This is a sel -a chi ed e sion o an o iginal a icle. This e sion
may di e om he o iginal in pagina ion and ypog aphic de ails.
Au ho (s):
Ti le:
Yea :
Ve sion:
Copy igh :
Righ s:
Righ s u l:
Please ci e he o iginal e sion:
CC BY-NC-ND 4.0
h ps://c ea i ecommons.o g/licenses/by-nc-nd/4.0/
Towa d a s age heo y o he de elopmen o employees' in o ma ion secu i y beha io
© 2020 The Au ho s
Published e sion
Ka jalainen, Ma i; Siponen, Mikko; Sa ke , Sup a eek
Ka jalainen, M., Siponen, M., & Sa ke , S. (2020). Towa d a s age heo y o he de elopmen o
employees' in o ma ion secu i y beha io . Compu e s and Secu i y, 93, 101782.
h ps://doi.o g/10.1016/j.cose.2020.101782
2020
Compu e s & Secu i y 93 (2020) 101782
Con en s lis s a ailable a ScienceDi ec
Compu e s & Secu i y
jou nal homepage: www.else ie .com/loca e/cose
Towa d a s age heo y o he de elopmen o employees’ in o ma ion
secu i y beha io
Ma i Ka jalainen
a
, Mikko Siponen
b , ∗, Sup a eek Sa ke
c
a
M3S Resea ch Uni , Facul y o In o ma ion Technology and Elec ical Enginee ing, Uni e si y o Oulu, Oulu, FI 90014, Finland
b
Facul y o In o ma ion Technology, Uni e si y o Jy askyla, P.O. Box 35, FI 40014, Finland
c
McIn i e School o Comme ce, Uni e si y o Vi ginia, USA
a i c l e i n o
A icle his o y:
Recei ed 1 May 2019
Re ised 30 Janua y 2020
Accep ed 26 Feb ua y 2020
A ailable online 4 Ma ch 2020
Keywo ds:
In o ma ion secu i y
In o ma ion secu i y beha io
Compliance wi h in o ma ion secu i y
policies
S age heo y
Lea ning
a b s a c
Exis ing beha io al in o ma ion secu i y esea ch p oposes con inuum o non-s age models ha ocus on
finding s a ic de e minan s o in o ma ion secu i y beha io (ISB) ha emains unchanged. Such models
canno explain a case whe e he easons o ISB change. Howe e , he unde lying easons and mo i es
o use s’ ISB a e no s a ic bu may change o e ime. To unde s and he change in easoning be ween
di e en an eceden s, we examine s age heo izing in o he fields and de elop he equi emen s o an
eme gen heo y o he de elopmen o employees’ ISB: (1) he con en o s ages based on he s age el-
emen s and hei s age-specific a ibu es; (2) he s age-independen elemen explaining he ins abili y
o ISB; and (3) he empo al o de o s ages based on de elopmen al p og ession. To illus a e he s age
heo y equi emen s in an in o ma ion secu i y con ex , we sugges ou s ages: in ui i e hinking, decla -
a i e hinking, agency- ela ed hinking, and ou ine- ela ed hinking. We p opose ha lea ning is a key
d i e o change be ween he s ages. Acco ding o ou heo izing, employees s a wi h in ui i e belie s
and la e de elop ou ine- ela ed hinking. Fu he mo e, using in e iew da a collec ed om employees
in a mul ina ional company, we illus a e he di e ences in he s ages. Fo u u e in o ma ion secu i y
esea ch, we concep ualize ISB change in e ms o s ages and con ibu e a heo e ical amewo k ha can
be empi ically alida ed. In ela ion o p ac ice, unde s anding he di e ences be ween he s ages o e s a
ounda ion o iden i ying he s age-specific challenges ha lead o non-compliance and he co espond-
ing in o ma ion secu i y aining aimed a ackling hese challenges. Gi en ha use s’ ISB ollows s ages,
al hough no in a specific o de , iden i ying such s ages can imp o e he e ec i eness o in o ma ion
secu i y aining in e en ions wi hin o ganiza ions.
©2020 The Au ho s. Published by Else ie L d.
This is an open access a icle unde he CC BY-NC-ND license.
( h p://c ea i ecommons.o g/licenses/by-nc-nd/4.0/ )
1. In oduc ion
The cen al ole o in o ma ion and in o ma ion echnology has
made in o ma ion secu i y a key conce n o o ganiza ions. One
o he issues iden ified in he so-called beha io al in o ma ion
secu i y li e a u e conce ns why employees comply wi h o i-
ola e hei o ganiza ion’s in o ma ion secu i y p ocedu es (ISPs).
This li e a u e examines cases whe e employees can bypass some
in o ma ion secu i y p ocedu es, such as lea ing hei compu -
e s unlocked, sending confiden ial e-mails wi hou enc yp ion, o
opening links o in ec ed websi es ( V oom and on Solms, 2004 ;
Ka jalainen e al., 2019 ). F om a p ac ical pe spec i e, unde s and-
ing such beha io s is impo an ; i use s do no comply wi h
∗Co esponding au ho .
E-mail add ess: mikko. .siponen@jyu.fi (M. Siponen).
ISPs, in o ma ion secu i y solu ions, howe e echnically sophis i-
ca ed, lose hei e ec i eness ( K uge and Kea ney, 2006 ; Fu nell
and Moo e, 2014 ). Indeed, employees’ adop ion o insecu e beha -
io s con inues o be a key explana ion o in o ma ion secu i y
b eaches ha c ea es significan financial losses o o ganiza ions
( Sa a and Maple, 2016 ; Ponemon Ins i u e, 2014a , 2014b ; Sa eNe ,
2014 ).
A dominan app oach o unde s anding employees’ in o ma ion
secu i y beha io (ISB) (o in en ions behind hem) has been o
es non-s age—also known as con inuum— heo ies in o de o ake
s a ic “snapsho s” o beha io and i s an eceden (see Weins ein
e al., 1998 ; Schwa ze , 2008 ). In hese non-s age models, he
explana ions o p edic o s a e s a ic and imeless. Fo example,
de e ence heo y is among he mos commonly applied heo-
ies in beha io al in o ma ion secu i y esea ch ( Sommes ad e al.,
2014 ). I explains ISB iola ions (o in en ions) h ough s a ic and
h ps://doi.o g/10.1016/j.cose.2020.101782
0167-4048/© 2020 The Au ho s. Published by Else ie L d. Thisisanopen access a icle unde he CC BY-NC-ND license. ( h p://c ea i ecommons.o g/licenses/by-nc-nd/4.0/ )
2 M. Ka jalainen, M. Siponen and S. Sa ke / Compu e s & Secu i y 93 (2020) 101782
imeless easons, such as se e i y, ce ain y, and cele i y o
sanc ions. We a gue ha di e en easons may ha e di e ing im-
po ance based on, o example, employees’ wo k expe ience. P e-
ious esea ch, in assuming s a ic (non-s age) explana ions, canno
explain a si ua ion in which he ole o di e en easons—such as
ea appeals o he se e i y and ce ain y o sanc ions—changes.
An al e na i e app oach is o unde s and he de elopmen h ough
s ages ( Velice and P ochaska, 2008 ), a common app oach in social
psychology, mo al psychology, and c iminology (e.g., P ochacka and
DiClemen e, 1983 ; Weins ein e al., 1998 ; Tho nbe y, 1987 ). In his
pape , we seek o answe he ollowing esea ch ques ion: How
can we explain a change in employees’ easons o hei ISBs o e
ime and ac oss di e en si ua ions? As an answe o his esea ch
ques ion, we p opose he equi emen s o a s age model app oach
in he con ex o ISB esea ch. We also illus a e he s ages wi h
in e iew da a collec ed om in e iews wi h o ganiza ional em-
ployees.
Such a s age model app oach has he po en ial o c ea e a new
unde s anding o in o ma ion secu i y esea ch and p ac ice. I he
easons o ISB di e o a e changing o e ime o an indi idual,
esea ch and p ac ice should benefi om esea ch aimed a cap-
u ing such ISB dynamics in o quali a i ely dis inc s ages. Fo ex-
ample, as a manage ial con ol mechanism, he se e i y o sanc-
ions can be use ul o ini ia ing a mo i a ion o complian ISB,
bu i may be less e ec i e o main aining complian ISB o e
ime, which may equi e expe iencing mo e in insic benefi s om
ISB. Resea ch and p ac ice can also cap u e ISB dynamics in he
sense ha , ega dless o he endency o comply wi h ISPs, ISB
can pe iodically di e om his pa e n due o ce ain si ua ion-
specific demands, such as changes in he wo k en i onmen o
ime p essu e. F om hese pe spec i es, he dynamics o ISB ha e
la gely emained uns udied.
Fo in o ma ion secu i y esea ch, we o e a dynamic concep-
ual amewo k, which may inc ease ou unde s anding o how in-
o ma ion secu i y– ela ed easoning may change o e ime and in
di e en si ua ions. As an implica ion o p ac ice, he s ages o -
e a ool o iden i ying di e ences in use s’ easons o ISB (o
compliance/non-compliance).
The emainde o his pape is o ganized as ollows. The second
sec ion explains he p inciples o s age heo ies. The hi d sec ion
shows ha exis ing esea ch on employees’ ISB has no s udied he
opic om he s age heo y pe spec i e, as ou lined in ou s udy.
The ou h sec ion p esen s a discussion on ou heo izing and he
ela ed empi ical da a collec ion and analysis p ocess. The fi h sec-
ion p esen s he equi emen s and empi ical illus a ions o he
eme gen s age heo y. The six h sec ion ou lines he con ibu ions
and implica ions o p ac ice and esea ch. Finally, he se en h sec-
ion summa izes he key findings.
2. On s age heo ies
2.1. Some s age heo y p inciples
Classical beha io al change heo ies ha e been p oposed in he
fields o de elopmen al psychology, heal h psychology, and mo al
psychology. Examples o hese include s age heo ies o mo al de-
elopmen ( Kohlbe g, 1981 ), addic i e beha io s ( P ochaska e al.,
1992 ), and g ie ing ( Küble -Ross and Kessle , 2006 ). While a ew
s age heo ies also exis in in o ma ion sys ems (IS) ( Venka esh
e al., 2011 ), change heo izing in IS is o en associa ed wi h p o-
cess heo ies, dis inc om he a iance heo ies p oposed by Moh
(1982 ; Bu on-Jones e al., 2015 ; Sabhe wal and Robey, 1995 ). In
u n, he change heo ies in psychology a e o en called s age
heo ies , while heo ies wi hou s ages a e e e ed o as non-
s age heo ies ( Velice and P ochaska, 2008 ) o con inuum heo-
ies ( Weins ein e al., 1998 ). Moh (1982) only ecognized e en -
based change heo ies, which he called p ocess heo ies. Howe e ,
a numbe o p ocess and s age heo ies in, e.g., psychology a e no
undamen ally e en -based ( Weins ein e al., 1998 ). The e o e, he
key dis inc ion be ween s age/p ocess and con inuum/non-s age
heo ies is no necessa ily he exis ence o e en s. Mo eo e , a i-
ance models can ha e e en s ha may e en induce change. Fo
example, p o ec ion mo i a ion heo y is used as a classical exam-
ple o a non-s age heo y in heal h psychology ( Weins ein e al.,
1998 ). Acco ding o his heo y, ea con ibu es o h ea ecogni-
ion and he adop ion o p o ec i e beha io s ( Roge s, 1975 ). As
ea is aised by some e en , p o ec ion mo i a ion heo y has
an e en (implici ly). Howe e , why p o ec ion mo i a ion heo y
is iewed as a non-s age heo y in heal h psychology ( Weins ein
e al., 1998 ) has no hing o do wi h e en s: I is because he ea-
sons o change (e.g., ea ) do no change; hey always emain he
same. In o he wo ds, o non-s age heo ies, he independen a i-
ables a e expec ed o emain unchanged du ing he li e cycle o he
phenomenon. In u n, s age o p ocess heo ies a e needed when
he ac o s a e belie ed o change du ing he en i e li e cycle o he
phenomenon. S age heo ies sugges ha a de elopmen is linked
o s ages. The e o e, a s age heo y endea o s o explain he de el-
opmen pa h o a specific phenomenon by di iding he de elop-
men in o dis inc s ages ( Weins ein e al., 1998 ).
2.2. On he de elopmen o s age heo ies
Reichenbach (1938) sepa a ed “ heo y disco e y” om “ he-
o y jus ifica ion”. Fo heo y disco e y, he e a e mul iple possi-
ble p ocesses desc ibing how s age heo ies a e de eloped. Com-
mon o he disco e y o many s age heo ies is ha hey a e o ig-
inally based on specula ion o imagina ion) o /and schola s’ em-
pi ical obse a ions. As s age heo y has been p oposed in many
cases, la e a significan numbe o s udies ha e es ed he o ig-
inal assump ions o e he yea s ( heo y jus ifica ion). Feye abend
(1975) conduc ed a e iew o scien ific b eak h oughs and no ed
ha heo y disco e y mus ha e significan ly less e idence han
heo y jus ifica ion, o he wise new heo y disco e y and b eak-
h oughs will be se iously hinde ed. The de elopmen o equi e-
men s o ou s age heo y o ISB ep esen s a heo y disco e y ap-
p oach. Ou s age heo y is la gely based on heo izing on concep s
om p e ious s age heo ies.
2.3. An empi ical e sus a heo e ical concep
Schwa ze (2008) claimed ha in heal h psychology, s ages
ha e no hing o do wi h disco e ing scien ific u h. Ins ead, “ he
ques ion is no whe he s ages uly exis , bu whe he s age is
a use ul cons uc ” (p. 85). Ins ead o ying o cap u e all possi-
ble s ages, s age heo ies y o cap u e ypical s ages wi h ins u-
men al alue, ei he heo e ically o empi ically ( Schwa ze , 2008 ).
Somewha simila ly, Weins ein e al., 1998 , p. 291) epo ed ha
a “s age is a heo e ical cons uc . We can define a p o o ype o
each s age, bu ew people will ma ch his ideal pe ec ly.” Fo
example, gi en ha humans a e in en ional and ha hey may
change hei beha io e en se e al imes a day, de elopmen and
change can be indi idual and si ua ional. A s age heo y ha seeks
o cap u e all changes would esul in a conside able numbe o
s ages and a highly complica ed model. This is a key eason o
iew s ages as heo e ical cons uc s, which do no exis in eali y
as such, bu p esen ideal ypes o ce ain pu poses ( Schwa ze ,
2008 ; Weins ein e al., 1998 ).
S age heo ies ha e mo e han wo o de ed s ages, which com-
p ise di e en elemen s ha explain indi iduals’ beha io and
mo emen be ween he s ages ( Weins ein e al., 1998 ). Ye , e en
in ideal cases, no all people necessa ily go h ough all ( heo e ical)
M. Ka jalainen, M. Siponen and S. Sa ke / Compu e s & Secu i y 93 (2020) 101782 3
s ages ( Kohlbe g, 1981 ), and people may emain in one s age o -
e e ( Weins ein e al., 1998 ). O en, he p ecise du a ion in which
people eside in a s age canno be known, and nei he is his im-
po an ( Weins ein e al., 1998 ).
Ou esul ing s age heo y eflec s he abo e ideas o he heo-
e ical na u e o s age heo y concep s. We ou line he con en o
s age heo y by combining ou obse a ions om employee in e -
iews wi h he exis ing li e a u e on s age heo ies, di e en ypes
o knowledge, and s ages o beha io . Howe e , ou app oach is
somewha Kohlbe gian in he sense ha he s ages a e heo e i-
cally defined and pu in o de ( ollowing Kohlbe g, 1981 ), and only
hei con en is illus a ed wi h empi ical da a. We now look a
p e ious esea ch and he ocus on non-s age models a he han
s age heo ies.
3. P e ious empi ical wo k on employees’ ISB
The exis ing esea ch on ISB comp ises h ee closely e-
la ed esea ch a eas. Fi s , influenced by S aub (1990) , compu e
abuse/misuse s udies examine di e en une hical o illegal ac ions,
such as sending acis emails and using illegal so wa e wi hin
o ganiza ions (e.g., Lee e al., 2004 ; D’A cy e al., 2008 ; Siponen,
2001 ). These s udies ha e mainly applied heo ies om c iminol-
ogy (e.g., de e ence heo y in D’A cy e al., 2008 ). Ano he e-
la ed esea ch a ea ocuses on in es iga ing employees’ in en ions
o comply wi h o iola e o ganiza ions’ ISPs ( He a h and Rao,
2009a ; Siponen and Vance, 2010 ), hei ac ual beha io ( Ng e al.,
2009 ), o bo h ( Myy y e al., 2009 ). Thi d, se e al s udies ha e in-
es iga ed use s’ insecu e beha io s wi hou connec ing hem o
compu e abuse/misuse o policy iola ions. Such s udies include
he use o p o ec i e echnologies ( Dine e al., 2009 ), good pass-
wo d p ac ices ( S an on e al., 2003 ), and secu i y conscious be-
ha io ( Rhee e al., 2009 ). Appendix A summa izes he p e ious
esea ch in g ea e de ail.
Ou li e a u e e iew shows ha h ee abo e-men ioned pe -
spec i es o e non-s age models (see heo y ype in Appendix A ).
Mos p e ious s udies ha e explained ISB o in en ion he eo .
Mo eo e , p e ious esea ch has also examined changes in ISB o
in en ions behind i (see ins ances o he dynamic na u e o ISB
in Appendix A ). Fo example, in expe imen al s udies, ea ap-
peals ( Johns on and Wa ken in, 2010 ; Boss e al., 2015 ), g oup ac-
i i ies ( Alb ec sen and Ho den, 2010 ), o eedback and gamifi-
ca ion ( Fu nell e al., 2019 ) ha e been linked o changes in ISB
o in en ions. Howe e , e en i hese s udies explain ISB change
(o in ended change), hey do no examine changes in easoning
o ISB.
Finally, p e ious ISB s udies also include mode a o a iables
(see Appendix A ). The mode a o s in hese s udies conce n he
influence o sanc ions ( Chen e al., 2013 ), cul u al dimensions
( Dine e al., 2009 ), pe sonal alues ( Li e al., 2010 ; Bo ena and
Bélange , 2013 ), o pe sonali y ai s ( Sh opshi e e al., 2015 ).
Ins ead o explaining ISB change ac oss si ua ions, hese s udies
ocus on explaining he influence o ela i ely s able indi idual o
cul u al cha ac e is ics on ISB. They do no explain he change o
mode a o s.
To summa ize, in e ms o independen a iables (IVs) and de-
penden a iables (DVs), p e ious esea ch has p oposed models in
which he IVs o mode a o s emain unchanging. Mo eo e , he e
a e expe imen al s udies explaining changes in he le el o DVs,
no in e ms o IVs. In o he wo ds, p e ious s udies do no ex-
amine changes in use s’ in o ma ion secu i y cogni ions o e ime
o ac oss si ua ions. Mo e p ecisely, exis ing s udies do no exam-
ine: 1) how di e en ac o s migh be ele an o use s in di e -
en s ages o de elopmen (i.e., s age-specific in o ma ion secu i y
cogni ions and change enhance s in ou model); 2) how a use ’s
complian ISB can pe iodically change om his usual pa e n due
o ce ain si ua ion-specific demands (i.e., o e iding cogni ions in
ou model); and 3) o e all, how a use ’s ISB may become ou-
inized o e ime as an ou come o a lea ning p ocess. This s udy
endea o s o ake he fi s s ep by p o iding a no el iew ha may
explains ISB in e ms o s ages.
4. Role o empi ical da a in ou s udy
We s a ed ou esea ch by collec ing in e iew da a on em-
ployees’ easons o hei ISB. In e iew da a we e collec ed
in mul iple loca ions o a global company ope a ing in he
ma ine indus y and ene gy ma ke . The da a we e collec ed
h ough semi-s uc u ed in e iews conduc ed by he wo au ho s.
Appendix B p esen s he numbe o in e iews, he di e en o -
ganiza ional posi ions, and he coun ies. In e iewees in di e en
coun ies and o ganiza ional posi ions we e andomly selec ed o
dec ease possible bias in ou findings on he basis o he cha ac-
e is ics o a ce ain p o ession o o ganiza ional cul u e. The in-
e iews we e o a s ong con e sa ional na u e, and a he han
he elici a ion o ac s, hey in ol ed ac i e lis ening and an ac i a-
ion o in e iewees’ cons uc ion o meaning ( Schulze and A i al,
2011 ). Howe e , b oad in e iew hemes and open-ended ques ions
we e planned be o ehand (see in e iew ou line in Appendix B ).
Al oge he , 72 ace- o- ace in e iews we e eco ded and an-
sc ibed, wi h an a e age in e iew las ing 47 min.
Ou da a collec ion and analysis all unde quali a i e con en
analysis, defined as “subjec i e in e p e a ion o he con en o
ex da a h ough he sys ema ic classifica ion p ocess o coding
and iden i ying hemes o pa e ns” ( Hsieh and Shannon, 2005 ,
1278). The fi s au ho conduc ed an ini ial da a analysis, wi h he
analysis p oceeding collabo a i ely among all au ho s’ engagemen
in discussions, so ing o ideas, and concep ualiza ions. To desc ibe
he phenomenon unde s udy, we fi s collec ed some iewpoin s
explaining in o ma ion secu i y a i udes and ISB and c ea ed he
ini ial da a-d i en ca ego ies wi hou connec ing ou in e iew
ques ions wi h a specific beha io al heo y ( Hsieh and Shannon,
2005 ). A e se e al i e a ions, 88 ini ial ca ego ies o easons
o employees’ ISB eme ged om he da a. Nex , in he absence
o longi udinal esea ch se ings, we u ilized ou heo e ical
sensi i i y o unde s and beha io al change. We de eloped he
equi emen s o a s age heo y, based on social and o ganiza ional
esea ch, so as o suppo he eme gence o ou in o ma ion
secu i y–specific heo y (see Sec ion 5.1 ). Based on he equi e-
men s, we in e p e ably defined h ee high-le el ca ego ies (i.e.,
in o ma ion secu i y cogni ions, change enhance s, and o e iding
cogni ions) and ca ego ized he ini ial open codes (i.e., easons o
ISB) unde hese ca ego ies. Fu he , we es ablished he o de o
he s ages as elying on ou p og essi e s ages o beha io ( Gelle ,
2002 ; Howell, 1982 ). Thus, e en hough empi ical obse a ions
se ed as ou s a ing poin and poin ed o he con en o he
s ages (see ela ed empi ical ac o s in Table 1 ), he li e a u e on
di e en ypes o knowledge and he s ages o beha io , in he
spi i o heo e ical sensi i i y ( Pa on, 1990 ), guided he p ecise
o mula ion o he s ages and he de elopmen o he eme ging
s age heo y. The e o e, he s ages we e heo e ically defined and
placed in o de , and only hei con en is illus a ed wi h empi ical
da a. The equi emen s and esul ing s age heo y a e in oduced
below.
5. Findings
We fi s in oduce he equi emen s o a s age heo y and hei
meaning in an in o ma ion secu i y con ex . In wha ollows, we
p esen he ou s ages o he de elopmen o employees’ ISB.
4 M. Ka jalainen, M. Siponen and S. Sa ke / Compu e s & Secu i y 93 (2020) 101782
Table 1
De elopmen s ages o employees’ ISB: Elemen s, a ibu es, and ac o s.
Elemen s o a s age heo y A ibu es in S age 1: In ui i e
hinking
A ibu es in S age 2:
Decla a i e hinking
A ibu es in S age 3:
Agency- ela ed hinking
A ibu es in S age 4:
Rou ine- ela ed hinking
S age-specific in o ma ion
secu i y cogni ions
explaining ISB, i.e.,
compliance (C) and/o
non-compliance (N) wi h
ISPs
In ui i e cogni ions (N) –
Rela ed empi ical ac o s:
– Seg ega ion
– Compe ence o e es ima ion/
in o ma ion secu i y
equi emen
unde es ima ion
– In o ma ion secu i y
con en men
Decla a i e cogni ions (C/N) –
Rela ed empi ical ac o s:
– In o ma ion secu i y
conflic – ela ed (N); alue
conflic ; incon enience
– He e onomous (C/N);
dependency on au ho i y;
dependency on ole model;
social con o mi y
Agency cogni ions (C) –
Rela ed empi ical ac o s:
–E alua ion o isks
–Value cong uence
–T us in ISPs
Rou ine- ela ed cogni ions
(C) –Rela ed empi ical
ac o s:
– Agency cogni ions
explaining ISB wi h low
cogni i e e o
S age-specific change
enhance s p omo ing
beha io al change
Be ween 1–2: Mo i a ion
enhance s –Rela ed
empi ical ac o s:
Be ween 2–3: Reflec ion
enhance s –Rela ed
empi ical ac o s:
Be ween 3–4: F equency
enhance s –Rela ed
empi ical ac o s:
– In e nal; pe sonal in e es
and ac i i y
–Ex e nal; di ec and indi ec
in o ma ion secu i y
acciden s, media isibili y
– O ganiza ional
con ol– ela ed; manda o y
ISPs, moni o ing, ewa ds,
and sanc ions
– Expe ien ial lea ning
con en
– Collabo a i e lea ning
me hods
– Inc easing suscep ibili y o
in o ma ion secu i y isks
– Enhancing alue
connec i i y
– Reconciling beha io al
efficiency
S age-independen
o e iding
condi ions:
Condi ions o ins abili y o
ISB ha a e common o
s ages 2–4
O e iding cogni ions (N) –Rela ed empi ical ac o s:
–Wo king En i onmen
– Sho cu s
–Social P essu e
– Oppo unism
5.1. Requi emen s o a s age heo y in he con ex o employees’ ISB
S age heo ies a e unde pinned by di e en me a-cha ac e is ics
(e.g., Weins ein e al., 1998 ; Kohlbe g, 1981 ). Me a-cha ac e is ics
define he equi emen s o a s age heo y in he in o ma ion se-
cu i y con ex (in ou case), a iewpoin ha is cu en ly miss-
ing om he exis ing in o ma ion secu i y li e a u e. We define
he con en and o de o s ages by combining ou empi ical obse -
a ions o in o ma ion secu i y cogni ions and ISB wi h concep s
om he p e ious li e a u e on human hinking and beha io .
Fi s , he con en o he s ages can be defined in e ms o ce -
ain elemen s ha define he s ages, and each elemen has specific
a ibu es ( Nolan, 1973 ). To define he elemen s and hei s age-
specific a ibu es in he in o ma ion secu i y con ex , we adop ed
he basic assump ions o he o ganiza ional ou ine change li -
e a u e ha a beha io al change is closely ela ed o knowledge
( B esman, 2013 ). Fu he , we es ablish and suppo he mean-
ing o he knowledge- ela ed elemen s wi h concep s om he
p e ious li e a u e on human hinking and beha io (as p e-
sen ed in Sec ion 5.2 ). Acco dingly, we selec he na u e o em-
ployees’ knowledge o hei o ganiza ion’s ISPs as he elemen
o iden i ying he s ages, calling hem in o ma ion secu i y cog-
ni ions ( Heds öm and Swedbe g, 1998 ). We also ecognize an-
o he elemen , i.e., change enhance s , which p omo es he de-
elopmen o in o ma ion secu i y cogni ions ( P ochaska and Di-
clemen e, 1983 ; 1992 ) . Fu he , we submi ha hese elemen s
ha e di e en s age-specific a ibu es: S age 1 has ypical cogni-
ions i and enhance s A, while S age 2 has ypical cogni ions ii and
enhance s B. Fu he , ou s age heo y p esen s di e en ac o s
o each s age-specific a ibu e de i ed om he empi ical da a
(see Table 1 ).
Second, ou s age heo y ecognizes ha human beha io is
p one o excep ions ( Johns, 2006 ) and ha de elopmen al changes
a e no necessa ily pe manen ( G een, 1989 ). Thus, ou s age he-
o y includes a s age-independen elemen : he cogni ions explain-
ing he ins abili y o ISB . These o e iding cogni ions a e ela ed
o he expe ienced si ua ional cons ain s o ci cums ances ha
change employees’ p e alen ISB om complian o non-complian
( Kaise and Fuh e , 2003 ; Ha e, 1963 ). Based on his unde s anding,
schola s and p ac i ione s can unde s and he condi ions unde
which employees elapse om compliance o non-compliance wi h
ISPs and hei need o suppo o main ain hei compliance. Ou
s age heo y p esen s di e en ac o s o his s age-independen
o e iding cogni ion, de i ed om he empi ical da a (see
Table 1 ).
Thi d, we define he ela ions be ween di e en elemen s
and ela ed a ibu es in e ms o hei de elopmen al ajec o y
( an de Ven, 1992 ; Weins ein e al., 1998 ; Nolan, 1973 ). In defin-
ing his empo al cha ac e is ic, we iew he de elopmen o be-
ha io as p og essi e, which means ha beha io / easoning be-
comes mo e ad anced a la e s ages ( G een, 1989 ). Mo eo e , he
o ganiza ional ou ine change li e a u e o en assumes ha beha -
io al change p oceeds as a lea ning p ocess ( B esman, 2013 ). Ac-
co dingly, we a gue ha he de elopmen o in o ma ion secu i y
cogni ions is a p og essi e lea ning p ocess based on inc easing
con ex -specific in o ma ion secu i y unde s anding, o example,
ega ding in o ma ion secu i y isks and esponsibili ies. Thus, we
submi ha compliance wi h ISPs in la e s ages equi es mo e
knowledge o he ISPs and mo e cogni i ely ad anced easoning
in e ms o inc easing mo i a ion, eflec ion, and ou iniza ion. We
define he o de o in o ma ion secu i y cogni ions and change en-
hance s guided by he ou p og essi e s ages o beha io ( Gelle ,
2002 ), also called le els o compe ence ( Howell, 1982 ): uncon-
sciously incompe en , consciously incompe en , consciously com-
pe en , and unconsciously compe en (see Sec ion 5.2 ). Along wi h
p o-en i onmen beha io ( Gelle , 2002 ), he s ages o beha io
ha e been used in o he con ex s, e.g., o unde s anding he de-
elopmen o an indi idual’s consciousness and compe ence in e-
la ion o in e cul u al li e acy ( Heywa d, 2002 ), c oss-cul u al com-
munica ion ( Gudykuns , 1994 ), o ganiza ional success ( May and
K uge , 1988 ; Thompson, 1996 ), and ins i u ional change ( Ca nes
e al., 2012 ).

M. Ka jalainen, M. Siponen and S. Sa ke / Compu e s & Secu i y 93 (2020) 101782 5
Fig. 1. The s age heo y o he de elopmen o employees’ ISB.
In sum, he equi emen s o ou s age heo y include (1) he
con en o s ages based on he s age elemen s and hei s age-
specific a ibu es (i.e., in o ma ion secu i y cogni ions and change
enhance s); (2) he s age-independen elemen ha explain ISB in-
s abili y (i.e., o e iding cogni ions); and (3) he empo al o de o
s ages based on de elopmen al p og ession (i.e., p og essi e s ages
o beha io ). The cha ac e is ics a e used in e p e i ely as high-
le el p inciples guiding ou da a analysis and heo y de elopmen .
The pu pose o ou da a analysis is o empi ically illus a e he
meaning o in o ma ion secu i y cogni ions, change enhance s, and
o e iding cogni ions in he con ex o employees’ ISB (see ac o s
in Table 1 ), while he cha ac e is ic ega ding he empo al o de
is pu ely heo e ical in na u e.
5.2. Illus a ing he equi emen s o a s age heo y o he
de elopmen o employees’ ISB
As p esen ed abo e, s age heo y includes he de elopmen al
ajec o y o elemen s ha can be specified by a se o a ibu es
( Nolan, 1973 ). Fig. 1 p esen s he o e all idea o his pa e n in he
con ex o employees’ ISB.
In his con ex , elemen s include s age-specific in o ma ion
secu i y cogni ions (whi e solid squa es 1–4 in Fig. 1 ), s age-
independen o e iding cogni ions ( he dashed whi e squa e D
wi h he dashed a ow in Fig. 1 ), and change enhance s, which
p omo e beha io al change be ween he s ages (dashed a ows A–
C in Fig. 1 ). By in o ma ion secu i y cogni ions, we e e o he
easons explaining ISB as indi idual belie s and desi es ha gen-
e a e a specific ac ion ( Heds öm and Swedbe g, 1998 ). A se o
a ibu es ha speci y he cogni ion elemen includes in ui i e,
decla a i e, agency, and ou ine- ela ed cogni ions as well as s age-
independen o e iding cogni ions. In u n, by change enhance s,
we e e o ac i i ies and expe iences ha lead o change in in en-
ions, a i udes, o beha io —issues ha p omo e mo emen om
one s age o he nex ( P ochaska and Diclemen e, 1983 ; 1992 ). A
se o a ibu es ha specifies enhance s o change includes mo-
i a ion, eflec ion, and equency enhance s. Fig. 1 also p esen s
how each s age is ela ed o compliance and non-compliance wi h
ISPs (g ay squa es and ela ed solid a ows). Finally, Fig. 1 p esen s
he de elopmen o ISB as a cyclical p ocess because when a wo k
si ua ion o ci cums ances change (e.g., employees’ wo k asks o
an o ganiza ion’s in o ma ion secu i y policies), a new de elop-
men p ocess is needed o di ec he p e ailing in ui i e hink-
ing owa d new ou ine- ela ed hinking so as o co espond o
he equi emen s o con ex ual change (see dashed a ow be ween
s ages 4 and 1 in Fig. 1 ). Table 1 p o ides a summa y o he el-
emen s, a ibu es, and ac o s associa ed wi h each s age as well
as hei ela ion o compliance (C) and/o non-compliance (N) wi h
ISPs.
The ou s ages in he de elopmen o employees’ ISB will now
be elabo a ed on he basis o he in e iew na a i es and sup-
po ing li e a u e. In addi ion, ac o s ela ed o he s age a ibu es
(i.e., in o ma ion secu i y cogni ions, change enhance s, and o e -
iding cogni ions) will be illus a ed wi h in e iew quo a ions in
Appendix C and i alicized in he ex .
5.2.1. S age 1: in ui i e hinking s age
5.2.1.1. S age desc ip ion. Ou esul s indica e ha employees ha e
ce ain in ui i e in o ma ion secu i y– ela ed belie s, which as
“a mos undamen al ca ego y o cogni ion” ( Spe be , 1997 , 67),
a e ob ained h ough upb inging, educa ion, o p e ious expe-
iences. We ound ha such belie s a e some imes in con as
wi h o ganiza ions’ ISPs. The e o e, complian ISB—such as a oiding
email o sending c i ical in o ma ion o using s ong passwo ds—
o en does no in ui i ely make sense o employees. Conse-
quen ly, employees do no ecognize hei in o ma ion secu i y–
ela ed weakness and/o he ins umen al alue o new ISB, such
as he benefi s o choosing a s ong passwo d. Thus, employ-
ees in his s age a e unconsciously incompe en ( Gelle , 2002 ),
i.e., hei ISB is unconsciously incompa ible wi h hei o ganiza-
ion’s ISPs. Nex , we in oduce some ypical in ui i e cogni ions
ela ed o his p e-in en ional s age, which we e de i ed om
ou da a.
Seg ega ion means ha an in e iewee in ui i ely ela es e-
sponsibili y o ensu ing in o ma ion secu i y o o he pa ies, such
as in o ma ion echnology (IT) employees o echnologies, o has a
alse us in IT. Fo example, employees may expec ha in o ma-
ion secu i y is being aken ca e o by IT s a and, hence, may no
be awa e o hei in o ma ion secu i y– ela ed esponsibili ies. An
example o alse us in IT is ha employees may no unde s and
ha hei passwo ds a e o e ly simple and, hence, easy o b eak.
Fu he , because employees in he in ui i e hinking s age a e un-
amilia wi h he o ganiza ion’s o mal ISPs and con ex ual need,
hey can o e es ima e hei own in o ma ion secu i y knowledge
and abili ies, unde es ima e he significance o ISPs, o may no
see he need o imp o emen . These inabili ies—compe ence o e -
es ima ion, in o ma ion secu i y equi emen unde es ima ion, and in-
o ma ion secu i y con en men —ac as ypical cogni ions in he
6 M. Ka jalainen, M. Siponen and S. Sa ke / Compu e s & Secu i y 93 (2020) 101782
in ui i e hinking s age and hinde employees om seeing he
need o al e hei beha io . We hus in oduce mo i a ion en-
hance s, which a e e ec i e o c ea ing in o ma ion secu i y–
ela ed in en ions.
Change enhance s om S age 1 o S age 2: Mo i a ion enhance s
Fo employees in he in ui i e hinking s age, one o he chal-
lenges is o ini ia e mo i a ion o beha io al change. Fo his pu -
pose, social science has iden ified a ple ho a o en i onmen al con-
di ions and cogni i e s uc u es ha igge he conscious cogni-
i e p ocessing o in ui i e belie s (see Louis and Su on, 1991 ).
In he in o ma ion secu i y con ex , we ound expe iences and
condi ions ha can igge employees o ques ion hei in ui i e
non-complian ISB, which we e med in e nal, ex e nal, and o ga-
niza ional con ol– ela ed mo i a ion enhance s . Ou esul s show
ha he ini ia ion o in o ma ion secu i y cogni ions and beha -
io change a ely occu s spon aneously on accoun o in e nal mo-
i a ion enhance s, i.e., pe sonal in e es and ac i i y gea ed o-
wa d lea ning new ISPs. Ins ead, some imes, ISPs a e bo h in con-
as wi h employees’ in ui i e hinking (S age 1) and no in insi-
cally mo i a ing (i.e., inhe en ly sa is ac o y ac i i y, see Deci and
Ryan, 1987 ). Consequen ly, he ini ia ion o lea ning ypically e-
qui es ex e nal e en s o ac s o o ganiza ional con ol. Mo i a-
ion enhance s can change employees’ in o ma ion secu i y cog-
ni ions om in ui i e o decla a i e. This means ha hey enable
employees o ealize a disc epancy be ween hei cu en ISB and
ISP and, in some cases, mo i a e hem owa d compliance. Ex e nal
and con ol- ela ed mo i a ion enhance s in he in o ma ion secu-
i y con ex a e illus a ed nex .
The in e iews equen ly showed ha a ious ex e nal e en s
p opelled he employees’ owa d becoming awa e o he ISPs.
These mo i a ion enhance s included con on ing in o ma ion
secu i y– ela ed e en s, e.g., in news o social media ( media is-
ibili y ) and expe iencing an in o ma ion secu i y acciden di ec ly
h ough pe sonal expe ience o indi ec ly h ough he expe ience
o o he s. In addi ion, o ganiza ional con ol– ela ed mo i a ion
enhance s (i.e., managemen ’s ac s o con ol) included expe i-
encing an ISP as manda o y h ough managemen ’s o de s, mon-
i o ing, ewa ds , and sanc ions . We ound ha bo h ex e nal and
con ol- ela ed enhance s can mo i a e employees owa d bo h
changing hei cogni ions ( om in ui i e o decla a i e, see Sub-
Sec ion 5.2.2 ) and ac ual beha io al change.
Howe e , we ound ha e en i mo i a ion enhance s a e a ail-
able, employees can ail o change hei in ui i e cogni ions and
ISB. This is so i change enhance s (e.g., in o ma ion secu i y ac-
ciden s) a e no sufficien o elici ing causal easoning be ween
employees’ ISB and i s consequences (see Sub- Sec ion 5.2.2 ). Wi h-
ou e ec i e mo i a ion enhance s, employees con inue o hink
and beha e acco ding o hei exis ing in ui i e cogni ions ins ead
o de eloping new ones. Thus, a ecu en mo i a ion enhance is
needed o p omo ing beha io al change. Success ul mo i a ion en-
hance s mo e employees o he decla a i e hinking s age, which is
in oduced nex .
5.2.2. S age 2: decla a i e hinking s age
5.2.2.1. S age desc ip ion. Decla a i e cogni ions eme ge as a conse-
quence o success ul knowledge acquisi ion and communica ions
in ol ing mo i a ion enhance s. This means ha employees ha e
he abili y o e alua e he co ec ness o hei ISB based on a ac -
based unde s anding o he ISPs and hei ela ed consequences
( Kaise and Fuh e , 2003 ). Howe e , employees in his s age yp-
ically knowingly iola e ISPs; hus, hey a e consciously incom-
pe en ( Gelle , 2002 ). We ound ha his is because ac ually
g ounded in o ma ion alone is o en no a sufficien basis o com-
plian ISB, as i does no o e an unde s anding o he impo -
ance o ISPs in he specific o ganiza ional con ex and pe sonal
si ua ion. The e o e, ou s udy e eals in o ma ion secu i y conflic –
ela ed cogni ions ha explain non-compliance i posi i e conse-
quences o non-compliance (e.g., mo e efficien ly mee ing o he
compe ing wo k p io i ies) a e conside ed mo e impo an , imme-
dia e, o ce ain—wi h compliance being incon enien o inefficien
(see Gelle , 2002 ). Howe e , compliance wi h ISPs is s ill possible
i employees ha e de eloped he e onomous cogni ions , de e mined
by ex e nal o ces, wi hou he need o pe sonal wo k si ua ion-
specific in o ma ion secu i y jus ifica ions. We now look a he yp-
ical decla a i e cogni ions de i ed om ou da a.
As men ioned abo e, in his s age, in o ma ion secu i y cogni-
ions can be ei he he e onomous (explaining bo h compliance and
non-compliance) o in o ma ion secu i y conflic – ela ed (explain-
ing non-compliance) (see Table 1 ). Ou in e iews showed ha he
p esence o he e onomous decla a i e cogni ions means ha com-
pliance is dependen on issues ex insic o in o ma ion secu i y:
whe he employees expe ience an obliga ion o do so by an au-
ho i y figu e ( dependency on au ho i y ), whe he hey eel ha i
is impo an o ollow managemen as a ole model ( dependency
on ole model ), o whe he hey adjus hei beha io acco ding
o how hey hink o pe cei e he beha io o o he s ( social con-
o mi y ). Howe e , as men ioned ea lie , people in his s age o -
en knowingly iola e ISPs because mo i a ion enhance s alone a e
no always sufficien o ensu ing complian ISB. In o ma ion se-
cu i y conflic – ela ed decla a i e cogni ions mean ha employees
do no comply wi h ISPs because o o he expe iences ha o e -
ide hei exis ing mo i a ion o in o ma ion secu i y compliance:
alue conflic and incon enience. These cogni ions illus a e ha
employees a e unwilling o unde go addi ional lea ning and e o ,
o he sake o in o ma ion secu i y, wi hou a p o ound unde -
s anding o he impo ance o in o ma ion secu i y equi emen s
in a specific wo k con ex and wi hou ha ing ex e nally mo i a ed
he e onomous cogni ions.
Value conflic means ha e en i employees a e cognizan o
he in o ma ion secu i y equi emen s, how o comply wi h hem,
and why compliance is necessa y (i.e., in o ma ion secu i y al-
ues), a pe son may no see how compliance fi s in wi h hei own
wo k. Ins ead, his pe son may p e e o he wo k alues, which
could lead o non-compliance. Fo example, sales employees may
expe ience a con adic ion be ween in o ma ion secu i y equi e-
men s and p oduc i i y equi emen s ha explain non-compliance.
Mo eo e , employees o en conside he ex en o he incon enience
associa ed wi h ISPs, which some imes leads o non-compliance
wi h ISPs, ins ead o expending addi ional e o in o seeking and
lea ning sui able echnical in o ma ion and skills o ci cum en -
ing insecu e p ocedu es. Fo example, he in e iewees s a ed ha
email enc yp ion o passwo d p ac ices a e oo es ic i e, ime-
consuming, o difficul .
In sum, while in ui i e cogni ions a e ela ed only o non-
compliance (S age 1), decla a i e cogni ions (he e onomous and in-
o ma ion secu i y conflic – ela ed in S age 2) explain bo h non-
compliance and compliance wi h ISPs. Fu he , besides decla a i e
cogni ions, non-compliance in his s age can be explained h ough
o e iding cogni ions , which can s imula e complian employees o
iola e ISPs (common in s ages 2–4; see Sec ion 5.2.5 ). Indeed, we
ound ha wi hou con ex ual in o ma ion secu i y unde s and-
ing, and due o compe ing mo i a ions, employees may be insu -
ficien ly mo i a ed o main ain complian ISB. We also ound e i-
dence o how he absence o he e onomous cogni ions (e.g., man-
agemen ’s o de s and ole model) can p opel employees o aban-
don hei complian beha io . A g ea e pe sis ence o complian
beha io needs o be suppo ed h ough eflec ion enhance s, ad-
d essed below.
Change enhance s om S age 2 o S age 3: Reflec ion enhance s
One o he essen ial challenges in he decla a i e hinking
s age is o make employees eflec on hei ac -based knowl-
edge in o de o gene a e pe sonally meaning ul and ac i e ISB.
M. Ka jalainen, M. Siponen and S. Sa ke / Compu e s & Secu i y 93 (2020) 101782 7
Reflec ion e e s o he ac i e and delibe a i e cogni i e p ocess-
ing o he knowledge needed o each solu ions o p ac ical p ob-
lems ( Ha on and Smi h, 1995 ), such as non-compliance wi h ISPs.
In his ega d, ou in e iews e ealed se e al eflec ion enhance s ,
i.e., expe ien ial lea ning con en and collabo a i e lea ning me h-
ods (see Ka jalainen and Siponen, 2011 ). We ound ha eflec ion
enhance s can imp o e he unde s anding and ele ance o in o -
ma ion secu i y– ela ed communica ions, co ec employees’ alse
concep ions, and o e p ocedu es o dec ease an expe ienced in-
con enience wi h ISPs. Reflec ion enhance s can suppo employ-
ees’ ansi ion be ween he second and hi d s ages, i.e., o ma ion
o agency- ela ed cogni ions (see Sec ion 5.2.3 ) and compliance wi h
ISPs.
Expe ien ial lea ning con en , which was e ealed in ou in-
e iews, e e s o he possibili y o eflec ing on he meaning
o ISPs in e ms o he pe cep ions o he in o ma ion secu i y
h ea s and alues ha cha ac e ize a pe sonal si ua ion. Fo exam-
ple, while a unc ion o in o ma ion secu i y acciden s in he fi s
s age was o c ea e awa eness and mo i a ion owa d compliance,
a unc ion o in o ma ion secu i y acciden s, as pa o expe ien-
ial lea ning, is o unde s and and eflec on hei meaning in pe -
sonal si ua ions. While in e iewe s o en conside ed he alue o
ISPs om he iewpoin o confiden iali y, o he in o ma ion secu-
i y alues (e.g., in eg i y, a ailabili y) we e a ely ecognized and,
hus, need o be cla ified. Mo eo e , hei conc e e meaning needs
o be unde s ood om he iewpoin o di e en p o essional
alues. In addi ion, we ound ha collabo a i e lea ning me hods
(ins ead o one-way deli e y o in o ma ion secu i y knowledge)
a e enhance s ha can encou age employees o lea n and com-
mi hemsel es o in o ma ion secu i y. Examples include employ-
ees’ ac i e pa icipa ion in in o ma ion secu i y implemen a ion
(e.g., in o ma ion secu i y policy de elopmen ) and pe sonal in-
ol emen du ing in o ma ion secu i y aining h ough knowledge
sha ing.
Wi hou eflec ion enhance s, employees con inue o beha e
acco ding o hei exis ing cogni ions ins ead o de eloping new
ones. The e o e, ISB con inues o be highly dependen on he -
e onomous decla a i e cogni ions (i.e., dependency on au ho i y,
ole models, social con o mi y), s ongly influenced by in o ma-
ion secu i y conflic – ela ed decla a i e cogni ions (i.e., alue con-
flic , incon enience), and ulne able o he o e iding cogni ions
ha lead hem owa d non-compliance in ce ain ci cums ances
(see Sec ion 5.2.5 ). Success ul eflec ion enhance s mo e employ-
ees o he agency- ela ed hinking s age, which is in oduced
nex .
5.2.3. S age 3: agency- ela ed hinking s age
5.2.3.1. S age desc ip ion. Reflec ion enhance s enable he o ma-
ion o agency- ela ed cogni ions , indica ing ha employees a e con-
sciously compe en ( Gelle , 2002 ) in complying wi h ISPs. We sub-
mi ha , in his s age, in o ma ion secu i y cogni ions and be-
ha io ans o m om ex e nally di ec ed o sel -di ec ed ( Gelle ,
2002 ) based on knowledge on he e ec i eness ( Kaise and Fuh e ,
2003 ) and in e naliza ion ( O’Reilly and Cha man, 1986 ; Ryan e al.,
2008 ) o alues. This means ha complian ISB is based on in-
o ma ion secu i y-conscious easoning ela ed o employees’ sub-
jec i e es ima ions be ween pe sonal e o and in o ma ion secu-
i y benefi s as well as pe sonal alues and goals. Consequen ly,
we ound ha employee compliance is explained by agency cogni-
ions ha a e si ua ion-specific—namely, conside a ion o he ad-
an ages o p ocedu al compliance linked wi h he ex e nal en-
i onmen ( e alua ion o isks ), p o essional alues ( alue cong u-
ence ), and he e ec i eness o ISPs ( us in ISPs ). Agency cogni-
ions mean ha employees comply wi h ISPs because hey a e “ex-
pe ienced as ac ion o which one is esponsible” ( Deci and Ryan,
1987 , 1025) and no as a conflic be ween he ISPs and cogni ions
ega ding he e alua ion o isks, alue cong uence, and/o us
in ISPs.
The fi s agency cogni ion, he e alua ion o isks , means bal-
ancing in o ma ion secu i y h ea s wi h he alue o he in o ma-
ion in a specific wo k con ex . Besides being awa e o he alue
o p o ec (wo k- ela ed o pe sonal) in o ma ion, employees’ ISB
is s ongly a ached o hei concep ions o in o ma ion secu i y
h ea s in hei wo k en i onmen . Employees’ decisions o engage
in complian ISB a e consis en ly based on he obse a ion ha
h ea s could be ealized. Thus, compliance is based on he con-
scious si ua ion-specific decision de e mined by he inc eased isk-
p opensi y le el o an employee. Compliance also eme ges due o
us in ISPs . This means ha when he in e iewees belie e ha
he e is a significan (posi i e) consequence o using ce ain ISPs,
hey end o us hei efficiency and, consequen ly, comply wi h
hem. In addi ion, a sense o alue cong uence explains ISB in his
s age. This means ha employees’ compliance wi h ISPs depends
on hei unde s anding o how in o ma ion secu i y– ela ed al-
ues help hem implemen impo an p o essional alues. Fo ex-
ample, he in o ma ion secu i y alue o confiden iali y in e ms o
p o ec ing pe sonnel and sala y in o ma ion is s ongly connec ed
o human esou ces (HR) employees’ p o essional alues. In e es -
ingly, we ound alue cong uence o be ypically exp essed no
only as indi idual-le el cogni ion bu also a he g oup, depa -
men al, o e en o ganiza ional le el.
E en i employees in his s age comply wi h ISPs, as in he p e-
ious s ages, o e iding cogni ions (see Sec ion 5.2.5 ) can s imula e
complian employees owa d iola ing ISPs. Thus, a g ea e pe sis-
ence ega ding complian ISB needs o be suppo ed h ough e-
quency enhance s, he subjec o he nex sec ion.
Change enhance s om S age 3 o S age 4: F equency enhance s
A he agency- ela ed hinking s age, he goal is o make com-
plian ISB pa and pa cel o employees’ wo k ou ines, wi hou
addi ional cogni i e e o (i.e., si ua ion-specific conscious deci-
sions). Fo his pu pose, employees need equency enhance s ha
ein o ce agency- ela ed cogni ions h ough au onomy-suppo i e
eedback associa ed wi h he inc easing pe sis ence o beha io al
change ( Deci and Ryan, 1987 ) and inc easing au oma ici y o be-
ha io ( Gelle , 2002 ). F equency enhance s s eng hen he connec-
ion be ween complian ISB and he expec ed influence o mee -
ing beha io al goals ( Ouelle e and Wood, 1998 ). Wi hou his a -
fi ma ion o he co ec ness and e ec i eness o hei beha io al
choices, employee cogni ions a e no necessa ily s ong enough
o main ain complian beha io , and ins ead o becoming habi -
ual, compliance can dec ease o e ime ( Gelle , 2002 ). This means
ha due o he in angible na u e o in o ma ion secu i y h ea s
and he consequences o complian ISB ( Ka jalainen and Siponen,
2011 ), employees may be unable o ecognize he posi i e conse-
quences o ISP compliance wi hou ecei ing au onomy-suppo i e
eedback ( Gelle , 2002 ; Deci and Ryan, 1987 ) on complian
ISB.
We a gue ha au onomy-suppo i e eedback, which confi ms
employees’ compliance wi h ISPs, should inc ease he suscep ibil-
i y o in o ma ion secu i y isks, econcile beha io al efficiency,
and enhance alue connec i i y. As a esul o he expe ienced
inc ease in he suscep ibili y o in o ma ion secu i y isks, employ-
ees’ decision o comply wi h ISPs is no based on hei si ua ion-
specific es ima ion o he likelihood o in o ma ion secu i y isks;
ins ead, i is based on an emphasis o he po en ial in o ma ion
secu i y isks a ising om he neglec o ISPs. Th ough expe i-
enced econcilia ion wi h beha io al efficiency , complian ISB is s ill
conside ed aluable in mi iga ing in o ma ion secu i y isks, e en
i i is no expec ed o o e defini e p o ec ion o all occasions
and ha in o ma ion secu i y b eaches can occu in a clima e o
compliance. The expe ience o enhancing alue connec i i y can be
achie ed by suppo ing employees’ awa eness o hei p o essional
8 M. Ka jalainen, M. Siponen and S. Sa ke / Compu e s & Secu i y 93 (2020) 101782
and in o ma ion secu i y alues and he connec ions be ween
hem.
Wi hou equency enhance s, compliance wi h ISPs is achie -
able h ough conscious and si ua ion-specific decision-making, bu
i is also ulne able o o e iding cogni ions (see Sec ion 5.2.5 ). In-
o ma ion secu i y communica ion ha con inuously u ilizes hese
equency enhance s mo es employees o he final ou ine- ela ed
hinking s age, which is in oduced below.
5.2.4. S age 4: ou ine- ela ed hinking
5.2.4.1. S age desc ip ion. In he final s age o he de elopmen p o-
cess, employees comply wi h ISPs on ela i ely s able g ound. The
ou ine- ela ed in o ma ion secu i y cogni ions cha ac e izing his
s age sugges ha as a esul o equency enhance s, employ-
ees comply wi h ISPs wi h low cogni i e e o , i.e., hey become
unconsciously compe en in complying wi h ISPs ( Gelle , 2002 ).
Rou ine- ela ed cogni ions, as an ou come o a de elopmen p o-
cess, indica e ha ISPs ha e become aken- o -g an ed in ce ain
social con ex s ( Tos , 2011 ) ha a e mo e p oac i e and indepen-
den o en i onmen al eedback and ein o cemen . In addi ion,
employees’ beha io in his s age is no as s ongly dependen on
o e iding cogni ions as in he ea lie s ages. A fi s glance, he
fi s and final s ages o he s age heo y may seem almos iden i-
cal. Howe e , in o de o each he ou ine- ela ed cogni ions s age,
a lea ning p ocess is always needed o o m complian ISB. Du -
ing he p ocess o adop ing new ISPs, employees’ o m new hink-
ing and ISB ha a e alid in specific wo k si ua ions o ci cum-
s ances. Ne e heless, i is possible ha employees’ complian ISB
is lea ned in a di e en con ex and can mee he ISPs o he cu -
en o ganiza ional con ex . Fu he , o some people, awa eness o
he ISP is enough o make hem complian (depending on hei in-
o ma ion secu i y cogni ions), which can become ou inized o e
ime.
5.2.5. S age-independen o e iding cogni ions
As no ed ea lie , complian beha io can u n in o non-
compliance wi h ISPs due o s age-independen o e iding cogni-
ions. O e iding cogni ions e e o expe ienced con ex ual and
si ua ional influences o cons ain s ha may dec ease he influ-
ence o he s age-specific cogni ions ha explain compliance wi h
ISPs ( Kaise and Fuh e , 2003 ; Ha e, 1963 ). Recognizing hese cog-
ni ions is impo an , ega dless o an employee’s s age in he de-
elopmen p ocess. Wi h espec o he s age heo y cha ac e is-
ics, he o e iding cogni ions explaining he ins abili y o ISB poin
o he ci cums ances ega ding he possibili y o abandoning ce -
ain beha io al pa e ns.
Fi s , he wo king en i onmen as an o e iding cogni ion means
ha employees ecognize po en ial h ea s bu do no seem o eal-
ize hei possibili y because hey ha e high us in he company’s
echnical in o ma ion secu i y solu ions o o he people in he
wo king en i onmen . Fo example, while some employees usually
lock compu e s, hey may no do so in hei own office, as his
migh be deemed unnecessa y in his en i onmen .
The second o e iding cogni ion is he need o ake a sho cu ,
which e e s o si ua ions in which one is being lazy, hu ied, o
s essed. Fo example, a compu e is usually locked, bu no in si -
ua ions when i is le a ended o a sho pe iod o ime o o
sudden in e up ions.
Acco ding o he in e iewees, ISPs a e usually complied wi h,
excep in si ua ions whe e a pe son eels social p essu e , which
can be in e nal (e.g., a oiding nega i e eelings) o ex e nal (e.g.,
expe iencing ea ). An example o in e nal social p essu e is ha
employees may e eal sensi i e in o ma ion because hey wan o
help o he s o main ain good wo king ela ionships; hey migh
no ask o see employee badges o migh no lock hei compu -
e s because hey eel emba assed o ac in his way. An exam-
ple o ex e nal social p essu e is an employee e ealing sensi i e
in o ma ion, ei he pe sonally o h ough email, because hey eel
h ea ened.
Finally, oppo unism means ha ISPs a e complied wi h, excep
i a pe son has a mo i a ion o in en ional abuse in he sense o
gaining pe sonal benefi (e.g., mone a y benefi , ulfilled cu iosi y)
o causing ha m o he company.
E en i he o e iding cogni ions can po en ially influence em-
ployees’ complian ISB in s ages 2–4, i is assumed ha in he las
s age o he p ocess, employees’ ISB is no as s ongly dependen
on hese o e iding cogni ions as in o he s ages. This is so be-
cause in he las s age, ISB equi es less conscious e o , and hus,
he cogni i e load equi ed o ISB is lowe . As an excep ion, his
end is no alid in cases whe e an employee makes a conscious
decision o cause ha m o he company by iola ing ISPs and o e -
iding he e ec s o social p essu e o oppo unism.
6. Discussion
6.1. Con ibu ions
Ou s udy aimed a finding ou how o explain a change o em-
ployees’ easons o hei ISB o e ime and ac oss di e en si u-
a ions. Ou esul s con ibu e o in o ma ion secu i y esea ch by
in oducing a new heo e ical pe spec i e ha indica es ha em-
ployees’ compliance wi h ISPs can be s udied as a sequence o
ideal and heo e ical s ages ha lead o ou iniza ion o e ime.
This is di e en om much o he exis ing beha io al in o ma-
ion secu i y esea ch, which examines he phenomenon h ough
non-s age models. To gi e an example, p e ious in o ma ion se-
cu i y s udies sugges ha habi , as an unconscious o au oma ic
beha io , explains in o ma ion secu i y policy compliance ( Pahnila
e al., 2007 ; Vance e al., 2012 ). These s udies, howe e , do no
explain how he habi de elops. We y o cap u e he change
h ough s ages. Specifically, ou s udy p oposes ou s ages ha di -
e in e ms o cogni ions in explaining ISB. The fi s s age is cha -
ac e ized by in ui i e cogni ions, which esul in non-compliance
wi h ISPs. The second s age is cha ac e ized by decla a i e cogni-
ions, including he e onomous and in o ma ion secu i y conflic –
ela ed cogni ions ha esul in bo h non-compliance and compli-
ance. The hi d s age is cha ac e ized by agency- ela ed cogni ions,
while he ou h s age is cha ac e ized by ou ine- ela ed in o ma-
ion secu i y cogni ions, bo h esul ing in compliance wi h ISPs.
The majo i y o he indi idual cogni ions iden ified in ou s udy
can be ela ed o he a iables iden ified in p e ious s udies (see
Appendix E). Fo example, he a iables in he heo y o planned
beha io (e.g., subjec i e no ms and con ol belie s) a e concep u-
ally ela ed o decla a i e cogni ions in S age 2. Howe e , no ex-
is ing s udy has quali a i ely sepa a ed he di e en s ages o he
pu pose o explaining he de elopmen o employees’ ISB- ela ed
cogni ions. To u he cla i y his di e ence, le us look close a
Myy y e al. (2009) , who ound ha only lowe le els o mo al
easoning (a oiding punishmen and gaining pe sonal benefi ) ex-
plain compliance wi h he ISP. Fu he , hey conclude ha o he
pe sonal in e es s a e p io i ized o e ISP compliance. In e es ingly,
a posi i e ela ionship was no ound be ween highe -le el mo al
p inciples (e.g., social and p o essional oles) and ISP compliance.
Al hough concep ualized h ough s ages, ou s udy’s pe spec i e is
no ocused on mo al de elopmen ; i ocuses on heo ies o ypes
o knowledge and beha io . Howe e , hei findings a e simila o
ou s in e ms o he e onomous cogni ions de e mined by ex e -
nal o ces, wi hou he need o pe sonal wo k si ua ion–specific
in o ma ion secu i y jus ifica ions (e.g., dependency on au ho i y),
and in o ma ion secu i y conflic – ela ed cogni ions ha p io i-
ize posi i e consequences o non-compliance (e.g., mo e efficien ly
M. Ka jalainen, M. Siponen and S. Sa ke / Compu e s & Secu i y 93 (2020) 101782 15
Table 5
P e ious s udies’ heo y-based concep s compa ed wi h s age heo y ac o s.
In o ma ion secu i y cogni ions and enhance s o change a each s age Exis ing esea ch ha suppo s in o ma ion secu i y cogni ions and enhance s o
change a each s age
S age 1. in ui i e hinking
a. In ui i e cogni ions
Seg ega ion –
Compe ence o e es ima ion and in o ma ion secu i y equi emen
unde es ima ion
–
In o ma ion secu i y con en men –
b. Enhance s o change be ween s ages 1–2: Mo i a ion enhance s –
In e nal: Pe sonal in e es and ac i i y – Technology awa eness (Dine e al. 2009; Dine and Hu 2007 )
–Compu e and in e ne expe ience ( Rhee e al., 2009 )
–Compu e sel -efficacy and apa hy ( Boss e al., 2009 )
Ex e nal: Media isibili y –
Ex e nal: Di ec and indi ec in o ma ion secu i y acciden s – Secu i y b each inciden s lowe sel -efficacy ( Rhee e al., 2009 )
O ganiza ional con ol– ela ed: Manda o y na u e o in o ma ion
secu i y p ocedu es
– Manda o iness ( Boss e al., 2009 )
O ganiza ional con ol– ela ed: Moni o ing – Compu e moni o ing ( D’A cy e al. 2008 )
– De ec ion ce ain y ( He a h and Rao 2009a ;He a h and Rao 2009b )
– De ec ion p obabili y ( Li e al., 2010 )
– Ce ain y o con ol ( Chen e al., 2013 )
– Beha io al con ol ( Cox, 2012 ;Hu e al., 2012 )
– E alua ion o compliance ( Boss e al., 2009 )
O ganiza ional con ol– ela ed: Sanc ions – Sanc ions as a cos o non-compliance ( Bulgu cu e al., 2010a )
–Pe cei ed se e i y o sanc ions ( D’A cy e al. 2008 )
– The e ec o sanc ion se e i y is condi ioned on pe sonal no ms ( Li e al., 2010 )
– Fea o punishmen s (p econ en ional mo al easoning) ( Myy y e al., 2009 )
–Punishmen s (
Chen e al., 2013 )
– Sanc ion ce ain y, sanc ion se e i y ( Sa a e al., 2019 )
O ganiza ional con ol– ela ed: Rewa ds – Rewa ds as a benefi o compliance ( Bulgu cu e al., 2010a )
–Rewa ds( Chen e al., 2013 )
S age 2. decla a i e hinking
a. Decla a i e cogni ions:
He e onomous: Dependency on au ho i y –
He e onomous: Dependency on ole model – Managemen pa icipa ion ( Hu e al., 2012 )
He e onomous: Social
con o mi y –No ma i e belie s ( Bulgu cu e al., 2010a ; He a h and Rao 2009b ; Pahnila e al.,
2007 : Siponen e al., 2006 )
–Co-wo ke socializa ion ( Chan e al., 2005 )
– Subjec i e no m ( Dine e al., 2009 ; He a h and Rao 2009a ; Cox, 2012 ; Hu e al.,
2012 ; Sa a e al., 2019 )
–Desc ip i e no m ( He a h and Rao 2009a )
– Pee beha io ( He a h and Rao 2009b )
–Social influence ( Johns on and Wa ken in 2010 )
–Wo kg oup no m ( Guo e al., 2011 )
In o ma ion secu i y conflic – ela ed: Value conflic –Denial o esponsibili y ( Ha ing on 1996
)
–Value conflic s be ween IS secu i y alues and heal h ca e alues ( Heds öm
e al., 2011 )
In o ma ion secu i y conflic – ela ed: Incon enience –Wo k impedimen as a cos o compliance ( Bulgu cu e al., 2010a )
– Sel -efficacy ( Chan e al., 2005 ; Bulgu cu e al., 2010a ; He a h and Rao 2009a ;
Johns on and Wa ken in 2010 ; Ng e al., 2009 ; Siponen e al., 2007 ; Siponen
e al., 2006 ; Cox, 2012 ; Vance e al., 2012 ; Rhee e al., 2009 )
–Pe cei ed use ulness and ease o use, Con ollabili y, Pe cei ed beha io al con ol
( Dine and Hu 2007 )
– Response
cos s ( He a h and Rao 2009a ; Vance e al., 2012 )
– Usabili y issues ( Sasse e al., 2001 )
b. Enhance s o change be ween s ages 2–3: Reflec ion enhance s:
Expe ien ial lea ning con en –
Collabo a i e lea ning me hods – O ganiza ional in ol emen ( Lee e al., 2004 )
– In ol emen : ene gy, ime and e o ( Sa a
e al., 2018 )
– In ol emen : knowledge sha ing, collabo a ion, in e en ion and expe ience ( Sa a
e al., 2016 )
STAGE 3. AGENCY-RELATED THINKING
a. Agency cogni ions:
T us in in o ma ion secu i y p ocedu es – Sa e y o esou ces as a benefi o compliance ( Bulgu cu 2010a )
– Response efficacy ( He a h and Rao 2009a ; Johns on and Wa ken in 2010 ; Siponen
e al., 2007 ; Siponen e al., 2006 ; Vance e al., 2012 )
–Pe cei ed e ec i eness ( He a h and Rao 2009b )
–Pe cei ed benefi s ( Ng e al., 2009 )
– Gene al con ollabili y o IS secu i y h ea s ( Rhee e al., 2009 )
E alua ion o isks –Vulne abili y o esou ces as a cos o non-compliance ( Bulgu cu e al.,
2010a )
– Secu i y b each conce n le el ( He a h and Rao 2009a )
–Pe cei ed h ea se e i y ( Johns on and Wa ken in 2010 )
–Pe cei ed secu i y isks ( Li e al., 2010 ; Guo e al., 2011 )
–Pe cei ed suscep ibili y and se e i y o secu i y inciden s ( Ng e al., 2009 )
– Th ea app aisal ( Pahnila e al., 2007 ;Siponen e al., 2007 ;Siponen e al., 2006 ;
Vance e al., 2012 )
–Pe cei ed ulne abili y ( Cox, 2012 )
( con inued on nex page )

16 M. Ka jalainen, M. Siponen and S. Sa ke / Compu e s & Secu i y 93 (2020) 101782
Table 5 ( con inued )
In o ma ion secu i y cogni ions and enhance s o change a each s age Exis ing esea ch ha suppo s in o ma ion secu i y cogni ions and enhance s o
change a each s age
Value cong uence – In insic benefi s as a benefi o compliance ( Bulgu cu e al., 2010a )
– O ganiza ional commi men ( He a h and Rao 2009 )
–Rela i e ad an age o job pe o mance ( Guo e al., 2011 )
–Pe cei ed iden i y ma ch ( Guo e al., 2011 )
–Pe cei ed alue cong uence ( Son 2011 )
– Commi men ( Sa a e al., 2016 ; 2018 )
–Pe sonal no ms ( Sa a e al., 2016 ; 2018 )
b. Enhance s o change be ween s ages 3–4: F equency enhance s
Inc easing suscep ibili y o in o ma ion secu i y isks –
Reconciling beha io al efficiency –
Enhancing alue connec i i y –
STAGE 4. ROUTINE-RELATED THINKING
a. Rou ine- ela ed cogni ions
Agency cogni ions explaining ISB wi h low cogni i e e o –Habi s ( Pahnila e al., 2007 ; Vance e al., 2012 )
Common cogni ions o S ages 1–4: O e iding Cogni ions
Oppo unism – A i ude in e ms o wo k e hics ( Dine and Hu 2007 )
–No ms ela ed wi h law compliance ( Lee e al., 2004 )
–Pe cei ed benefi s,
pe sonal no ms ( Li e al., 2010 )
– Lack o a ibu ed us explain compu e abuse ( Posey e al., 2011 )
–Pe cei ed legi imacy o ISPs ( Son 2011 )
–Posi i e a i ude owa ds IS secu i y beha io ( Bulgu cy e al., 2010a ; Cox, 2012 ;
Hu e al., 2012 ; Pahnila e al., 2007 )
–Si ua ional c ime p e en ion ( Sa a e al., 2018 ; Sa a e al., 2019 )
Social P essu e – In insic cos s as a cos o noncompliance ( Bu gu cu e al. 2010a )
Wo king En i onmen –
Sho cu s –
CRediT au ho ship con ibu ion s a emen
Ma i Ka jalainen: Concep ualiza ion, Me hodology, In es iga-
ion, Resou ces, Da a cu a ion, W i ing - o iginal d a , W i ing
- e iew & edi ing, P ojec adminis a ion, Funding acquisi ion.
Mikko Siponen: Me hodology, In es iga ion, Resou ces, Da a cu-
a ion, W i ing - o iginal d a , W i ing - e iew & edi ing, Vi-
sualiza ion, Supe ision, P ojec adminis a ion, Funding acquisi-
ion. Sup a eek Sa ke : Me hodology, Resou ces, W i ing - o iginal
d a , W i ing - e iew & edi ing, Visualiza ion, Supe ision, P ojec
adminis a ion, Funding acquisi ion.
Re e ences
Adams, A. , Sasse, M.A. , 1999. Use s a e no he enemy. Commun. ACM 42 (12),
40–46 .
Alb ech sen, E. , 2007. A quali a i e s udy o use ’s iew on in o ma ion secu i y.
Comp. Secu . 26 (4), 276–289 .
Alb ech sen, E. , Ho den, J. , 2010. Imp o ing in o ma ion secu i y awa eness and
beha io h ough dialogue, pa icipa ion and collec i e eflec ion. In e . S udy.
Comp. Secu . 29, 432–445 .
Alohali, M. , Cla ke, N. , Li, F. , Fu nell, S. , 2018. Iden i ying and p edic ing he ac o s
a ec ing end-use s’ isk- aking beha io . In . Comp. Secu . 26 (3), 306–326 .
Bo ena, B. & Bélange , F. (2013) Religiosi y and in o ma ion
secu i y policy compli-
ance. P oceedings o he Nine een h Ame icas Con e ence on In o ma ion Sys-
ems, Chicago, Illinois, Augus 15-17, 1–8.
Boss, S.R. , Galle a, D.F. , Low y, P.B. , Moody, G. , Polak, P. , 2015. Wha do sys ems
use s ha e o ea ? Using ea appeals o engende h ea s and ea ha mo i-
a e p o ec i e secu i y beha io s. MIS Q. 39 (4), 837–864 .
Boss, S.R. , Ki sch, L.J. , Ange meie , I. , Shingle , R.A. , Boss, W. , 2009. I someone is
wa ching, I’ll do wha I’m asked: manda o iness, con ol, and in o ma ion secu-
i y. Eu . J. In . Sys . 18, 151–164 .
B esman,
H. , 2013. Changing ou ines: a p ocess model o ica ious g oup lea ning
in pha maceu ical R&D. Acad. Manag. J. 56 (1), 35–61 .
Bulgu cu, B. , Ca usoglu, H. , Benbasa , I. , 2010a. In o ma ion secu i y policy compli-
ance: an empi ical s udy o a ionali y-based belie s and in o ma ion secu i y
awa eness. MIS Q. 34 (3), 523–548 .
Bulgu cy, B., Ca usoglu, H. & Benbasa , I. (2010b) Quali y and ai ness o an in o -
ma ion secu i y policy as an eceden s o employees’ secu i y engagemen in he
wo kplace: an empi ical in es iga ion. P oceedings o he 43 d Hawaii In e na-
ional Con e ence on Sys em Sciences.
Bu on-Jones, A. , McLean, E.R. , Monod, E.
, 2015. Theo e ical pe spec i es in IS e-
sea ch: om a iance and p ocess o concep ual la i ude and concep ual fi . Eu .
J. In . Sys . 24 (6), 664–679 .
Ca nes, M. , De ine, P.G. , Isaac, C. , Manwell, L.B. , Fo d, C.E. , Bya s-Wins on, A. , Fine, E. ,
She ida, J.T. , 2012. P omo ing ins i u ional change h ough bias li e acy. J Di e s
High Educ 5 (2), 63–77 .
Chan, M. , Woon, I. , Kankanhalli, A. , 2005. Pe cep ions o in o ma ion secu i y in he
wo kplace: linking in o ma ion secu i y clima e o complian beha io . J. In .
P i acy. Secu . 1 (3), 18–41 .
Chen, Y. , Ramamu hy, K.R. , Wen, K.-.W. , 2013. O ganiza ions’ in o ma ion
secu i y policy compliance: s ick o ca o app oach. J. Manag. In . Sys . 29 (3),
157–188 .
Cox, J. , 2012. In o ma ion sys ems use secu i y: a s uc u ed model o he know-
ing-doing gap. Compu . Hum. Beha . 28, 1849–1858 .
D’A cy, J. , G eene, G. , 2014. Secu i y cul u e and he employmen ela ionship as
d i e s o employees’ secu i y compliance. In . Manag. Comp. Secu . 22 (5),
474–489 232 .
D’A cy, J. & G eene, G. (2009) The mul i ace ed na u e o secu i y cul u e and i s in-
fluence on end use beha io . IFIP TC 8 In e na ional Wo kshop On In o ma ion
Sys ems Secu i y Resea ch, Cape Town Sou h A ica, May 29–30.
D’A cy, J. , He a h, T. , 2011. A e iew and analysis o de e ence heo y in he IS se-
cu i y li e a u e: making sense o he dispa a e findings. Eu . J. In . Sys . 20 (6),
643–658 .
D’A cy, J. , Ho a , A. , 2007. De e ing in e nal in o ma ion sys ems misuse. Commun.
ACM 50 (10), 113–117 .
D’A cy, J. , Ho a , A. , Galle a, D.F. , 2008. Use awa eness o secu i y coun e measu es
and i s impac on in o ma ion sys ems misuse: a de e ence app oach. In . Sys .
Res. 20 (1), 79–98 .
Deci, E.L. , Ryan, R.M. , 1987. The suppo o au onomy and he con ol o beha io . J.
Pe s. Soc. Psychol. 53 (6), 1024–1037 .
Dine , T. , Goo, J. , Hu, Q. , Nam, K. , 2009. Use beha iou owa ds p o ec i e in o -
ma ion echnologies: he ole o na ional cul u al di e ences. In . Sys . J. 19,
391–412 .
Dine , T. , Hu, Q. , 2007. The cen ali y o awa eness in he o ma ion o use beha -
io al
in en ion owa d p o ec i e in o ma ion echnologies. J. Assoc. In . Sys . 8
(7), 386–408 .
Feye abend, P. , 1975. Agains me hod. Ou line o an Ana chis ic Theo y o Knowl-
edge. New Le Books, London .
Fo h, M. , 2016. Fac o s influencing he in en ion o comply wi h da a p o ec ion eg-
ula ions in hospi als: based on gende di e ences in beha iou and de e ence.
Eu . J. In . Sys . 25, 91–109 .
Fu nell, S.M., Alo aibi, F., & Esmael, R. (2019) Aligning secu i y p ac ice wi h policy:
guiding and nudging owa ds be e beha io . P oceedings o he 52nd Hawaii
In e na ional Con e ence on Sys em Sciences (HICSS), 5618–5627.
Fu nell, S. , Moo e, L. ,
2014. Secu i y li e acy: he missing link in oday’s online soci-
e y? Comp. F aud. Secu . 5, 12–18 .
Gudykuns , W.B. , 1994. B idging di e ences. E ec i e In e g oup Communica ion.
Sage, London .
Guo, K.H. , Yuan, Y. , A che , N.P. , Connelly, C.E. , 2011. Unde s anding non-malicious
secu i y iola ions in he wo kplace: a composi e beha io model. J. Manag. In .
Sys . 28 (2), 203–236 .
Gelle , E.S. , 2002. The challenge o inc easing p o-en i onmen beha io . In: Bech-
el, R.B., Chu chman, A. (Eds.), Handbook o En i onmen al Psychology. Wiley,
New Yo k, pp. 525–540 .
G een, M. , 1989 .
Ha e, R.M. , 1963. F eedom and Reason. Ox o d
Uni e si y P ess, Ox o d, UK .
M. Ka jalainen, M. Siponen and S. Sa ke / Compu e s & Secu i y 93 (2020) 101782 17
Ha ing on, S.J. , 1996. The e ec o codes o e hics and pe sonal denial o
esponsibili y on compu e abuse judgmen s and in en ions. MIS Q. 20 (3),
257–278 .
Ha on, N. , Smi h, D. , 1995. Reflec ion in eache educa ion: owa ds defini ion and
implemen a ion. Teach. Teach. Educ. 11 (1), 33–49 .
Heds öm, K. , Kolkowska, E. , Ka lsson, F. , Allen, J.P. , 2011. Value conflic s o in o -
ma ion secu i y managemen . J. S a eg. In . Sys . 20, 373–384 .
Heds öm, P. , Swedbe g, R. , 1998. Social mechanisms: an in oduc o y essay. In:
Heds öm, P., Swedbe g, R. (Eds.), Social mechanisms. An analy ical App oach
o Social
Theo y. Camb idge Uni e si y P ess, New Yo k, Camb idge UK .
He a h, T. , Rao, H.R. , 2009a. P o ec ion mo i a ion and de e ence: a
amewo k o secu i y policy compliance in o ganiza ions. Eu . J. In . Sys .
18 (2), 106–125 .
He a h, T. , Rao, H.R. , 2009b. Encou aging in o ma ion secu i y beha io s in o gani-
za ions: ole o penal ies, p essu es, and pe cei ed e ec i eness. Decis. Suppo
Sys . 47, 154–165 .
Heywa d, M. , 2002. F om in e na ional o in e cul u al. Redefining he in e na ional
school o a globalized wo ld. J. Res. In . Educ. 1 (1), 9–32 .
Ho a , A. , D’A cy, J. , 2012. Applying an ex ended model o de e ence ac oss
cul-
u es: an in es iga ion o in o ma ion sys ems misuse in he U.S. and Sou h Ko-
ea. In . Manag. 49, 99–101 .
Howell, W.S. , 1982. The Empa hic Communica o . Wadswo h Publishing Company,
Uni e si y o Minneso a .
Hsieh, H.-.F. , Shannon, S.E. , 2005. Th ee app oaches o quali a i e con en analysis.
Qual. Heal h Res. 15 (9), 1277–1288 .
Hu, Q. , Dine , T. , Ha , P. , Cooke, D. , 2012. Managing employee compliance wi h in-
o ma ion secu i y policies: he c i ical ole o op managemen and o ganiza-
ional cul u e. Dec. Sci. 43 (4), 615–659 .
Ifinedo, P. , 2014. In o ma ion sys ems secu i y policy compliance: an
empi ical s udy
o he e ec s o socialisa ion, influence, and cogni ion. In . Manag. 51, 69–79 .
Ifinedo, P. , 2012. Unde s anding in o ma ion sys ems secu i y policy compliance: an
in eg a ion o he heo y o planned beha io and he p o ec ion mo i a ion
heo y. Comp. Secu . 31 (1), 83–95 .
Johns, G. , 2006. The essen ial impac o con ex on o ganiza ional beha io . Acad.
Manag. Re . 31 (2), 386–408 .
Johns on, A.C. , Wa ken in, M. , 2010. Fea appeals and in o ma ion secu i y beha -
io s: an empi ical s udy. MIS Q. 34 (3), 549–566 .
Johns on, A.C. , Wa ken in, M. , Siponen, M. , 2015. An enhanced ea appeal he o ical
amewo k: le e aging h ea s o he human asse h ough sanc ioning he o ic.
MIS Q. 39 (1), 113–134 .
Kaise , F.G. , Fuh e , U. , 2003. Ecological beha io ’s dependency on di e en o ms o
knowledge. Appl. Psychol. 52 (4), 598–613 .
Ka jalainen, M. , Siponen, M. , Puhakainen, P. , Sa ke , S. , 2013. One Size Does No Fi
All: Di e en Cul u es Requi e Di e en In o ma ion Sys ems Secu i y In e en-
ions. Pasific Asia Con e ence o In o ma ion Sys ems, Jeju Island, Ko ea .
Ka jalainen, M. , Siponen, M. , 2011. Towa d a new me a- heo y o designing in-
o ma ion sys ems (IS) secu i y aining app oaches. J. Assoc. In . Sys . 12 (8),
518–555 .
Ka jalainen, Ma i , Siponen, Mikko , Sa ke , Sup a eek , e al. , 2019. Towa ds a The-
o y o In o ma ion Sys ems secu i y Beha io s o O ganiza ional Employees: A
dialec ical Pe spec i e. In . Sys . Res. 30 (2), 687–704 .
Klein, H.K. , Mye s, M.D. , 1999. A se o p inciples o conduc ing and e alua ing in-
e p e i e field s udies in in o ma ion sys ems. MIS Q. 23 (1), 67–93 .
Kohlbe g, L. , 1981. Essays on mo al de elopmen . Vol. I: The Philosophy o Mo al
De elopmen . Ha pe & Row, San F ancisco, CA .
Kolkowska, E. , Dhillon, G. , 2013. O ganiza ional powe and in o ma ion secu i y ule
compliance. Comp. Secu . Spec. Issue 33, 3–11 .
K uge , H.A. , Kea ney, W.D. ,2006. A p o o ype o assessing in o ma ion secu i y
awa eness. Comp. Secu . 25 (4), 289–296 .
Küble -Ross, E. , Kessle , D. , 2006. On G ie and g ie ing: Finding he Meaning o
G ie Th ough he Fi e S ages o Loss. Sc ibne , New Yo k .
Lee, A.S. , 1991. In eg a ing posi i is and in e p e i e app oaches o o ganiza ional
esea ch. O gan. Sci. 2 (4), 342–365 .
Lee, S.M. , Lee, S.G. , Yoo, S. , 2004. An in eg a i e model o compu e abuse based on
social con ol and gene al de e ence heo ies. In . Manag. 41 (6), 707–718 .
Li, H. , Zhang, J. , Sa a hy, R. , 2010. Unde s anding compliance wi h in e ne use policy
om he pe spec i e o a ional choice heo y. Decis. Suppo Sys . 48, 635–645 .
Li, H. Zhang, J. & Sa a hy, R. (2009) Unde s anding he compliance wi h he in e ne
use policy om a c iminology pe spec i e. P oceedings o he Fi een h Ame -
icas Con e ence on In o ma ion Sys ems, San F ancisco, Cali o nia Augus 6 h-
9 h. Pape 418, 1–8.
Louis, M.R. , Su on, R.I. , 1991. Swi ching cogni i e gea s: om habi s o mind o ac-
i e hinking. Hum. Rela . 44 (1), 55–76 .
Low y, P.B. , Moody, G. , 2015. P oposing he con ol- eac ance compliance model
(CRCM) o explain opposing mo i a ions o comply wi h o ganisa ional in o -
ma ion secu i y policies. In . Sys . J. 25, 433–463 .
May, G.D. , K uge , M.J. , 1988. The manage wi hin. Pe son. J. 67 (2), 56–65 .
Moh , L.B. , 1982. Explaining O ganiza ional Beha io . Jossey-Bass, San F ancisco .
Myy y, L. , Siponen, M. , Pahnila, S. , Va iainen, T. , Vance, A. , 2009. Wha le els o
mo al easoning and alues explain adhe ence o in o ma ion secu i y ules?
An empi ical s udy. Eu . J. In . Sys . 18, 126–139 .
Ng, B. , Kankanhalli, A. , Xu, Y. , 2009. S udying use s’ compu e
secu i y beha io : a
heal h belie pe spec i e. Decis. Suppo Sys . 46, 815–825 .
Nolan, R. , 1973. Managing he compu e esou ce: a s age hypo hesis. Commun.
ACM 16 (4), 399–405 .
O’Reilly, C. , Cha man, J. , 1986. O ganiza ional commi men and psychological a ach-
men : he e ec s o compliance, iden ifica ion, and in e naliza ion on p osocial
beha io . J. Appl. Psychol. 71 (3), 4 92–4 99 .
Ouelle e, J.A. , Wood, W. , 1998. Habi and in en ion in e e yday li e: he mul iple
p ocesses by which pas beha io p edic s u u e beha io . Psychol. Bull. 124
(1), 54–74 .
Pahnila, S., Siponen, M. & Mahmood, A. (2007) Employees’ beha io owa ds IS se-
cu i y policy compliance. P oceedings o he 40 h Annual Hawaii In e na ional
Con e ence On Sys em Sciences (HICSS’07), 156b-156b.
Pa on, M.Q. (1990) Quali a i e e alua ion and esea ch me hods. Sage: Newbu y
Pa k CA.
Ponemon Ins i u e (2014a) 2014: a yea o megab eaches. Sponso ed
by Iden i y Finde . A ailable: h p://www.iden i yfinde .com/us/Files/
2014TheYea O TheMegaB each.pd .
Ponemon Ins i u e (2014b) 2014 Cos o da a b each s udy: global analy-
sis. Benchma k esea ch sponso ed by IBM. A ailable: h p://www-01.
ibm.com/common/ssi/cgi-bin/ssialias?sub ype=WH&in o ype=SA&appname=
GTSE _ SE _ SE _ USEN&h mlfid=SEL03027USEN&a achmen =SEL03027USEN.PDF# .
Posey, C. , Benne , R.J. , Robe s, T.L. ,2011. Unde s anding he mindse o he abusi e
inside : an examina ion
o inside s’ causal easoning ollowing in e nal secu i y
changes. Comp. Secu . 30, 4 86–4 97 .
P ochaska, J.O. , DiClemen e, C.C. , 1983. S ages and p ocesses o sel -change o smok-
ing: owa d an in eg a i e model o change. J. Consul . Clin. Psychol. 51 (3),
390–395 .
P ochaska, J.O. , DiClemen e, C.C. , No c oss, J.C. , 1992. In sea ch o how people
change. Applica ions o addic i e beha io s. Am. Psychol. 47 (9), 1102–1114 .
Reichenbach, H. (1938) Expe ience and p edic ion: an analysis o he ounda ions
and he s uc u e o knowledge. Uni e si y o Chicago P ess.
Rhee, H.S. , Kim, C. , Ryu, Y.U. , 2009. Sel -efficacy
in in o ma ion secu i y: i s influence
on end use s’ in o ma ion secu i y p ac ice beha io . Comp. Secu . 28, 816–826 .
Roge s, R.W. , 1975. A p o ec ion mo i a ion heo y o ea appeals and a i ude
change. J. Psychol. 91 (1), 93–114 .
Ryan, R.M. , Pa ick, H. , Deci, E.L. , Williams, G.C. , 2008. Facili a ing heal h beha io
change and i s main enance: in e en ions based on sel -de e mina ion heo y.
Eu . Heal h Psychol. 10, 2–5 .
Sabhe wal, R. , Robey, D. , 1995. Reconciling a iance and p ocess s a egies o s udy-
ing in o ma ion sys em de elopmen . In . Sys . Res. 6 (4), 303–327 .
Sa a, N.S. , Maple, C. , Fu nell, S.
, Azad, M.A. , Pe e a, C. , Dabbagh, M. , Sookhak, M. ,
2019. De e ence and p e en ion-based model o mi iga e in o ma ion secu i y
inside h ea s in o ganisa ions. Fu . Gene , Comp. Sys , 97, 587–597 .
Sa a, N.S. , Maple, C. , Wa son, T. , Von Solms, R. , 2018. Mo i a ion and oppo uni y
based model o educe in o ma ion secu i y inside h ea s in o ganisa ions. J.
In . Secu . Appl. 40, 247–257 .
Sa a, N.S. , Maple, C. , 2016. Human e o s in he in o ma ion secu i y ealm –and
how o fix hem. Comp. F aud. Secu . 9, 17–20 .
Sa a, N.S. , Von Solms, R. , Fu nell, S.
, 2016. In o ma ion secu i y policy compliance
model in o ganiza ions. Comp. Secu . 56, 70–82 .
Sa eNe (2014). Cus ome sen imen su ey. A ailable: h p://www.sa ene -inc.
com/news/2014/da a-b eaches-impac -on-cus ome -loyal y-su ey/#s hash.
V TVqGI5.dpu .
Sasse, A. , B os o , S. , Wei ich, D. ,2001. T ans o ming he ’weakes link. human /
compu e in e ac ion app oach o usable and e ec i e secu i y. BT Technol. J.
19 (3), 122–131 .
Schulze, U. , A i al, A. , 2011. Designing in e iews o gene a e ich da a o in o ma-
ion sys ems esea ch. In . O gan. 21, 1–16 .
Schwa ze , R. , 2008. Some bu ning issues in esea ch on heal h beha io change.
Appl. Psycho. 57 (1), 84–93 .
Sh opshi e, J. , Wa ken in, M.
, Sha ma, S. , 2015. Pe sonali y, a i udes, and in en ions:
p edic ing ini ial adop ion o in o ma ion secu i y beha io . Comp. Secu . 49,
177–191 .
Siponen, Mikko , 2001. On he Role o Human Mo ali y in In o ma ion Sys em Se-
cu i y: F om he P oblems o Desc ip i ism o Non-Desc ip i e Founda ions. In .
Resou . Manag. J. 14 (4), 15–23 .
Siponen, M. , Mahmood, M.A. , Pahnila, S. , 2014. Employees’ adhe ence o in o ma ion
secu i y policies: an explo a o y field s udy. In . Manag. 51, 217–224 .
Siponen, M.T., Pahnila, S. & Mahmood, A. (2007) Employees’ adhe ence o in o ma-
ion secu i y policies: an empi ical s udy. In: New App oaches Fo secu i y, P i-
acy and T us in Complex En i onmen s, Ven e , H., Elo , M., Labuschagne, L.,
Elo , J. & on Solms, R. (eds.), 133–144. P oceedings o he IFIP TC-11 22nd In-
e na ional In o ma ion Secu i y Con e ence (SEC 2007), 14–16 May 2007, Sand-
on, Sou h A ica, 232/2007.
Siponen, M., Pahnila, S. & Mahmood, A. (2006) Fac o s influencing p o ec ion mo i-
a ion and is secu i y policy compliance. Inno a ions in In o ma ion Technology,
1–5.
Siponen, M. , Vance, A. , 2010. Neu aliza ion: new insigh s in o he p oblem o em-
ployee in o ma ion sys ems secu i y policy iola ions. MIS Q. 34 (3), 487–502 .
Sommes ad, T. , Hallbe g, J. , Lundholm, K. , Beng sson, J. , 2014. Va iables influenc-
ing in o ma ion secu i y policy compliance. A sys ema ic e iew o quan i a i e
s udies. In . Manag. Compu . Secu . 22 (1), 42–75 .
Son, J.Y. , 2011. Ou o ea o desi e? Towa d a be e unde s anding o employees’
mo i a ion o ollow is secu i y policies. In . Manag. 48, 296–302 .
Spe be , D. , 1997. In ui i e and eflec i e belie s. Mind Language 12 (1), 67–83 .
S an on, J.M., S am, K.R., Guzman, I. & Calde a, C. (2003) Examining he linkage be-
ween o ganiza ional commi men and in o ma ion secu i y. In IEEE Sys ems,
Man, and Cybe ne ics Con e ence. Washing on DC, USA.
S an on, J.M. , S am, K.R. , Mas angelo,
P. , Jol on, J. , 2005. Analysis o end use secu-
i y beha iou s. Compu e s and Secu i y 24 (2), 124–133 .
18 M. Ka jalainen, M. Siponen and S. Sa ke / Compu e s & Secu i y 93 (2020) 101782
S aub, D.W. , 1990. E ec i e is secu i y: an empi ical s udy. In . Sys . Res. 1 (3),
255–276 .
Theoha idou, M. , Kokolakis, S. , Ka yda, M. , Kioun ouzis, E. , 2005. The inside h ea
o in o ma ion sys ems and he e ec i eness o ISO17799. Compu . Secu . 24,
472–484 .
Thompson, J.L. , 1996. S a egic e ec i eness and success: he lea ning challenge.
Manag. Dec. 34 (7), 14–22 .
Tho nbe y, T.P. , 1987. Towa d an in e ac ional heo y o delinquency. C iminology
25 (4), 863–891 .
Tos , L.P. , 2011. An in eg a i e model o legi imacy judgmen s. Acad. Manage. Re .
36 (4), 686–710 .
Tsohou, A. , Ka yda, M. ,
Kokolakis, S. , 2015. Analyzing he ole o cogni i e and cul-
u al biases in he in e naliza ion o in o ma ion secu i y policies: ecommenda-
ions o in o ma ion secu i y awa eness p og ams. Compu . Secu . 52, 128–141 .
Van de Ven, A.H. , 1992. Sugges ions o s udying s a egy p ocess: a esea ch no e.
S a eg. Manag. J. 13, 169–191 .
Vance, A. , Siponen, M. , Pahnila, S. , 2012. Mo i a ing IS secu i y compliance: insigh s
om habi and p o ec ion mo i a ion heo y. In . Manag. 49, 190–198 .
Wa ken in, M. , Johns on, A.C. , Sh opshi e, J. , 2011. The influence o he in o mal
social lea ning en i onmen on in o ma ion p i acy policy compliance
efficacy
and in en ion. Eu . J. In . Sys . 20 (3), 267–284 .
Velice , W.F. , P ochaska, J.O. , 2008. S age and non-s age heo ies o beha io and be-
ha io change: a commen on schwa ze . Appl. Psychol. An In . Re . 57, 75–83 .
Venka esh, V. , Thong, J.Y.L. , Chan, F.K.Y. , Hu, P.J-H. , B own, S.A. , 2011. Ex ending he
wo-s age in o ma ion sys ems con inuance model: inco po a ing UTAUT p e-
dic o s and he ole o con ex . In . Sys . J. 21, 527–555 .
Weins ein, N.D. , Ro hman, A.J. , Su on, S.R. , 1998. S age heo ies o heal h beha io :
concep ual and me hodological issues. Heal h Psychol. 17 (3),
290–299 .
V oom, C. , on Solms, R. , 2004. Towa ds in o ma ion secu i y beha io al compliance.
Compu . Secu . 23 (3), 191–198 .
Ma i Ka jalainen is pos doc o al esea che in he Uni e si y o Oulu. She has a
Mas e ’s deg ee in Educa ion and holds a Ph.D. in In o ma ion P ocessing Science.
He esea ch in e es s include IS secu i y beha io , aining, and decision-making
p ocesses. She has published pape s in jou nals such as Jou nal o he Associa ion
o In o ma ion Sys ems .
Mikko Siponen is a p o esso o In o ma ion Sys ems a he Uni e si y o Jy äskylä.
He holds a Ph.D. in philosophy om he Uni e si y o Joensuu, Finland, and a Ph.D.
in In o ma ion Sys ems om he Uni e si y o Oulu, Finland. His- esea ch in e es s
include IS secu i y, IS de elopmen , compu e e hics, and philosophical aspec s
o
IS. Mikko has published mo e han 70 a icles in jou nals such as MIS Qua e ly,
Jou nal o he Associa ion o In o ma ion Sys ems, In o ma ion & Managemen , Eu o-
pean Jou nal o In o ma ion Sys ems, In o ma ion & O ganiza ion, Communica ions o
he ACM, IEEE Compu e , IEEE IT P o essional , and o he s. He has ecei ed o e 10
million EUR o esea ch unding om co po a ions and nume ous unding bodies.
He has been a ack chai o he In e na ional Con e ence on In o ma ion Sys ems
and he Eu opean Con e ence on In o ma ion Sys ems h ee imes. His-o he edi-
o ial boa d expe iences include posi ions wi h Jou nal o he Associa ion o In o -
ma ion Sys ems, Eu opean
Jou nal o In o ma ion Sys ems, In o ma ion & Managemen ,
and Communica ions o he Associa ion o In o ma ion Sys ems .
Sup a eek Sa ke Sup a eek Sa ke is Rolls-Royce Commonweal h Comme ce P o-
esso a he McIn i e School o Comme ce, Uni e si y o Vi ginia. His-pas wo k has
been published in many leading jou nals. He is a Senio Edi o o ISR, on he Boa d
o Edi o s o JMIS, he ou -going EIC o JAIS, and o me Senio Edi o o MISQ and
Decision Sciences.