is to demonstrate that the company actively attempted to mitigate threats inherent in its business model [23]. It is, therefore, important for organizations to understand the different BYOD technical solutions and their limitations before adopting BYOD.…”

Factors driving employee participation in corporate BYOD programs: A cross-national comparison from the perspective of future employees

“…Recently, literature has begun to examine various aspects of BYOD usage. Some studies focus on employees' compliance to information security policies when using BYOD (Alaskar and Shen, 2016;Crossler et al, 2014;Hovav and Putri, 2016). Crossler et al (2014) found that self-efficacy, response efficacy, threat severity and cost to comply can influence individuals' motivation to comply with a BYOD policy.…”

“…These initiatives enable employees to choose and use devices selected on their own. Usually these programs comprise definitions of the technical requirements privately owned devices have to meet and policies with respect to BYOD usage, security, and liability which employees have to accept (Crossler et al 2014;Harris 2012;Vogel et al 2010). For example, employees typically must permit their employer to remove all data from BYOD devices ("wipe out") if the item is lost or the employee resigns ).…”