Which are the Most Effective Measures for Improving Employees' Security Compliance?
Martin Kretzer, Alexander Mädche · International Conference on Information Systems · 2015
Employees’ compliance behavior with information security policies has been extensively researched yet. In particular, many studies identified and explained measures that increase employees’ security compliance such as trainings and controls. Although the identification and explanation of these measures is valuable for managers, these findings are insufficient. Since managers need to balance limited resources, they need to be able to prioritize and invest in the most effective measures for improving employees’ security compliance. Therefore, to complement extant research, we survey 332 employees in an organization that has established 15 security measures. Our results provide managers with a quantitative assessment of these 15 security measures. Furthermore, we discuss the implications of our findings and give recommendations for managers. In addition, our results may also be valuable for theorists because, e.g., we show and explain which type of information security agent is most effective.