From Information Security Governance to Data Protection Effectiveness: The Serial Mediating Roles of Security Policy Compliance and Cybersecurity Capability

Abstract

Purpose - This study examines the relationship between Information Security Governance (ISG) and Data Protection Effectiveness (DPE), focusing on the serial mediating roles of Security Policy Compliance (SPC) and Cybersecurity Capability (CC). Design/methods/approach – A quantitative explanatory approach was employed using a cross-sectional survey of 300 respondents selected through purposive sampling in Indonesia. Data were collected using a structured questionnaire comprising 33 indicators across four constructs and analyzed using Partial Least Squares Structural Equation Modeling (PLS-SEM) with SmartPLS 4. Findings – The results revealed significant positive relationships between ISG and SPC (β = 0.493, p < 0.001), SPC and CC (β = 0.433, p < 0.001), and CC and DPE (β = 0.404, p < 0.001). The serial indirect relationship between ISG and DPE through SPC and CC was also significant (β = 0.086, p < 0.001). The model explained 45.4% of the variance in DPE. Research implications/limitations – The findings suggest that effective data protection requires coordinated governance, consistent security policy compliance, and organizational cybersecurity capabilities. However, the cross-sectional design, purposive sampling, and reliance on self-reported data limit causal interpretation and generalizability. Originality/value – This study integrates the Information Security Governance and Dynamic Capability perspectives within a Governance–Behavior–Capability–Outcome Framework. It extends existing cybersecurity research by identifying behavioral compliance and organizational capability as sequential mechanisms linking security governance with data protection effectiveness.