THE LAST LINE OF DEFENSE : MOTIVATING EMPLOYEES TO FOLLOW CORPORATE SECURITY GUIDELINES
Laurie J. Kirsch, Scott R. Boss · Journal of the Association for Information Systems · 2007
Information security has become increasingly important to organizations. Despite the prevalence of technical security measures , individual employees remain the last line – and frequently the weakest link – in corporate defenses. When individuals choose to disregard security policies and procedures , the organization is at risk. How, then, can organizations motivate their employees to follow security guidelin es? Using an organizational control lens, we build a model to explain individual information security precaution -taking behavior . Specific hypotheses are developed and tested using a field survey. We examine elements of control and introduce the concept of “mandatoriness” which we define as the degree to which individuals perceive that compliance with existing security policies and procedures is compulsory or expected by organizational management. We find that the acts of specifying polic ies and evaluat ing behaviors are effective in convincing individuals that security policies are mandatory. The perception of mandatoriness is effective in motivating individuals to take security precautions.