Organizational information security policies: a review and research framework

Abstract

A major stream of research within the field of information systems security examines the use of organizational policies that specify how users of information and technology resources should behave in order to prevent, detect, and respond to security incidents. However, this growing (and at times, conflicting) body of research has made it challenging for researchers and practitioners to comprehend the current state of knowledge on the formation, implementation, and effectiveness of security policies in organizations. Accordingly, the purpose of this paper is to synthesize what we know and what remains to be learned about organizational information security policies, with an eye toward a holistic understanding of this research stream and the identification of promising paths for future study. We review 114 influential security policy-related journal articles and identify five core relationships examined in the literature. Based on these relationships, we outline a research framework that synthesizes the construct linkages within the current literature. Building on our analysis of these results, we identify a series of gaps and draw on additional theoretical perspectives to propose a revised framework that can be used as a basis for future research.

Appendices

Appendix A: Security policy research literature reviews

The following is not an exhaustive list of IS security research literature reviews, as there are additional reviews that are only tangentially related to security policy research and/or appear in lower-tier journals and conference proceedings.

Article	Coverage	Description/key findings	How our review differs in scope*
Crossler et al (2013)	Overview of behavioral IS security literature; not a systematic review paper	Using the extant literature as a base, proposed the following topics for future behavioral IS security research: separating insider deviant behavior from insider misbehavior; unmasking the mystery of the hacker world; improving information security compliance; cross-cultural information security research	We review the broader body of security policy literature
D’Arcy and Herath (2011)	17 empirical studies in the IS literature that used deterrence (sanction) constructs, published through 2010 (approximately); specific time period not provided	Reviewed empirical studies that used deterrence theory in the IS literature; in an attempt to explain the contradictory findings in this literature, identified contingency variables, and methodological and theoretical issues specific to the application of deterrence theory in the IS context	We review the broader body of security policy literature
Dhillon and Backhouse (2001)	IS security literature through 2000 (approximately); specific number of articles and time period not provided	Classified IS security literature into Burrell and Morgan’s sociological paradigms (functionalist, interpretive, radical humanist, radical structuralist); one of the earliest papers to identify the preponderance of purely technical IS security research and called for a socioorganizational perspective	We review the more specific body of security policy literature
Guo (2013)	Not a systematic review paper; literature on employees’ security-related behavior; specific number of articles and time period not provided	Provided a classification/taxonomy of employees’ security-related behavior, based on the extant literature	We review the broader body of security policy literature
Karlsson et al (2015)	72 information security culture research articles published between 2000 and 2013	Classified the papers in terms of theories, research methods, and research topics	We review the security policy literature, which is distinct from security culture research
Lebek et al (2013); Lebek et al (2014)	113 articles on employees’ information security awareness and behavior published between 2000 and mid 2012 (both the 2013 and 2014 publications cover the same scope)	Classified 54 different theories used in behavioral IS security studies; based on the results, provided a taxonomy of antecedents of information security behavior	We review the broader body of security policy literature
Padayachee (2012)	Not a systematic review paper; overview of selected literature on employees’ security policy compliance; specific number of articles and time period not provided	Provided a taxonomy of factors that influence employees’ security policy compliance, which was derived from the literature and grounded in self-determination theory	We review the broader body of security policy literature
Siponen and Oinas-Kukkonen (2007)	IS security literature through 2000; specific number of articles not provided	Classified the papers based on research approaches, reference disciplines, and security issues (access to information systems, secure communication, security management, secure information systems development)	We review the more specific body of security policy literature
Siponen & Vance (2014)	19 empirical, survey studies of employees’ security policy compliance, published between 1990 and 2011	Provided methodological guidelines for survey studies of security policy compliance behavior in organizations; the guidelines were applied to the reviewed articles, and no study met more than three of the five proposed guidelines.	We review the broader body of security policy literature
Siponen et al (2008)	1280 IS security research articles published between 1990 and 2004	Classified the papers in terms of theories, research methods, and research topics	We review the more specific body of security policy literature
Sommestad et al (2014)	29 empirical studies of employees’ security policy compliance published through 2012 (approximately); specific time period not provided	Meta-analyzed the literature on employees’ security policy compliance; showed the relative strength of the various predictor variables used in the literature (60 total predictor variables)	We review the broader body of security policy literature
Soomro et al (2016)	67 articles on management role in information security published between 2004 and September 2014	Classified the papers into the following categories: information security and management; information security policy awareness and training; integration of technical and managerial activities for information security management; human aspects of information security management; information security as a business issue	We review the more specific body of security policy literature
Wall et al (2015)	24 empirical studies of employees’ security-related behavior published between 2002 and 2012	Evaluated the philosophical underpinnings (using critical review methods) of empirical studies of employees’ security-related behavior	We review the broader body of security policy literature
Willison and Warkentin (2013)	Overview of selected IS and general literature on neutralization, deterrence and expressive motivations, and organizational justice; specific number of articles and time period not provided; not a systematic review paper	Proposed the following topics for future empirical investigations of employee computer abuse: techniques of neutralization (rationalizations), expressive/instrumental criminal motivations, disgruntlement as a result of perceptions of organizational justice	We review the broader body of security policy literature
Zafar & Clark (2009)	137 IS security research articles published through 2007; start date not provided	Classified the papers according to themes established by the IBM Information Security Capability Reference Model (e.g., Governance, Identity and Access Management, Personnel Security)	We review the more specific body of security policy literature

1. * Our review also differs from each of these based on the time frame (ours is through the first half of 2017), and the identification of linkages among the constructs in the literature (as opposed to primarily a classification of articles based on research topic, theory, method, etc.).

Appendix B: Articles included in review (sorted by author)

The issue of which articles constitute security policy research is not entirely straightforward, particularly when it comes to the vast literature on employees’ security policy compliance. Within this subset of the security policy literature, there exist many different conceptualizations of compliance behavior (Chu et al, 2015; Guo, 2013), and not all behaviors contain an explicit security policy labeling. We follow the criteria of past reviews (Siponen & Vance, 2014; Sommestad et al, 2014) and include policy-related behaviors in organizational contexts, such as computer abuse and IS misuse, within our conceptualization of security policy compliance. Including these behaviors is based on the notion that they mainly involve the unauthorized use of information and technology resources within organizations, and, therefore, constitute security policy violations (Chu et al, 2015).

A similar issue exists with respect to protection motivation theory (PMT)-based studies on how to achieve secure behavior (e.g., Boss et al, 2009, 2015; Johnston & Warkentin, 2010a; Posey et al, 2015). Within this work, some papers explicitly describe secure behaviors in response to security policies (e.g., using anti-spyware, backing up data, changing passwords), whereas others are vague on this issue, or are specific to the personal/home usage context. Again, following past reviews of the security compliance literature (Siponen & Vance, 2014; Sommestad et al, 2014), we include only those PMT-based studies that involve secure behavior in organizational contexts. Adhering to these criteria means that a study meets at least one of the following conditions: (1) a description of secure behavior in which the user is interacting with an organizational information system, (2) a description of the direct relevance of the secure behavior to the organizational context, or (3) the use of organizational respondents. PMT-based studies where the population is personal/home computer users or the context is otherwise not work-related are excluded, because in such cases individuals are not subject to security policies and must acquire information about security threats and tools on their own (Anderson & Agarwal, 2010; Chen and Zahedi, 2016). Appendix D further details our exclusion criteria, as it pertains to a specific list of excluded articles.

In making the preceding points, we emphasize that the PMT-based studies of how to achieve secure behavior often use similar constructs, regardless of whether the context is organizational or personal/home usage. Likewise, studies of employees’ security compliance use many similar theoretical bases and constructs across the variety of behaviors being investigated (e.g., security policy compliance/non-compliance, computer abuse, IS misuse, etc.). Consequently, we have captured the key constructs and themes within these subsets of the security policy literature, even if a particular study may have been excluded based on our criteria.

Regarding the overall security policy literature, we do not claim to have captured every (peer-reviewed) published article for this review, but we do have a relatively complete consensus of the literature, to the point where the constructs and interrelationships in our research framework are supported and no new concepts emerged from the literature. In this manner, we followed Rowe’s (2014) guidance that reviews for understanding should strive for strong coverage of the domain rather than absolute completeness.

Article	Journal	Empirical/Conceptual	Methodology
Al-Mukahal & Alshare (2015)	Information and Computer Security	Empirical	Survey
Aurigemma & Leonard (2015)	Journal of Information System Security	Empirical	Survey
Barlow et al (2013)	Computers and Security	Empirical	Survey
Baskerville et al (2014)	Information Technology and People	Conceptual	–
Boss et al (2009)	European Journal of Information Systems	Empirical	Survey
Bulgurcu et al (2010)	MIS Quarterly	Empirical	Survey
Chan et al (2005)	Journal of Information Privacy and Security	Empirical	Survey
Chen et al (2012)	Journal of Management Information Systems	Empirical	Experiment
Chen et al (2015)	The Journal of Computer Information Systems	Empirical	Survey
Cheng et al (2013)	Computers and Security	Empirical	Survey
Chu et al (2016)	Journal of Business Ethics	Empirical	Survey
Crossler et al (2014)	Journal of Information Systems	Empirical	Survey
D’Arcy and Hovav (2007)	Communications of the ACM	Empirical	Survey
D’Arcy & Devaraj (2012)	Decision Sciences	Empirical	Survey
D’Arcy and Greene (2014)	Information Management and Computer Security	Empirical	Survey
D’Arcy et al (2009)	Information Systems Research	Empirical	Survey
D’Arcy et al (2014)	Journal of Management Information Systems	Empirical	Survey
Dinev & Hu (2007)	Journal of the Association for Information Systems	Empirical	Survey
Dinev et al (2009)	Information Systems Journal	Empirical	Survey
Doherty & Fulford (2005)	Information Resources Management Journal	Empirical	Survey
Doherty & Fulford (2006)	Computers & Security	Conceptual	–
Doherty et al (2009)	International Journal of Information Management	Empirical	Archival
Flowerday & Tuyikeze (2016)	Computers and Security	Empirical	Survey
Foth (2016)	European Journal of Information Systems	Empirical	Survey
Fulford & Doherty (2003)	Information Management and Computer Security	Empirical	Survey
Gaunt (1998)	International Journal of Medical Informatics	Empirical	Observation, Survey
Goel and Chengalur-Smith (2010)	Journal of Strategic Information Systems	Empirical	Survey
Goo et al (2014)	IEEE Transactions on Professional Communication	Empirical	Survey
Gritzalis (1997)	Computers and Security	Conceptual	–
Guo & Yuan (2012)	Information and Management	Empirical	Survey
Guo et al (2011)	Journal of Management Information Systems	Empirical	Survey
Han et al (2017)	Computers and Security	Empirical	Survey
Harrington (1996)	MIS Quarterly	Empirical	Survey
Hedström et al (2011)	Journal of Strategic Information Systems	Empirical	Case studies
Herath & Rao (2009a)	Decision Support Systems	Empirical	Survey
Herath & Rao (2009b)	European Journal of Information Systems	Empirical	Survey
Höne and Eloff (2002a)	Computers and Security	Conceptual	–
Höne and Eloff (2002b)	Network Security	Conceptual	–
Hong et al (2006)	Information Management and Computer Security	Empirical	Survey
Hovav & D’Arcy (2012)	Information and Management	Empirical	Survey
Hsu et al (2015)	Information Systems Research	Empirical	Survey
Hu et al (2011)	Communications of the ACM	Empirical	Scenario, Survey
Hu et al (2012)	Decision Sciences	Empirical	Survey
Hu et al (2015)	Journal of Management Information Systems	Empirical	Experiment
Hwang et al (2017)	Online Information Review	Empirical	Survey
Ifinedo (2012)	Computers and Security	Empirical	Survey
Ifinedo (2014)	Information and Management	Empirical	Survey
Ifinedo (2016)	Information Systems Management	Empirical	Survey
Johnston & Warkentin (2010a)	MIS Quarterly	Empirical	Experiment
Johnston & Warkentin (2010b)	Journal of Organizational and End User Computing	Empirical	Experiment
Johnston et al (2013)	Journal of Organizational and End User Computing	Empirical	Survey
Johnston et al (2015)	MIS Quarterly	Empirical	Experiment, Interviews
Johnston et al (2016)	European Journal of Information Systems	Empirical	Survey
Kadam (2007)	Information Systems Security	Conceptual	–
Karyda et al (2005)	Computers & Security	Empirical	Case studies
Kim et al (2016)	Information & Management	Empirical	Survey
Knapp et al (2006)	Information Management and Computer Security	Empirical	Interviews, Survey
Knapp et al (2009)	Computers & Security	Empirical	Survey, Content Analysis
Knapp & Ferrante (2012)	Journal of Management Policy and Practice	Empirical	Survey
Lee and Larson (2009)	European Journal of Information Systems	Empirical	Survey
Lee and Lee (2002)	Information Management and Computer Security	Conceptual	–
Lee et al (2004)	Information and Management	Empirical	Survey
Lee et al (2016)	Computers and Security	Empirical	Survey
Li et al (2010)	Decision Support Systems	Empirical	Survey
Li et al (2014)	Information Systems Journal	Empirical	Survey
Liao et al (2009)	Journal of Computer Information Systems	Empirical	Survey
Liang et al (2013)	Information Systems Research	Empirical	Survey
Lowry & Moody (2015)	Information Systems Journal	Empirical	Scenario, Survey
Lowry et al (2015)	Information Systems Journal	Empirical	Survey
Moquin & Wakefield (2016)	Journal of Computer Information Systems	Empirical	Survey
Myyry et al (2009)	European Journal of Information Systems	Empirical	Survey
Ng et al (2009)	Decision Support Systems	Empirical	Survey
Padayachee (2012)	Computers & Security	Conceptual	–
Pathari & Sonar (2012)	Information Management and Computer Security	Conceptual	Modeling
Posey et al (2011a)	Computers and Security	Empirical	Survey
Posey et al (2015)	Journal of Management Information Systems	Empirical	Survey
Puhakainen & Siponen (2010)	MIS Quarterly	Empirical	Survey, Interviews
Rees et al (2003)	Communications of the ACM	Conceptual	–
Renaud & Goucher (2012)	Information Management and Computer Security	Empirical	Interviews
Safa et al (2016)	Computers & Security	Empirical	Survey
Shephard & Mejias (2016)	International Journal of Human–Computer Interaction	Empirical	Experiment
Shropshire et al (2015)	Computers and Security	Empirical	Survey
Siponen (2000)	Information Management and Computer Security	Conceptual	–
Siponen (2006)	Communications of the ACM	Conceptual	–
Siponen & Iivari (2006)	Journal of the Association for Information Systems	Conceptual	–
Siponen & Vance (2010)	MIS Quarterly	Empirical	Scenario, Survey
Siponen & Willison (2009)	Information and Management	Empirical	Archival
Siponen et al (2009)	Communications of the ACM	Empirical	Survey
Siponen et al (2010)	Computer	Empirical	Survey
Siponen et al (2014)	Information and Management	Empirical	Survey
Sommestad et al (2015)	Information and Computer Security	Empirical	Survey
Son (2011)	Information and Management	Empirical	Survey
Park & Son (2016)	International Journal of Information Management	Empirical	Survey
Spears & Barki (2010)	MIS Quarterly	Empirical	Interviews, Survey
Stahl et al (2012)	Information Systems Journal	Empirical	Archival
Straub (1990)	Information Systems Research	Empirical	Survey
Teh et al (2015)	Journal of Global Information Management	Empirical	Survey
Tsohou et al (2015b)	European Journal of Information Systems	Empirical	Action, Case Study
Vaast (2007)	Journal of Strategic Information Systems	Empirical	Interviews
Vance & Siponen (2012)	Journal of Organizational and End User Computing	Empirical	Scenario, Survey
Vance et al (2012)	Information and Management	Empirical	Survey
Vance et al (2013)	Journal of Management Information Systems	Empirical	Scenario, Survey
Vance et al (2015)	MIS Quarterly	Empirical	Scenario, Survey
von Solms (1999)	Information Management and Computer Security	Conceptual	–
Wall (2013)	Security Journal	Empirical	Archival
Wall et al (2013)	Journal of Information Privacy and Security	Empirical	Survey
Warkentin et al (2011)	European Journal of Information Systems	Empirical	Survey
Warman (1992)	European Journal of Information Systems	Empirical	Survey, Interview
Wiant (2005)	Computers and Security	Empirical	Survey
Wood (1982)	Computers and Security	Conceptual	–
Workman et al (2008)	Computers in Human Behavior	Empirical	Archival, Survey
Xue et al (2011)	Information Systems Research	Empirical	Survey
Yazdanmehr & Wang (2016)	Decision Support Systems	Empirical	Survey
Zhang et al (2009)	Information Management and Computer Security	Empirical	Survey

Appendix C: Articles included in review (sorted by article frequency)

Journal	Number of articles included in review
Computers and Security	17
Information Management and Computer Security	10
European Journal of Information Systems	9
Information and Management	9
MIS Quarterly	8
Journal of Management Information Systems	6
Communications of the ACM	5
Information Systems Journal	5
Information Systems Research	5
Decision Support Systems	4
Journal of Computer Information Systems	3
Journal of Organizational and End User Computing	3
Journal of Strategic Information Systems	3
Decision Sciences	2
Information and Computer Security	2
International Journal of Information Management	2
Journal of Information Privacy and Security	2
Journal of the Association for Information Systems	2
Computer	1
Computers in Human Behavior	1
IEEE Transactions on Professional Communication	1
International Journal of Human–Computer Interaction	1
International Journal of Medical Informatics	1
Information Resources Management Journal	1
Information Systems Management	1
Information Systems Security	1
Information Technology and People	1
Journal of Business Ethics	1
Journal of Global Information Management	1
Journal of Information Systems	1
Journal of Information System Security	1
Journal of Management Policy and Practice	1
Network Security	1
Online Information Review	1
Security Journal	1

Appendix D: Articles excluded from the review

The following table lists articles that were excluded from our review, including details of our rationale. Obviously, this list is not exhaustive, but our aim is to provide transparency into our exclusion process, particularly with respect to the exclusion of certain well-known articles that appear in top-tier IS journals. We refer the reader back to the Methodology section, as well as Appendix B, for additional details on our inclusion/exclusion criteria.

Notes: the term “not security policy centric” is used to describe an article that we deemed as not directly addressing the design, implementation, compliance/non-compliance, or monitoring of security policies in organizations. Many such articles address information security issues or information security management in a general sense. The remaining descriptions of our rationale for exclusion are self-explanatory.

Article	Journal	Rationale for Exclusion
Albrechtsen (2007)	Computers and Security	Not security policy centric
Anderson & Agarwal (2010)	MIS Quarterly	Not security policy centric; personal/home usage context
Backhouse et al (2006)	MIS Quarterly	Oriented toward industry policy
Basin et al (2013)	ACM Transactions on Information and System Security	Oriented toward technical policy
Bauer and van Eeten (2009)	Telecommunications Policy	Not security policy centric
Bauer et al (2009)	ACM Transactions on Software Engineering and Methodology	Oriented toward technical policy
Boss et al (2015)	MIS Quarterly	Not security policy centric; personal/home usage context
Burns et al (2017)	Computers in Human Behavior	Not security policy centric
Chen and Zahedi (2016)	MIS Quarterly	Not security policy centric; personal/home usage context
Crossler and Bélanger (2009)	Journal of Information System Security	Not security policy centric
Culnan and Williams (2009)	MIS Quarterly	Not security policy centric; issues and opinion paper
Cuppens et al (2013)	Journal of Computer Security	Oriented toward technical policy
David (2002)	Computers and Security	Issues and opinion paper
Dhillon and Backhouse (2000)	Communications of the ACM	Not security policy centric
Di Modica and Tomarchio (2016)
Foley and Fitzgerald (2011)	Journal of Computer Security	Oriented toward technical policy
Herath et al (2014)	Information Systems Journal	Not security policy centric; personal/home usage context
Hicks et al (2010)	ACM Transactions on Information and System Security	Oriented toward technical policy
Horcas et al (2016)	Computers and Security	Oriented toward technical policy
Jajodia et al (2001)	ACM Transactions on Database Systems	Oriented toward technical policy
Kankanhalli et al (2003)	International Journal of Information Management	Not security policy centric
Karjalainen and Siponen (2011)	Journal of the Association for Information Systems	Not security policy centric
Khoury and Tawbi (2012)	ACM Transactions on Information and System Security	Oriented toward technical policy
Li & Wang (2008)	Journal of the ACM	Not security policy centric
Liang & Xue (2009)	MIS Quarterly	Not security policy centric; personal/home usage context
Liang & Xue (2010)	Journal of the Association for Information Systems	Not security policy centric; personal/home usage context
Liu (2015)	European Journal of Information Systems	Not security policy centric
Liu et al (2016)	Information Sciences	Oriented toward technical policy
Lowry et al (2014)	Journal of Business Ethics	Not security policy centric
McDaniel and Prakash (2006)	ACM Transactions on Information and System Security	Oriented toward technical policy
Mehra (2010)	The American Journal of Comparative Law	Oriented toward public policy
Montanari et al (2013)	Computers & Security	Oriented toward technical policy
Muthaiyah and Kerschberg (2007)	Information Systems Frontiers	Oriented toward technical policy
Osenga (2013)	Journal of Information Policy	Oriented toward public policy
Phelps et al (2012)	Journal of Information System Security	Not security policy centric
Posey et al (2011b)	Journal of Information System Security	Not security policy centric
Posey et al (2013)	MIS Quarterly	Not security policy centric; primarily a methodological article; taxonomy of security-related behaviors
Rhee et al (2009)	Computers & Security	Not security policy centric; personal/home usage context
Schneider (2000)	ACM Transactions on Information and System Security	Oriented toward technical policy
Shirtz and Elovici (2011)	Information Management and Computer Security	Not security policy centric
Silva et al (2016)	Decision Support Systems	Oriented toward industry policy
Smith et al (2010)	MIS Quarterly	Oriented toward industry policy
Stanton et al (2005)	Computers and Security	Not security policy centric; taxonomy of security-related behaviors
Straub and Nance (1990)	MIS Quarterly	Not security policy centric
Straub & Welke (1998)	MIS Quarterly	Not security policy centric
Tang et al (2016)	Information Technology and Management	Not security policy centric
Thomson (2010)	Journal of Information System Security	Not security policy centric
Tsohou et al (2010)	Journal of Information System Security	Not security policy centric
Tsohou et al (2015a)	Computers & Security	Not security policy centric
Unal & Caglayan (2013)	Computer Networks	Oriented toward technical policy
Uzunov et al (2015)	Computers and Security	Oriented toward technical policy
Vance et al (2014)	Journal of the Association for Information Systems	Not security policy centric; personal/home usage context
Von Dran et al (1996)	Computers and Security	Issues and opinion paper
Vroom and von Solms (2004)	Computers and Security	Not security policy centric
Wall et al (2016)	Journal of the Association for Information Systems	Oriented toward public policy
Warkentin et al (2016b)	Journal of the Association for Information Systems	Not security policy centric; personal/home usage context
Warkentin et al (2016a)	Decision Support Systems	Not security policy centric; personal/home usage context.
Willison (2006)	Information and Organization	Not security policy centric
Willison and Backhouse (2006)	European Journal of Information Systems	Not security policy centric
Workman and Gathegi (2007)	Journal of the American Society for Information Science and Technology	Not security policy centric; personal/home usage context
Zhang et al (2005)	ACM Transactions on Information and System Security	Oriented toward technical policy

Appendix E: Research framework constructs, definitions, and supporting publications

Construct	Definition	Examples	Sample Publications
Security standards, guidelines and regulations	The formal documents and opinions on security policy recommendations that are published by external bodies, groups, or associations	ISO 27001/02, COBIT, Health Insurance Portability and Accountability Act (HIPPA), Information Technology Infrastructure Library (ITIL), and the Payment Card Industry Data Security Standard (PCI DSS)	Knapp et al (2009), Siponen (2006); von Solms (1999)
Desired policy format and structure	The aims and objectives of an organization’s security policies, in terms of length, clarity, and level of detail	Management endeavors to design security policies that are concise and easy to understand	Goel and Chengalur-Smith (2010), Pathari & Sonar (2012)
Internal and external risk management considerations	The internal and external factors that pose information security risks to an organization	Organization type, size, IT infrastructure, business objectives, economic environment, and internal/external threats	Hong et al (2006), Karyda et al (2005), Knapp et al (2009), Warman (1992), Wall (2013)
Security policy design and implementation	The actual design characteristics of the completed security policy and the manner in which the policy is implemented at the organization	Creating an internet use policy by defining the purpose, scope, roles/responsibilities, and expected/prohibited employee behaviors	Karyda et al (2005), Knapp et al (2009), Wall (2013)
Information security culture, awareness, and support	Security culture consists of the shared assumptions, values, and beliefs help by a group of employees (Karlsson et al, 2015; Knapp et al, 2006). Security awareness refers to the values and attitudes that individual employees hold in regard to secure information practices (Tsohou et al, 2015). Managerial support for information security initiatives represents the financial backing, sponsorship, encouragement, and leadership that management put forth for security initiatives	Management is strongly committed to delivering the funds necessary to enhance employee awareness of security policies	Chen et al (2015), Johnston et al (2013), Karyda et al (2005)
Socioemotional consequences for employees	The interaction between the existence of a security policy and an employee’s social and emotional well-being	An employee feels an increased sense of stress in needing to comply with a new anti-malware policy at their organization	Renaud & Goucher (2012), Vaast (2007)
Personality and dispositional traits	The inherent, individual characteristics of employees, including behavioral, cognitive, and ethical norms	An employee believes that it is their moral responsibility to comply with security policies laid out by the organization	Ifinedo (2014), Myyry et al (2009), Vance & Siponen (2012)
Security policy legitimacy, fairness and justice	The perception of an individual that a security policy is desirable, appropriate, and reasonable	An employee considers a new password policy at their organization as an unfair burden on them	Hu et al (2012), Siponen & Iivari (2006), Son (2011)
Compliance with security policy	The extent to which employees intend to comply or actually comply with a security policy	Despite a policy stating that data backups should be completed every night, an employee ignores the guideline and only backs up their data on a weekly basis.	Bulgurcu et al (2010), Herath & Rao (2009a; b)
Organizational security objectives	The benefits that the implementation of security policies intend to achieve	By implementing a data protection policy, an organization hopes to reduce the number of incidents of personal information being accidentally released.	Hsu et al 2015; Knapp & Ferrante (2012), Spears & Barki (2010), Wiant (2005)

Appendix F: Article coding results by relationship

The papers highlighted in the R1–R5 columns below correspond to the findings presented in the Results section. The items listed in the “Main Theoretical/Conceptual Linkages” column represent theories and conceptual models that were referenced in each of the listed papers. The data presented here varies in magnitude and scope, depending on the theoretical orientation of each paper. In some cases, a theory or model was used to construct or extend a research model; in other cases, a broader theory or concept simply informed the direction of the research.

Paper	R1	R2	R3	R4	R5	Main Theoretical/Conceptual Linkages
Al-Mukahal & Alshare (2015)			x			Deterrence theory, neutralization theory, theory of planned behavior
Aurigemma & Leonard (2015)			x			Affective organizational commitment, theory of planned behavior, rational choice theory
Barlow et al (2013)			x			Theory of neutralization techniques
Baskerville et al (2014)			x			Emote opportunity model of computer abuse
Boss et al (2009)		x	x			Social influence theory, organismic integration theory, agency theory, control theory
Bulgurcu et al (2010)			x			Theory of planned behavior, rational choice theory, deterrence theory
Chan et al (2005)			x			Not applicable or none noted
Chen et al (2012)			x			Compliance theory, general deterrence theory
Chen et al (2015)		x				Organizational culture theory, security culture framework
Cheng et al (2013)			x			General deterrence theory, social bond theory, social control mechanisms
Chu et al (2016)			x			General deterrence theory
Crossler et al (2014)			x			Protection motivation theory
D’Arcy and Hovav (2007)			x			General deterrence theory
D’Arcy & Devaraj (2012)			x			Deterrence theory
D’Arcy and Greene (2014)			x			Social exchange theory
D’Arcy et al (2009)			x			General deterrence theory
D’Arcy et al (2014)			x			Coping theory, moral disengagement theory, social cognitive theory
Dinev & Hu (2007)			x			Theory of planned behavior
Dinev et al (2009)			x			Theory of planned behavior
Doherty & Fulford (2005)					x	Not applicable or none noted
Doherty & Fulford (2006)	x					Not applicable or none noted
Doherty et al (2009)	x					Not applicable or none noted
Flowerday & Tuyikeze (2016)	x	x				Not applicable or none noted
Foth (2016)			x			Theory of planned behavior, general deterrence theory
Fulford & Doherty (2003)	x					Not applicable or none noted
Gaunt (1998)		x				Not applicable or none noted
Goel & Chengalur-Smith (2010)	x					Not applicable or none noted
Goo et al (2014)			x			Safety climate and performance model
Gritzalis (1997)	x					Not applicable or none noted
Guo & Yuan (2012)			x			Deterrence theory, social cognitive theory
Guo et al (2011)			x			Composite behavior model
Han et al (2017)			x			Rational choice theory
Harrington (1996)			x			Deterrence theory
Hedström et al (2011)			x			Value-based compliance model
Herath & Rao (2009a)			x			General deterrence theory, protection motivation theory
Herath & Rao (2009b)			x			General deterrence theory, agency theory
Höne and Eloff (2002a)	x					Not applicable or none noted
Höne and Eloff (2002b)	x					Not applicable or none noted
Hong et al (2006)	x					Integrated system theory of information security management
Hovav & D’Arcy (2012)			x			Deterrence theory
Hsu et al (2015)			x	x		Social control theory
Hu et al (2011)			x			Deterrence theory, rational choice theory, self-control theory
Hu et al (2012)			x			Theory of planned behavior
Hu et al (2015)			x			Self-control theory
Hwang et al (2017)			x			Protection motivation theory
Ifinedo (2012)			x			Theory of planned behavior, protection motivation theory
Ifinedo (2014)			x			Theory of planned behavior, social cognitive theory, social bond theory
Ifinedo (2016)			x			General deterrence theory, rational choice theory, organizational climate perspective
Johnston & Warkentin (2010a)			x			Protection motivation theory, fear appeals model
Johnston & Warkentin (2010b)			x			Not applicable or none noted
Johnston et al (2013)		x				Social cognitive theory
Johnston et al (2015)			x			Protection motivation theory, deterrence theory
Johnston et al (2016)			x			Protection motivation theory, general deterrence theory
Kadam (2007)	x					Not applicable or none noted
Karyda et al (2005)	x	x			x	Not applicable or none noted
Kim et al (2016)			x			Abuse opportunity structure, emotion process model
Knapp et al (2006)		x				Grounded theory
Knapp et al (2009)	x	x			x	Grounded theory
Knapp & Ferrante (2012)				x	x	General deterrence theory, theory of organizational learning
Lee and Larson (2009)			x			Protection motivation theory
Lee and Lee (2002)			x			General deterrence theory, social bond theory, social learning theory
Lee et al (2004)			x			General deterrence theory, social control theory, theory of planned behavior
Lee et al (2016)		x				Person-environment fit theory
Li et al (2010)			x			Rational choice theory
Li et al (2014)			x			Organizational justice
Liao et al (2009)			x			Theory of planned behavior, deterrence theory, theory of ethics
Liang et al (2013)			x			Control theory, regulatory focus theory
Lowry & Moody (2015)		x	x			Organizational control theory, reactance theory
Lowry et al (2015)			x			Fairness theory, reactance theory
Moquin & Wakefield (2016)			x			Protection motivation theory, theory of planned behavior
Myyry et al (2009)			x			Theory of cognitive moral development, theory of motivational types of values
Ng et al (2009)			x			Health belief model
Padayachee (2012)			x			Self-determination theory
Pathari & Sonar (2012)	x					Not applicable or none noted
Posey et al (2011a)			x			Causal reasoning theory, attribution theory
Posey et al (2015)			x			Protection motivation theory, organizational commitment
Puhakainen & Siponen (2010)			x			Universal constructive instructional theory, elaboration likelihood model
Rees et al (2003)	x				x	Not applicable or none noted
Renaud & Goucher (2012)		x				Not applicable or none noted
Safa et al (2016)			x			Social bond theory, involvement theory
Shephard & Mejias (2016)			x			General deterrence theory, rational choice theory, agency theory
Shropshire et al (2015)			x			Theory of reasoned action, technology acceptance model
Siponen (2000)		x				Theory of reasoned action, theory of planned behavior, intrinsic motivation, technology acceptance model
Siponen (2006)	x					Not applicable or none noted
Siponen & Iivari (2006)			x			Conservative-deontological theory, liberal-intuitive theory, prima-facie theory, virtue theory, utilitarian theory, universalizability theory
Siponen & Vance (2010)			x			Neutralization theory, general deterrence theory
Siponen & Willison (2009)	x					Not applicable or none noted
Siponen et al (2009)			x			Theory of reasoned action, protection motivation theory
Siponen et al (2010)			x			Protection motivation theory, deterrence theory, theory of reasoned action, innovation diffusion theory
Siponen et al (2014)			x			Protection motivation theory, theory of reasoned action, cognitive evaluation theory
Sommestad et al (2015)			x			Theory of planned behavior, protection motivation theory
Son (2011)			x			General deterrence theory, intrinsic and extrinsic motivation models
Park & Son (2016)			x			Procedural justice
Spears & Barki (2010)			x	x		Buy-in theory of participation, system quality theory, emergent interactions theory
Stahl et al (2012)		x				Critical social theory
Straub (1990)			x			General deterrence theory
Teh et al (2015)			x			Social exchange theory
Tsohou et al (2015b)		x				Actor-network theory, structuration theory, contextualism
Vaast (2007)		x				Not applicable or none noted
Vance & Siponen (2012)			x			Rational choice theory
Vance et al (2012)			x			Protection motivation theory, habit theory
Vance et al (2013)			x			Theory of accountability
Vance et al (2015)			x			Accountability theory
von Solms (1999)	x					Not applicable or none noted
Wall (2013)	x		x			Not applicable or none noted
Wall et al (2013)						Self-determination theory, psychological reactance theory
Warkentin et al (2011)			x			Social learning theory
Warman (1992)	x					Not applicable or none noted
Wiant (2005)				x		Deterrence theory
Wood (1982)	x				x	Not applicable or none noted
Workman et al (2008)			x			Threat control model, social cognitive theory, protection motivation theory
Xue et al (2011)			x			Technology acceptance model
Yazdanmehr & Wang (2016)			x			Norm activation theory, social norms theory
Zhang et al (2009)			x			Risk compensation theory, theory of planned behavior
Total articles	20	15	81	4	6

Appendix G: Overview of Supplementary Theories and Approaches

Informing theory or approach	Summary	Boundary conditions and assumptions	Limitations	References
Control theory	Control theory examines the managerial design and implementation of mechanisms that attempt to affect the behavior of another person or group as a means to achieve organizational goals. Key areas of focus include the antecedents to control choice (e.g., behavior observability) and the characteristics of control (e.g., control mode, degree, style)	Control theory assumes a clear division of roles between controllers (e.g., managers) and controllees (e.g., staff) Control theory focuses primarily around the controller’s concern for the organization’s ability to capture value	Where organizational structure and job roles are ambiguous, control theory is less helpful in clarifying controller–controlee interactions Control research within IS has been largely focused on systems development processes	Cram et al (2016b), Davis (1940), Flamholtz et al (1985), Remus et al (2015), Tannenbaum (1962), Wiener et al (2016)
Institutional theory	Institutional theory considers the norms, processes, and routines within organizations associated with social behavior	Where organizational structures are viewed as being legitimate, fair, and just, employees are more likely to perform their responsibilities more effectively, including complying with rules and regulations	Institutional theory deemphasizes the individual interests of actors, in favor of institutional influences	DiMaggio (1988), Jaffee (1991), Meyer and Rowan (1977), Niehoff and Moorman (1993), Schnedler and Vadovic (2011), Scott (1987), Workman (2009)
Replication and longitudinal research	Replication research seeks to obtain the same results as previous studies by either reproducing similar conditions or deliberately introducing variations to the conditions (e.g., data set, population) of the original study Longitudinal research draws on data from multiple points in time	Replication research relies on the prior publication of work that allows for a reproduction of similar study conditions or a deliberate variation of particular study conditions Longitudinal research aims to identify causal factors by uncovering changes that occur over time	Replication research is not always identified as such and comprises only a small proportion of published research Longitudinal research introduces challenges in terms of data collection difficulties (e.g., finding organizations or individuals willing to participate on multiple occasions)	Lindsay and Ehrenberg (1993), Salterio (2014), Tsang and Kwan (1999)
Agency theory	Agency theory examines the relationship between two parties, the principal and agent, and the challenges that arise from their conflicting goals and the limited ability of the principal to oversee the agent’s work	Applications of agency theory commonly assume that (1) agents act primarily out of self-interest; (2) the goals of principals and agents conflict; and (3) information asymmetry exists between principals and agents Agency relationships can apply in a variety of settings, including owner-manager and manager-subordinate	Agency theory is most useful in situations where principal–agent goal conflict and/or information asymmetry is high Agency theory has been criticized for being narrow in scope and difficult to test	Eisenhardt (1989), Jensen and Meckling (1976), Perrow (1986), Sharma (1997), Zsidisin and Ellram (2003)
Work systems theory, cybernetics	Work systems theory considers the circumstances where humans and machines perform work using information and technology, while accounting for the planned and unplanned changes that occur within such systems. A cybernetic process is one that uses a feedback loop to set goals, determine achievement against those goals, and make ongoing corrections	Systems and processes are standardized and measurable. Where performance variances are identified within the systems, the related information can be used to resolve the problems that exist. Work systems theory and cybernetics can apply to both technical processes, as well as sociotechnical systems	In processes that are unstandardized, difficult to measure, or information isn’t available to make corrections, feedback loops may be less helpful	Alter (2013), Hofstede (1978)