Dual identities at work: how security role and functional role shape cybersecurity behaviours
Obi Ogbanufe, Huigang Liang · Behaviour and Information Technology · 2025
Irrespective of their primary functional roles in the organisation, individuals are expected to perform specific information security roles. However, there is often a divide between the organisation's expectations of the two roles. The divide becomes more pronounced when the individual's self-concept is tied to their primary functional role rather than the information security role. Drawing from the role identity theory and information security literature, we examine the construction of information security role identity (ISRI) and how its impacts on in-role and extra-role security behaviours differ from those of functional role identity. Specifically, we examine the effect of security self-efficacy, personal values, other’s expectations, and organisational support on ISRI and, in turn, in-role and extra-role security behaviours. We analyzed survey data of 537 workers using structural equation modelling. The results reveal that ISRI is shaped by personal values and other’s expectations but not security self-efficacy and organisational support. In addition, information security role identity influences both in-role and extra-role security behaviours, while functional role only influences extra-role security behaviours. Our findings contribute to research and practice by showing how information security role identity is determined and its effects on mandatory and volitional security behaviours, highlighting its importance in security management.