Information Security Policy Violations: A Grounded Theory Approach to Counterfactual Balance and Tensions
Kennedy Njenga, Paul Benjamin Lowry · SSRN Electronic Journal · 2018
Research shows that employees seldom follow recommended information security policies regardless of their awareness levels. The focus of this study is to examine the causes of violations and to generate unique insights that places heavy emphasis on ‘intent’ of violations rather than ‘effect’. For such reason, the work employs a qualitative Grounded Theory approach. The use of Grounded Theory in this work presents insightful behavioral features in a selected institution and generates a substantive theory of intent. Specific reference is placed on identifying counterfactual balances of norms, commitment and attachment that give rise to tension outcomes; namely, relational imbalance, unstable disposition, and lack of cognitive consonance. Our model proposes that counterfactual balance that leads to these three tensions will most likely result in IS policy violations. The implications for this model are discussed within the main body of this work.