CoChat
Sign Up
Cited by 450Information and Cyber SecurityPrivacy, Security, and Data ProtectionTechnology Adoption and User Behaviour

Toward a Unified Model of Information Security Policy Compliance1

Open access
Moody, Gregory D., Siponen, Mikko, Pahnila, Seppo·2018·MIS Quarterly
DOI 10.25300/misq/2018/13853
Open this paper in CoChat — free accountOpen PDF

Abstract

Information systems security (ISS) behavioral research has produced different models to explain security policy compliance. This paper (1) reviews 11 theories that have served the majority of previous information security behavior models, (2) empirically compares these theories (Study 1), (3) proposes a unified model, called the unified model of information security policy compliance (UMISPC), which integrates elements across these extant theories, and (4) empirically tests the UMISPC in a new study (Study 2), which provided preliminary empirical support for the model. The 11 theories reviewed are (1) the theory of reasoned action, (2) neutrali- zation techniques, (3) the health belief model, (4) the theory of planned behavior, (5) the theory of interpersonal behavior, (6) the protection motivation theory, (7) the extended protection motivation theory, (8) deterrence theory and rational choice theory, (9) the theory of self-regulation, (10) the extended parallel processing model, and (11) the control balance theory. The UMISPC is an initial step toward empirically examining the extent to which the existing models have similar and different constructs. Future research is needed to examine to what extent the UMISPC can explain different types of ISS behaviors (or intentions thereof). Such studies will determine the extent to which the UMISPC needs to be revised to account for different types of ISS policy violations and the extent to which the UMISPC is generalizable beyond the three types of ISS violations we examined. Finally, the UMISPC is intended to inspire future ISS research to further theorize and empirically demonstrate the important differences between rival theories in the ISS context that are not captured by current measures.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.25300/misq/2018/13853

Cites

11 of 11 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Whether individuals practice good cyber hygiene depends on the individual's moral beliefs and behavioural intentions.

    “Whether individuals practice good cyber hygiene depends on the individual's moral beliefs and behavioural intentions (Vallor and Rewak, 2018;Moody et al., 2018).”

    From The influence of ethical principles and policy awareness priming on university students’ judgements about ICT code of conduct compliance (2022) · cites this paper as Moody et al., 2018

    In “Summary of the Key Results from Study 2” (page unavailable), the paper reports that role values help explain intentions to comply with information-security policies. But “Findings, Applicability, and Future Research Needs Per Construct” says the moral-beliefs construct was not retained and leaves its role an open question. The reported finding concerns employees’ compliance intentions, not whether individuals actually practice good cyber hygiene. (LLM, conf=0.88)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 105

  1. Akers, R. L., Krohn, M. D., Lanza-Kaduce, L., Radosevich, M. 1979. "Social Learning and Deviant Behavior: A Specific Test of a General Theory," American Sociological Review (44:4), pp. 636-655.
  2. Ashforth, B. E., and Mael, F. 1989. "Social Identity Theory and the Organization," Academy of Management Review (14:1), pp. 20-39.
  3. Ashforth, B. E., Rogers, K. M., and Corley, K. G. 2011. "Identity in Organizations: Exploring Cross-Level Dynamics," Organiza- tion Science (22:5), pp. 1144-1156.
  4. Bagozzi, R. P. 1992. "The Self-Regulation of Attitudes, Intentions, and Behavior," Social Psychology Quarterly (55:2), pp. 178-204.
  5. Bamberg, S., and Schmidt, P. 2003. "Incentives, Morality, or Habit? Predicting Students' Car Use for University Routes with the Models of Ajzen, Schwartz, and Triandis," Environment and Behavior (35:2), pp. 264-285.
  6. Barlow, J., Warkentin, M., Ormond, D., and Dennis, A. 2013. "Don't Make Excuses! Discouraging Neutralization to Reduce IT Policy Violation," Computers & Security (39:Part B), pp. 145-159.
  7. Baskerville, R., and Siponen, M. T. 2002. "An Information Security Meta-Policy for Emergent Organizations," Journal of Logistics Information Management (15:5/6), pp. 337-346.
  8. Becker, G. S. 1974. "Crime and Punishment: An Economic Approach," in Essays in the Economics of Crime and Punish- ment, G. S. Becker and W. M. Landes (eds.), Cambridge, MA: National Bureau of Economic Research, pp. 1-54,.
  9. Becker, M. H. 1974. "The Health Belief Model and Personal Health Behavior," Health Education Monograph Series (2:4), pp. 324-508.
  10. Bergeron, F., Raymond, L., Rivard, S., Gara, M.-F. 1995. "Deter- minants of EIS Use: Testing a Behavioral Model," Decision Support Systems (14:2), pp. 131-146.
  11. Boss, S. R., Galletta, D. F., Lowry, P., Moody, G., and Polak P. 2015. "What Do Users Have to Fear? Using Fear Appeals to Engender Threats and Fear That Motivate Protective Behaviors in Users," MIS Quarterly (39:4), pp. 837-864,
  12. Boss, S. R., Kirsch, L. J., Angermeier, I., Shingler, R., and Boss, R. W. 2009. "If Someone Is Watching, I'll Do What I'm Asked: Mandatoriness, Control, and Information Security," European Journal of Information Systems (18:2), pp. 151-164.
  13. Braithwaite, J. 1989. Crime, Shame and Reintegration, Cambridge, UK: Cambridge University Press.
  14. Bulgurcu, B., Cavusoglu, H., Benbasat, I. 2010. "Information Security Policy Compliance: An Empirical Study of Rationality- Based Beliefs and Information Security Awareness," MIS Quarterly (34:3), pp. 523-546.
  15. Curry, T. R. 2005. "Integrating Motivating and Constraining Forces in Deviance Causation: A Test of Causal Chain Hypothe- ses in Control Balance Theory," Deviant Behavior (26:6), pp. 571-599.
  16. D'Arcy, J., and Herath, T. 2011. "A Review and Analysis of Deterrence Theory in the IS Security Literature: Making Sense of the Disparate Findings," European Journal of Information Systems (20:6), pp. 643-658.
  17. D'Arcy, J., Herath, T., and Shoss, M. K. 2014. "Understanding Employee Responses to Stressful Information Security Requirements: A Coping Perspective," Journal of Management Information Systems (31:2), pp. 285-318.
  18. D'Arcy, J., and Hovav, A. 2007. "Deterring Internal Information Systems Misuse," Communications of the ACM (50:10), pp. 113-117.
  19. D'Arcy, J., Hovav, A., and Galletta, D. F. 2009. "User Awareness of Security Countermeasures and its Impact on Information Systems Misuse: A Deterrence Approach," Information Systems Research (23:1), pp. 79-98.
  20. Fishbein, M., and Ajzen, I. 1975. Belief, Attitude, Intention and Behavior: An Introduction to Theory and Research, Reading, MA: Addison-Wesley.
  21. Floyd, D. L., Prentice-Dunn, S., and Rogers, R. W. 2000. "A Meta- Analysis of Research on Protection Motivation Theory," Journal of Applied Social Psychology (30:2), pp. 407-429.
  22. Galletta, D. F., and Polak, P. 2003. "An Empirical Investigation of Antecedents of Internet Abuse in the Workplace," in Proceedings of the SIG Workshop on Human-Computer Interaction, pp. 47-51.
  23. Gefen, D., Straub, D. W., and Rigdon, E. E. 2011. "An Update and Extension to Sem Guidelines for Admnistrative and Social Science Research," MIS Quarterly (35:2), pp. iii-xiv.
  24. Gibbs, J. P. 1975. Crime, Punishment, and Deterrence, New York: Elsevier.
  25. Hair, J. F., Black, B., Babin, B., Anderson, R. E., anTatham. R. L. 2006. Multivariate Data Analysis (6 th ed.), Upper Saddle River, NJ: Pearson Prentice Hall.
  26. Harrington, S. J. 1996. "The Effect of Codes and Personal Denial of Responsibility on Computer Abuse Judgments and Intentions," MIS Quarterly (20:3), pp. 257-278.
  27. Hirschheim, R., Klein, H. K., and Lyytinen, K. 1995. Information Systems Development and Data Modelling: Conceptual and Philosophical Foundations, Cambridge, UK: Cambridge Univer- sity Press.
  28. Herath, T., and Rao, H. R. 2009. "Protection Motivation and Deterrence: A Framework for Security Policy Compliance in Organisations," European Journal of Information Systems (18:1), pp. 106-125.
  29. Johnston, A. C., and Warkentin, M. 2010. "Fear Appeals and Information Security Behaviors: An Empirical Study," MIS Quarterly (34:3), pp. 549-566.
  30. Johnston, A. C., Warkentin, M., and Siponen, M. 2015. "An Enhanced Fear Appeal Framework: Leveraging Threats to the Human Asset through Sanctioning Rhetoric," MIS Quarterly (39:1), pp. 113-134.
  31. Laudan, L. 1978. Progress and its Problems: Towards a Theory of Scientific Growth, Berkeley, CA: University of California Press.
  32. Lee, S. M., Lee, S.-G., and Yoo, S. 2004. "An Integrative Model of Computer Abuse Based on Social Control and General Deterrence Theories," Information & Management (41:6), pp. 707-718.
  33. Leiwo, J., and Heikkuri, S. 1998. "An Analysis of Ethics as Foundation of Information Security in Distributed Systems," in Proceedings of the 31 st Hawaii International Conference on Systems Sciences, Los Alamitos, CA: IEEE Computer Society Press.
  34. Leone, L., Perugini, M., and Ercolani, A. P. 1999. "A Comparison of Three Models of Attitude-Behavior Relationships in the Studying Behavior Domain," European Journal of Social Psychology (29:2-3), pp. 161-189.
  35. Liang, H., and Xue, Y. 2009. "Avoidance of Information Tech- nology Threats: A Theoretical Perspective," MIS Quarterly (33:1), pp. 71-90.
  36. Liang, H., and Xue, Y. 2010. "Understanding Security Behaviors in Personal Computer Usage: A Threat Avoidance Perspective," Journal of the Association for Information Systems (11:7), pp. 394-413.
  37. Limayem, M., and Hirt, S. G. 2003. "Force of Habit and Infor- mation Systems Usage: Theory and Initial Validation," Journal of the Association for Information Systems (4:1), pp. 65-97.
  38. Liska, A. E., Krohn, M. D., and Messner, S. F. 1989. "Strategies and Requisites for Theoretical Integration in the Study of Crime and Deviance," in Theoretical Integration in the Study of Deviance and Crime: Problems and Prospects, S. F. Messner, M. D. Krohn, A. E. Liska (eds.), Albany, NY: SUNY Press, pp. 1-20.
  39. Lowry, P. B., and Moody, G. D. 2015. "Proposing the Control Reactance Compliance Model (CRCM) to Explain Opposing Motivations to Comply with Organizational Information Security Policies," Information Systems Journal (25:50, pp. 433-463.
  40. Maddux, J. E., and Rogers, R. W. 1983. "Protection Motivation and Self-Efficacy: A Revised Theory of Fear Appeals and Attitude Change," Journal of Experimental Social Psychology (19:5), pp. 469-479.
  41. Maloney, E. K., Lapinski, M. K., and Witte, K. 2011. "Fear Appeals and Persuasion: A Review and Update of the Extended Parallel Process Model," Social and Personality Psychology Compass (5:4), pp. 206-219.
  42. Marsh, H. W., and Hocevar, D. 1985. "Application of Confirm- atory Factor Analysis to the Study of Self-Concept: First-and Higher Order Factor Models and Their Invariance Across Groups," Psychological Bulletin (97), pp. 362-582.
  43. Maruna, S., and Copes, H. 2005. "What Have We Learned from Five Decades of Neutralization Research?," Crime and Justice (32), pp. 221-320.
  44. Mishra, S., and Dhillon, G. 2006. "Information Systems Security Governance Research: A Behavioral Perspective," in Pro- ceedings of the 1 st Annual Symposium on Information Assurance, Academic Track of the 9 th Annual 2006 NYS Cyber Security Conference, New York, pp. 18-26.
  45. Ng, B.-Y., Kankanhalli, A., and Xu, Y. 2009. "Studying Users' Computer Security Behavior: A Health Belief Perspective," Decision Support Systems (46:4), pp. 815-825.
  46. Pahnila, S., Siponen, M., and Mahmood, A. 2007. "Employees' Behavior Towards IS Security Policy Compliance," in Proceedings of 40 th Annual Hawaii International Conference on System Sciences, Los Alamitos, CA: IEEE Computer Society Press.
  47. Paternoster, R. 2010. "How Much We Really Know about Criminal Deterrence?," Journal of Criminal Law and Crim- inology (100:3), pp. 765-824.
  48. Paternoster, R., and Simpson, S. 1996. "Sanction Threats and Appeals to Morality: Testing a Rational Choice Model of Corporate Crime," Law & Society Review (30:3), pp. 549-584.
  49. Peace, A. G., Galletta, D. F., and Thong, J. Y. 2003. "Software Piracy in the Workplace: A Model and Empirical Test," Journal of Management Information Systems (20:1), pp. 153-177.
  50. Pee, L. G., Woon, I. M. Y., and Kankanhalli, A. 2008. "Explaining Non-Work-Related Computing in the Workplace: A Comparison of Alternative Models," Information & Management (45:2), pp. 120-130.
  51. Pogarsky, G. 2004. "Projected Offending and Implications for Heterotypic Continuity," Criminology (42:1), pp. 111-135.
  52. Puhakainen, P., and Siponen, M. 2010. "Improving Employee's Compliance through IS Security Training: An Action Research Study," MIS Quarterly (34:4), pp. 757-778.
  53. Rogers, R. W. 1975. "A Protection Motivation Theory of Fear Appeals and Attitude Change," The Journal of Psychology (91:1), pp. 93-114.
  54. Sheppard, B. H., Hartwick, J., and Warshaw, P. R. 1988. "The Theory of Reasoned Action: A Meta-Analysis of Past Research with Recommendations for Modifications and Future Research," Journal of Consumer Research (15:12), pp. 325-343.
  55. Siponen, M. 2001. "On the Role of Human Morality in Information System Security: From the Problems of Descriptivism to Non- descriptive Foundations," in Social Responsibility in the Information Age: Issues and Controversies, G. Dillon (ed.), Hershey, PA: Idea Group Publishing, pp. 239-254.
  56. Siponen, M. 2005. "Analysis of Modern IS Security Development Approaches: Towards the Next Generation of Social and Adaptable ISS Methods," Information and Organization (15:4), pp. 339-375.
  57. Siponen, M., Karjalainen, M., and Sarker, S. 2010. "Unearthing Social Mechanisms that Lead Employees to Violate IS Security Procedures: An Inductive Study," in Proceedings of Dewald Roode Workshop on Information Systems Security Research, IFIP Working Group 8.11/11.13, B. Molyneux and A. Vance (eds.) (https://ifip.byu.edu/ifip2010.html).
  58. Siponen, M., Mahmood, M. A., and Pahnila, S. 2014. "Employees' Adherence to Information Security Policies: An Exploratory Field Study," Information & Management (51:2), pp. 217-224.
  59. Siponen, M., and Vance, A. 2010. "Neutralization: New Insights into the Problem of Employee Information Systems Security Policy Violations," MIS Quarterly (34:3), pp. 487-502.
  60. Siponen, M., and Vance, T. 2014. "Examining the Phenomenon of Deliberate IS Security Policy Violations: A Call and Guidelines for Research," European Journal of Information Systems (23:3), pp. 289-305.
  61. Siponen, M., Vance, T., and Willison, R. 2012. "New Insights into the Problem of Software Piracy: The Effects of Neutralization, Shame, and Moral Beliefs," Information & Management (49:7), pp. 334-341.
  62. Straub, D. W. 1990. "Effective IS Security," Information Systems Research (1:3), pp. 255-276.
  63. Straub, D., Goodman, S., and Baskerville, R. 2008. "Framing the Information Security Process in Modern Society," in Information Security: Policy, Processes, and Practices, D. W. Straub, S. Goodman, R. Baskerville (edsl), Armonk, NY: M. E. Sharpe Inc., pp. 5-12.
  64. Sykes, G. M., and Matza, D. 1957. "Techniques of Neutralization: A Theory of Delinquency," American Sociological Review (22:6), pp. 664-670.
  65. Teh, P.-L., Ahmed, P. K., and D'Arcy, J. 2015. "What Drives Information Security Policy Violations among Banking Employees? Insights from Neutralization and Social Exchange Theory," Journal of Global Information Management (23:1), pp. 44-64.
  66. Theoharidou, M., Kokolakis, S., Karyda, M., and Kiountouzis, E. 2005. "The Insider Threat to Information Systems and the Effec- tiveness of ISO17799," Computers & Security (24:6), pp. 472-484.
  67. Tittle, C. R. 1995. Control Balance: Toward a General Theory of Deviance, Boulder, CO: Westview Press.
  68. Vance, T., and Siponen, M. 2012. "IS Security Policy Violations: A Rational Choice Perspective," Journal of Organizational and End User Computing (24:1), pp. 21-41.
  69. Vance, T., Siponen, M., and Pahnila, S. 2012. "Motivating IS Security Compliance: Insights from Habit and Protection Motivation Theory," Information & Management (49:2), pp. 190-198.
  70. Venkatesh, V., Thong, J. Y. L., and Xin, X. 2012. "Consumer Acceptance and Use of Information Technology: Extending the Unified Theory of Acceptance and Use of Technology" MIS Quarterly (36:1), pp. 157-178.
  71. Verplanken, B. 2006. "Beyond Frequency: Habit as Mental Con- struct," British Journal of Social Psychology (45:3), pp. 639-656.
  72. Warkentin, M., and Willison, R. 2009. "Behavioral and Policy Issues in Information Systems Security: The Insider Threat," European Journal of Information Systems (18:2), pp. 101-105.
  73. Willison, R., and Warkentin, M. 2013. "Beyond Deterrence: An Expanded View of Employee Computer Abuse," MIS Quarterly, (37:1), pp. 1-20.
  74. Witte, K., Cameron, K. A., McKeon, J. K., and Berkowitz, J. M. 1996. "Predicting Risk Behaviors: Development and Validation of a Diagnostic Scale," Journal of Health Communications (1:4), pp. 317-341.
  75. Abraham, C. S., Sheeran, P., Abrams, D., and Spears, R. 1994. "Exploring Teenagers' Adaptive and Maladaptive Thinking in Relation to the Threat of HIV Infection," Psychology & Health, (9:4), pp. 253-272.
  76. Bamberg, S., and Schmidt, P. 2003. "Incentives, Morality, or Habit? Predicting Students' Car Use for University Routes with the Models of Ajzen, Schwartz, and Triandis," Environment and Behavior (35:2), pp. 264-285.
  77. Barlow, J., Warkentin, M., Ormond, D., and Dennis, A. 2013. "Don't Make Excuses! Discouraging Neutralization to Reduce IT Policy Violation," Computers & Security (39:Part B), pp. 145-159.
  78. Bergeron, F., Raymond, L., Rivard, S., Gara, M.-F. 1995. "Determinants of EIS Use: Testing a Behavioral Model," Decision Support Systems (14:2), pp. 131-146.
  79. Curry, T. R. 2005. "Integrating Motivating and Constraining Forces in Deviance Causation: A Test of Causal Chain Hypotheses in Control Balance Theory," Deviant Behavior (26:6), pp. 571-599.
  80. D'Arcy, J., Hovav, A., and Galletta, D. F. 2009. "User Awareness of Security Countermeasures and its Impact on Information Systems Misuse: A Deterrence Approach," Information Systems Research (23:1), pp. 79-98.
  81. Fisher, R. J. 1993. "Social Desirability Bias and the Validity of Indirect Questioning. Journal of Consumer Research, 20(2): 303-315.
  82. Guo, K.H., Yuan, Y., Archer, N.P., Connelly, C.E. 2011. Understanding Nonmalicious Security Violations in the Workplace: A Composite Behavior Model. Journal of management information systems 28(2): 203-236.
  83. Hu, Q., Xu, Z., Dinev, T., and Ling, H. 2011. Does deterrence work in reducing information security policy abuse by employees? Communications of the ACM 54(6) 54-60.
  84. Johnston, A. C., and Warkentin, M. 2010. "Fear Appeals and Information Security Behaviors: An Empirical Study," MIS Quarterly (34:3), pp. 549-566.
  85. Kanfer, R., and Ackerman, P. L. 1989. "Motivation and Cognitive Abilities: An Integrative/Aptitude-Treatment Interaction Approach to Skill Acquisition," Journal of Applied Psychology (74:4), pp. 657-690.
  86. Limayem, M., and Hirt, S. G. 2003. "Force of Habit and Information Systems Usage: Theory and Initial Validation," Journal of the Association for Information Systems (4:1), pp. 65-97.
  87. Gagnon, M.-P., Godin, G., Gane, C., Fortin, J.-P., Lamothe, L., Reinharz, D., and Cloutier, A. 2003. "An Adaptation of the Theory of Interpersonal Behavior to the Study of Telemedicine Adoption by Physicians," International Journal of Medical Informatics (71:2-3), pp. 103-115.
  88. McClenahan, C., Shevlin, M., Adamson, G., Bennett, C., and O'Neill, B. 2007. "Testicular Self-Examination: A Test of the Health Belief Model and the Theory of Planned Behavior," Health Education Research (22:2), pp. 272-284.
  89. Milne, S., Sheeran, P., and Orbell, S. 2000. "Prediction and Intervention in Health-Related Behavior: A Meta-Analytic Review of Protection Motivation Theory," Journal of Applied Social Psychology (30:1), pp. 106-143.
  90. O'Fallon, M., and Butterfield, K. 2005. "A Review of the Empirical Ethical Decision-Making Literature: 1996-2003," Journal of Business Ethics (59:4), pp. 375-413.
  91. Osman, A., Barrios, F. X., Osman, J. R., Schneekloth, R., and Troutman, J. A. 1994. "The Pain Anxiety Symptoms Scale: Psychometric Properties in a Community Sample," Journal of Behavioral Medicine (17:5), pp. 511-522.
  92. Paternoster, R., and Simpson, S. 1996. "Sanction Threats and Appeals to Morality: Testing a Rational Choice Model of Corporate Crime," Law & Society Review (30:3), pp. 549-584.
  93. Piquero, N. L., and Piquero, A. R. 2006. "Control Balance and Exploitative Corporate Crime," Criminology (44:2), pp. 397-430.
  94. Pogarsky, G. 2004. "Projected Offending and Implications for Heterotypic Continuity," Criminology (42:1), pp. 111-135.
  95. Rogers, R. W. 1983. "Cognitive and Physiological Processes in Fear Appeals and Attitude Change: A Revised Theory of Protection Motivation," in Social Psychophysiology, J. Cacioppo and R. E. Petty (eds.), New York: Guilford, pp. 153-176.
  96. Siponen, M., and Vance, A. 2010. "Neutralization: New Insights into the Problem of Employee Information Systems Security Policy Violations," MIS Quarterly (34:3), pp. 487-502.
  97. Siponen, M., and Vance, A. 2014. "Guidelines for Improving the Contextual Relevance of Field Surveys: The Case of Information Security Policy Violations," European Journal of Information Systems (23:3), pp. 289-305.
  98. Tittle, C. R. 1995. Control Balance: Toward a General Theory of Deviance, Boulder, CO: Westview Press.
  99. Tittle, C. R. 1997. "Thoughts Stimulated by Braithwaite's Analysis of Control Balance Theory," Theoretical Criminology (1:1), pp. 99-110.
  100. Trevino, L. K. 1992. "Experimental Approaches to Studying Ethical-Unethical Behavior in Organizations," Business Ethics Quarterly (2:2), pp. 121-136.
  101. Vance, T., and Siponen, M. 2010. "Neutralization: New Insights into the Problem of Employee Information Systems Security Policy Violations," MIS Quarterly (34:3), pp. 487-502.
  102. Vance, T., and Siponen, M. 2012. "IS Security Policy Violations: A Rational Choice Perspective," Journal of Organizational and End User Computing (24:1), pp. 21-41.
  103. Verplanken, B., and Orbell, S. 2003. "Reflections on Past Behavior: A Self-Report Index of Habit Strength," Journal of Applied Social Psychology (33:6), pp. 1313-1330.
  104. Witte, K., Cameron, K. A., McKeon, J. K., and Berkowitz, J. M. 1996. "Predicting Risk Behaviors: Development and Validation of a Diagnostic Scale," Journal of Health Communications (1:4), pp. 317-341.
  105. Woon, I. M. Y., Tan, G.-W., and Low, R. 2005. "A Protection Motivation Theory Approach to Home Wireless Security," in Proceedings of the 26 th International Conference on Information Systems, D. Avison, D. Galletta, and J. I. DeGross (eds.), Las Vegas, NV, December 11-14, pp. 367-380.

Cited by

Sorted by citations

Authors
Moody, G. D., Siponen, M., & Pahnila, S.
Affiliations
  • University of Nevada, Las Vegas (US)
  • University of Jyväskylä (FI)
  • University of Oulu (FI)
ORCID
Venue
MIS Quarterly
Publisher
MIS Quarterly
Published
2018-03-01
Volume
42
Issue
1
Pages
285-311
ISSN
  • 0276-7783 (ISSN-L)
  • 2162-9730
DOI
10.25300/misq/2018/13853
OpenAlex
W2786705330
Cited by
450
References
11
Citations by year
2026: 34 · 2025: 58 · 2024: 53 · 2023: 67 · 2022: 59 · 2021: 77 · 2020: 44 · 2019: 42 · 2018: 14
FWCI
71.41
Type
journal article
Language
en
Open access
Locations
  • MIS Quarterly (publishedVersion)
  • Jyväskylä University Digital Archive (University of Jyväskylä) (submittedVersion)
  • Journal of the Association for Information Systems (submittedVersion)
Funders
  • Academy of Finland
  • Tekes
  • European Regional Development Fund
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
  • Social Sciences › Decision Sciences › Information Systems and Management › Technology Adoption and User Behaviour
Keywords
information security policy compliance, security behavior, theory of reasoned action, theory of planned behavior, Health Belief Model, protection motivation theory, deterrence theory, rational choice theory, self-regulation, control balance theory, security breaches

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review