Policy Awareness, Enforcement and Maintenance: Critical to Information Security Effectiveness in Organizations
Kenneth J. Knapp, Claudia J. Ferrante · Journal of Management Policy and Practice · 2012
To minimize the probability of costly information security incidents, organizations should be highly motivated to communicate, enforce and maintain security policies. With insight from the workplace deviance and organizational learning literature, we investigate a model exploring the impact of policy awareness, enforcement and maintenance on the effectiveness of information security programs in organizations. Utilizing a sample of 297 certified information security professionals located in the United States, we found support for the model as well as a second-order version of a modified structure. Before concluding, we discuss our results, study limitations and offer implications for research and practice. 1