Organizational information security policies: a review and research framework

No abstract is available for this paper.

• Publication year

  2017

• Venue

  European Journal of Information Systems

• Publication date

  2017-07-18

• Fields of study

  Business, Computer Science, Engineering

• Identifiers
  DOI 10.1057/s41303-017-0059-9
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• An integrative model of information security policy compliance with psychological contract: Examining a bilateral perspective

  2017cited by this paper
• Why not comply with information security? An empirical approach for the causes of non-compliance

  2017cited by this paper
• When Do IT Security Investments Matter? Accounting for the Influence of Institutional Factors in the Context of Healthcare Data Breaches

  2017cited by this paper
• Matchmaking semantic security policies in heterogeneous clouds

  2016cited by this paper
• Facilitating the Transformational: An Exploration of Control in Cyberinfrastructure Projects and the Discovery of Field Control

  2016cited by this paper
• What Drives Information Security Policy Violations among Banking Employees ? : Insights from Neutralization and Social Exchange Theory

  2016cited by this paper
• Factors influencing the intention to comply with data protection regulations in hospitals: based on gender differences in behaviour and deterrence

  2016cited by this paper
• Dispositional and situational factors: influences on information security policy violations

  2016cited by this paper
• Employees' information security policy compliance: A norm activation perspective

  2016cited by this paper
• Contextualizing the twin concepts of systematicity and transparency in information systems literature reviews

  2016cited by this paper
• Understanding information security stress: Focusing on the type of information security compliance activity

  2016cited by this paper
• Neural Correlates of Protection Motivation for Secure IT Behaviors: An fMRI Examination

  2016cited by this paper
• Control Configuration and Control Enactment in Information Systems Projects: Review and Expanded Theoretical Framework

  2016cited by this paper
• Organizational Violations of Externally Governed Privacy and Security Rules: Explaining and Predicting Selective Violations under Conditions of Strain and Excess

  2016cited by this paper
• A model of emotion and computer abuse

  2016cited by this paper
• Individuals' Internet Security Perceptions and Behaviors: Polycontextual Contrasts Between the United States and China

  2016cited by this paper
• Leveraging software-defined networking for security policy enforcement

  2016cited by this paper
• Applying the Randomized Response Technique in Business Ethics Research: The Misuse of Information Systems Resources in the Workplace

  2016cited by this paper
• Continuance of protective security behavior: A longitudinal study

  2016cited by this paper
• Information security management needs more holistic approach: A literature review

  2016cited by this paper
• Information security policy compliance model in organizations

  2016cited by this paper
• Nontechnical Deterrence Effects of Mild and Severe Internet Use Policy Reminders in Reducing Employee Internet Abuse

  2016cited by this paper
• Procedural justice to enhance compliance with non-work-related computing (NWRC) rules: Its determinants and interaction with privacy concerns

  2016cited by this paper
• Hitting a moving target: a process model of information systems control change

  2016cited by this paper
• An approach for deploying and monitoring dynamic security policies

  2016cited by this paper
• Information Systems Control: A Review and Framework for Emerging Information Systems Processes

  2016cited by this paper
• Information security policy development and implementation: The what, how and who

  2016cited by this paper
• Resistance and power in a security certification scheme: The case of c: cure

  2016cited by this paper
• The Roles of Awareness, Sanctions, and Ethics in Software Compliance

  2016cited by this paper
• Critical Times for Organizations: What Should Be Done to Curb Workers’ Noncompliance With IS Security Policy Guidelines?

  2016cited by this paper
• Privacy and Data Security: HIPAA and HITECH

  2016cited by this paper
• The Behavioral Roots of Information Systems Security: Exploring Key Factors Related to Unethical IT Use

  2015cited by this paper
• Increasing Accountability Through User-Interface Design Artifacts: A New Approach to Addressing the Problem of Access-Policy Violations

  2015cited by this paper
• Developing a Typological Theory Using a Quantitative Approach: A Case of Information Security Deviant Behavior

  2015cited by this paper
• The Influence of Employee Affective Organizational Commitment on Security Policy Attitudes and Compliance Intentions

  2015cited by this paper
• Proposing the control‐reactance compliance model (CRCM) to explain opposing motivations to comply with organisational information security policies

  2015influential reference
• Standing on the Shoulders of Giants: Challenges and Recommendations of Literature Search in Information Systems Research

  2015cited by this paper
• Analyzing the role of cognitive and cultural biases in the internalization of information security policies: Recommendations for information security awareness programs

  2015influential reference
• Seeking Middle-Range Theories in Information Systems Research

  2015cited by this paper
• Types of Employee Perceptions of Information Security Using Q Methodology: An Empirical Study

  2015cited by this paper
• The Impact of Organizational Commitment on Insiders’ Motivation to Protect Organizational Information Assets

  2015cited by this paper
• Security solution frames and security patterns for authorization in distributed, collaborative systems

  2015cited by this paper
• Synthesizing information systems knowledge: A typology of literature reviews

  2015cited by this paper
• Why Do You Control? The Concept of Control Purpose and Its Implications for IS Project Control Research

  2015cited by this paper
• An examination of factors that influence the number of information security policy violations in Qatari organizations

  2015cited by this paper
• Critical Discourse Analysis as a Review Methodology: An Empirical Example

  2015cited by this paper
• The Role of Extra-Role Behaviors and Social Controls in Information Security Policy Effectiveness

  2015cited by this paper
• The Role of Self-Control in Information Security Violations: Insights from a Cognitive Neuroscience Perspective

  2015cited by this paper
• The sufficiency of the theory of planned behavior for explaining information security policy compliance

  2015cited by this paper
• Achieving Rigor in Literature Reviews: Insights from Qualitative Data Analysis and Tool-Support

  2015cited by this paper
• Information security culture - state-of-the-art review between 2000 and 2013

  2015influential reference
• An Enhanced Fear Appeal Rhetorical Framework: Leveraging Threats to the Human Asset Through Sanctioning Rhetoric

  2015cited by this paper
• Managing the introduction of information security awareness programmes in organisations

  2015influential reference
• Writing Qualitative IS Literature Reviews - Guidelines for Synthesis, Interpretation, and Guidance of Research

  2015cited by this paper
• Leveraging fairness and reactance theories to deter reactive computer abuse following enhanced organisational information security policies: an empirical study of the influence of counterfactual reasoning and organisational trust

  2015cited by this paper
• What Do Systems Users Have to Fear? Using Fear Appeals to Engender Threats and Fear that Motivate Protective Security Behaviors

  2015cited by this paper
• Theoretical perspectives in IS research: from variance and process to conceptual latitude and conceptual fit

  2015cited by this paper
• What Drives Information Security Policy Violations among Banking Employees?: Insights from Neutralization and Social Exchange Theory

  2015cited by this paper
• The impacts of organizational culture on information security culture: a case study

  2015cited by this paper
• The deep structure of organizational online networking – an actor‐oriented case study

  2015cited by this paper
• Personality, attitudes, and intentions: Predicting initial adoption of information security behavior

  2015cited by this paper
• Impacts of Comprehensive Information Security Programs on Information Security Culture

  2015cited by this paper
• Information security awareness and behavior: a theory-based literature review

  2014influential reference
• Understanding Compliance with Bring Your Own Device Policies Utilizing Protection Motivation Theory: Bridging the Intention-Behavior Gap

  2014cited by this paper
• A Path to Successful Management of Employee Security Compliance: An Empirical Study of Information Security Climate

  2014cited by this paper
• Employees' adherence to information security policies: An exploratory field study

  2014cited by this paper
• Using Measures of Risk Perception to Predict Information Security Behavior: Insights from Electroencephalography (EEG)

  2014cited by this paper
• Security services as coping mechanisms: an investigation into user intention to adopt an email authentication service

  2014cited by this paper
• Security culture and the employment relationship as drivers of employees' security compliance

  2014cited by this paper
• Variables influencing information security policy compliance: A systematic review of quantitative studies

  2014influential reference
• What literature review is not: diversity, boundaries and recommendations

  2014cited by this paper
• We Don't Replicate Accounting Research—Or Do We?†

  2014cited by this paper
• Guidelines for improving the contextual relevance of field surveys: the case of information security policy violations

  2014influential reference
• Useful Products in Theorizing for Information Systems

  2014cited by this paper
• An emote opportunity model of computer abuse

  2014cited by this paper
• Exploring the effects of organizational justice, personal ethics and sanction on internet use policy compliance

  2014cited by this paper
• Information systems security policy compliance: An empirical study of the effects of socialisation, influence, and cognition

  2014cited by this paper
• Understanding Employee Responses to Stressful Information Security Requirements: A Coping Perspective

  2014cited by this paper
• The trouble with European data protection law

  2014cited by this paper
• Using Accountability to Reduce Access Policy Violations in Information Systems

  2013influential reference
• Employees' Information Security Awareness and Behavior: A Literature Review

  2013cited by this paper
• CPM: Masking Code Pointers to Prevent Code Injection Attacks

  2013cited by this paper
• Understanding the violation of IS security policy in organizations: An integrated model based on social control and deterrence theory

  2013cited by this paper
• Research with In-built replications: Comment and further suggestions for replication research

  2013cited by this paper
• Future directions for behavioral information security research

  2013cited by this paper
• A formal role-based access control model for security policies in multi-domain mobile networks

  2013cited by this paper
• Don't make excuses! Discouraging neutralization to reduce IT policy violation

  2013cited by this paper
• Security-related behavior in using information systems in the workplace: A review and synthesis

  2013influential reference
• Is Your Banker Leaking Your Personal Information? The Roles of Ethics and Individual-Level Cultural Characteristics in Predicting Organizational Computer Abuse

  2013cited by this paper
• Formal specification and management of security policies with collective group obligations

  2013cited by this paper
• The Internet is Not a Super Highway: Using Metaphors to Communicate Information and Communications Policy

  2013cited by this paper
• Engaging Remote Employees: The Moderating Role of "Remote" Status in Determining Employee Information Security Policy Awareness

  2013cited by this paper
• Ensuring Employees' IT Compliance: Carrot or Stick?

  2013cited by this paper
• Work System Theory: Overview of Core Concepts, Extensions, and Challenges for the Future

  2013cited by this paper
• Control-Related Motivations and Information Security Policy Compliance: The Role of Autonomy and Efficacy

  2013cited by this paper
• Control Balancing in Information Systems Development Offshoring Projects

  2013cited by this paper
• Beyond Deterrence: An Expanded View of Employee Computer Abuse

  2013cited by this paper
• Insiders' Protection of Organizational Information Assets: Development of a Systematics-Based Taxonomy and Theory of Diversity for Protection-Motivated Behaviors

  2013cited by this paper
• Standing on the Shoulders of Giants: How Do We Combine the Insights of Multiple Theories in Public Policy Studies?

  2013cited by this paper
• Corrective Enforcement: A New Paradigm of Security Policy Enforcement by Monitors

  2012cited by this paper

• Manager information security-related stress and organizational information security performance

  2026cites this paper
• Security fatigue: manifestation of emotional exhaustion and cynicism by depletion of self-regulation capacity

  2026cites this paper
• When words lose their edge: a comparative analysis of information security policy keywords in the UK and Sweden

  2026cites this paper
• Non-technical determinants of information security policy compliance: An integrated PMT-TPB model with psychological ownership, trust, and social influence

  2026cites this paper
• Coping with Input Stage Challenges in Information Security Policy Development: Information Security Managers’ Perspectives in a Hybrid Work Environment

  2026cites this paper
• Technology discontinuance: a systematic literature review and research agenda

  2025influential citation
• Nexus Between Organizational Security Culture and Supply Chain Disruption Occurrence: Mediating Role of Security Compliance

  2025cites this paper
• Unraveling the psychological links between organizational security climate and extra-role security behaviors

  2025cites this paper
• The role of information technologies in modern corporate security

  2025cites this paper
• Towards software for tailoring information security policies to organisations' different target groups

  2025cites this paper
• Barking Up the Wrong Tree? Reconsidering Policy Compliance as a Dependent Variable Within Behavioral Cybersecurity Research

  2025cites this paper
• Empowering health, integrating privacy: a value-reflexive examination of smart health technologies

  2025cites this paper
• Structural power in local tourism governance: balancing growth and culture in Central Java, Indonesia

  2025cites this paper
• Questioning a security assumption: Are unique passwords harder to remember than reused or modified passwords?

  2025cites this paper
• Clashing Climates: How (In)Congruence Between Information Security Climate and Other Organizational Climates Affects Security Policy Compliance

  2025cites this paper
• The association between the multidimensional evaluation of attitudes toward security recommendations and the intention of following those recommendations.

  2025cites this paper
• Integrating Information Security Culture and Protection Motivation to Enhance Compliance with Information Security Policies in Banking: Evidence from PLS-SEM and fsQCA

  2025cites this paper
• Implementing security governance for remote work: challenges and best practices

  2025cites this paper
• Avoiding virtual dystopia: A design theory for emancipatory participatory immersive platforms

  2025cites this paper
• Conceptual inconsistencies in variable definitions and measurement items within ISP non-/compliance research: A systematic literature review

  2025cites this paper
• Intelligent intrusion detection for IoT and cyber-physical systems using machine learning

  2025cites this paper
• Enhancing information security management and performance through social and relational factors: a structural equation modelling approach

  2025cites this paper
• Examining business students’ intentions to misuse ChatGPT through the lens of deterrence and neutralisation theories

  2025cites this paper
• Developing and testing a framework for matching distinct personality types with information security awareness methods

  2025cites this paper
• Addressing organisational, individual and technological aspects and challenges in information security management: applying a framework in workplace and teleworking

  2025cites this paper
• From usable design characteristics to usable information security policies: a reconceptualisation

  2025cites this paper
• Research on abnormal access control of database management system under cloud computing platform

  2024cites this paper
• From cyber benign to cyber malicious: unveiling the evolution of insider cyber maliciousness from a stage theory perspective

  2024cites this paper
• Incorrect compliance and correct noncompliance with information security policies: A framework of rule-related information security behaviour

  2024cites this paper
• Research on Influencing Factors of Enterprise Information Security Strategy Compliance

  2024cites this paper
• Synthesizing Information Security Policy Compliance And Non-compliance: A Comprehensive Study And Unified Framework

  2024cites this paper
• Information Security Research in the Information Systems Discipline: A Thematic Review and Future Research Directions

  2024influential citation
• Validating and extending the unified model of information security policy compliance

  2024cites this paper
• Defining Actionable Advice in Information Security Policies - Guiding Employees to Strengthen Digital Sovereignty of Organizations

  2024cites this paper
• The institutionalization of digital compliance

  2024cites this paper
• Examining the effects of cognitive load on information systems security policy compliance

  2024cites this paper
• Reducing fraud in organizations through information security policy compliance: An information security controls perspective

  2024cites this paper
• The Influences of Employees' Emotions on Their Cyber Security Protection Motivation Behaviour: A Theoretical Framework

  2024cites this paper
• A field experiment on ISP training designs for enhancing employee information security compliance

  2024cites this paper
• Qualitative content analysis of actionable advice in information security policies - introducing the keyword loss of specificity metric

  2024cites this paper
• What goes around comes around: an in-depth analysis of how respondents interpret ISP non-/compliance questionnaire items

  2024cites this paper
• Information Security Investments: How to Prioritize?

  2024cites this paper
• Physical security culture: The neglected foundation for effective security

  2024cites this paper
• "What Keeps People Secure is That They Met The Security Team": Deconstructing Drivers And Goals of Organizational Security Awareness

  2024cites this paper
• The moderating impact of organizational culture on information security compliance

  2024cites this paper
• Recent insights in information security awareness training: A systematic literature review

  2024cites this paper
• IT Risk Management: Towards a System for Enhancing Objectivity in Asset Valuation That Engenders a Security Culture

  2024cites this paper
• A Comprehensive Taxonomy of Social Engineering Attacks and Defense Mechanisms: Toward Effective Mitigation Strategies

  2024cites this paper
• Psychological Capital and Information Security Policy Compliance

  2024cites this paper
• Fostering information security compliance as organizational citizenship behavior

  2024cites this paper
• Designing an incentive mechanism for information security policy compliance: An experiment

  2023cites this paper
• Security by envelopment – a novel approach to data-security-oriented configuration of lightweight-automation systems

  2023cites this paper
• Understanding extra-role security behaviors: An integration of self-determination theory and construal level theory

  2023cites this paper
• Examining the Differential Effectiveness of Fear Appeals in Information Security Management Using Two-Stage Meta-Analysis

  2023cites this paper
• Employees’ BYOD Security Policy Compliance in the Public Sector

  2023cites this paper
• Personal and Contextual Predictors of Information Security Policy Compliance: Evidence from a Low-Fidelity Simulation

  2023cites this paper
• What are the trend and core knowledge of information security? A citation and co-citation analysis

  2023cites this paper
• Addressing Organisational, Individual and Technological Aspects and Challenges in Information Security Management: Applying a Framework for a Case Study

  2023cites this paper
• ‘What a waste of time’: An examination of cybersecurity legitimacy

  2023cites this paper
• Managing compliance with privacy regulations through translation guardrails: A health information exchange case study

  2023cites this paper
• Identifying the idiosyncrasies of behavioral information security discourse and proposing future research directions: A Foucauldian perspective

  2023cites this paper
• Barking Up the Wrong Tree? Reconsidering Policy Compliance as a Dependent Variable within Behavioral Cybersecurity Research

  2023cites this paper
• Information security ignorance: An exploration of the concept and its antecedents

  2023cites this paper
• COVID-19 pandemic-induced organisational cultural shifts and employee information security compliance behaviour: a South African case study

  2023cites this paper
• A Framework for Analyzing and Improving ISP Compliance

  2023cites this paper
• Understanding employees' responses to information security management practices: a person-environment fit perspective

  2023cites this paper
• Evaluating compliance for organizational information security and business continuity: three strata of ventriloqual agency

  2023cites this paper
• How memory anxiety can influence password security behavior

  2023cites this paper
• The role of ethical climates in employee information security policy violations

  2023cites this paper
• Balancing software and training requirements for information security

  2023cites this paper
• IoT and Blockchain: A Review and a Technical-Legal-Social Acceptance Model

  2023cites this paper
• Creation and Analysis of a Natural Language Understanding Dataset for DoD Cybersecurity Policies (CSIAC-DoDIN V1.0)

  2023cites this paper
• Employees' in-role and extra-role information security behaviors from the P-E fit perspective

  2023cites this paper
• Sustainable data governance in the era of global data security challenges in Nigeria: A narrative review

  2023cites this paper
• Reflecting on the Use of the Policy-Process-Product Theory in Empirical Software Engineering

  2023cites this paper
• General data protection regulation: a study on attitude and emotional empowerment

  2023cites this paper
• The Impact of Challenge Information Security Stress on Information Security Policy Compliance: The Mediating Roles of Emotions

  2022cites this paper
• Cultivating proactive information security behavior and individual creativity: The role of human relations culture and IT use governance

  2022cites this paper
• The Impact of Challenge Information Security Stress on Information Security Policy Compliance: The Mediating Roles of Emotions

  2022cites this paper
• The Push and Pull of Cybersecurity Adoption: A Positional Paper

  2022cites this paper
• Old Keys May Not Open New Doors: The Necessity of Agility in Cybersecurity Policymaking

  2022cites this paper
• The African Journal of Information Systems The African Journal of Information Systems

  2022influential citation
• The influence of familiarity with Information Technology on the effects of deterrence

  2022cites this paper
• Mechanisms fostering the sustainability of actualized value propositions of implemented e‐Government projects in Sub‐Saharan Africa: A realist evaluation case of Nigeria and Rwanda

  2022cites this paper
• An Information Security Policy Development Process in Higher Education Institution: A Case Study Approach

  2022cites this paper
• Phantom or Menace: User Behaviors in Cybersecurity

  2022influential citation
• Factors Influencing Employees’ Information Security Awareness in the Telework Environment

  2022cites this paper
• Development of methods for identifying an appropriate benchmarking peer to establish information security policy

  2022cites this paper
• Cyber–Information Security Compliance and Violation Behaviour in Organisations: A Systematic Review

  2022cites this paper
• IT assimilation: construct, measurement, and implications in cybersecurity

  2022cites this paper
• Employees' Compliance with ISP: A Socio-Technical Conceptual Model

  2022cites this paper
• An extended digital forensic readiness and maturity model

  2022cites this paper
• The cybersecurity behavioral research: A tertiary study

  2022cites this paper
• Continuous improvement of information security management: an organisational learning perspective

  2022cites this paper
• The influence of inputs in the information security policy development: an institutional perspective

  2022cites this paper
• Employees' intentions toward complying with information security controls in Saudi Arabia's public organisations

  2022cites this paper
• Going Beyond Deterrence: A Middle-Range Theory of Motives and Controls for Insider Computer Abuse

  2022cites this paper
• Understanding employee's emotional reactions to ISSP compliance: focus on frustration from security requirements

  2022cites this paper
• Software Compliance Requirements, Factors, and Policies: a Systematic Literature Review

  2022cites this paper
• Voluntary and Instrumental Information Security Policy Compliance: An Integrated View of Prosocial Motivation, Self-Regulation and Deterrence

  2021cites this paper