If someone is watching, I'll do what I'm asked: Mandatoriness, control, and information security

European Journal of Information Systems

Volumn 18, Issue 2, 2009, Pages 151-164

  Boss, Scott R ^a   Kirsch, Laurie J ^b   Angermeier, Ingo ^c   Shingler, Raymond A ^c   Boss, R Wayne ^d  

^a BENTLEY UNIVERSITY   (United States)

^b UNIVERSITY OF PITTSBURGH   (United States)

^c Landstuhl Regional Medical Center   (United States)

^d UNIVERSITY OF COLORADO   (United States)

Author keywords

Control; Information security; Mandatoriness

Indexed keywords

EID: 67650100804     PISSN: 0960085X     EISSN: 14769344     Source Type: Journal    
DOI: 10.1057/ejis.2009.8     Document Type: Article

References (75)

1. AJZEN I (1985) From intentions to actions: a theory of planned behavior. In Action Control, from Cognition to Behavior (KUHL J, and BECKMANN J, Eds), pp 11-39, Springer-Verlag, Berlin, NY.
2. AMERICAN NATIONAL STANDARDS INSTITUTE (2005) Iso ics 35 Information Technology. American National Standards Institute, Washington DC.
3. ARMSTRONG JS and OVERTON TS (1977) Estimating nonresponse bias in mail surveys. Journal of Marketing Research 14(3), 396-102.
4. BARON RM and KENNY DA (1986) The moderator mediator variable distinction in social psychological-research - conceptual, strategic, and statistical considerations. Journal of Personality and Social Psychology 51(6), 1173-1182.
5. BIRNBERG JG and SNODGRASS C (1988) Culture and control - a field-study. Accounting Organizations and Society 13(5), 447-164.
6. BLUMSTEIN A (1978) Introduction. In Deterrence and Incapacitation: Estimating the Effects of Criminal Sanctions on Crime Rates (BLUMSTIEN A, COHEN Jand NAGIN D, Eds), National Academy of Sciences, Washington DC.
7. BROWN SA, MASSEY AP, MONTOYA-WEISS MM and BURKMAN JR (2002) Do I really have to? User acceptance of mandated technology. European Journal of Information Systems 11(4), 283-295.
8. CARDINAL LB (2001) Technological innovation in the pharmaceutical industry: the use of organizational control in managing research and development. Organization Science 12(1), 19-36.
9. CARDINAL LB, SITKIN SB and LONG CP (2004) Balancing and rebalancing in the creation and evolution of organizational control. Organization Science 15(4), 411-431.
10. CARMINES EG and ZELLER RA (1979) Reliability and Validity Assessment. Sage Publications, Beverly Hills, CA.
11. CHAE Band POOLE MS (2005) Mandates and technology acceptance: a tale of two enterprise technologies. Journal of Strategic Information Systems 14(2), 147-166.
12. CHARLTON JP and BIRKETT PE (1995) The development and validation of the computer apathy and anxiety scale. Journal of Educational Computing Research 13(1), 41-59.
13. CHIN WW (1998) The partial least squares approach for structural equation modeling. In Modern Methods for Business Research (MARCOULIDES GA, Ed), pp 295-336, Lawrence Erlbaum, Mahwah, NJ.
14. CHIN WW and GOPAL A (1995) Adoption intention in gss - relative importance of beliefs. Data Base for Advances in Information Systems 26(2-3), 42-64.
15. CHOUDHURY Vand SABHERWAL R (2003) Portfolios of control in outsourced software development projects. Information Systems Research 14(3), 291-314.
16. CHOW CW, HIRST Mand SHIELDS MD (1995) The effects of pay schemes and probabilistic management audits on subordinate misrepresentation of private information: an experimental investigation in a resource allocation context. Behavioral Research in Accounting 7, 1-15.
17. COHEN J (1977) Statistical Power Analysis for the Behavioral Sciences. Academic Press, New York.
18. COMPEAU DR and HIGGINS CA (1995) Computer self-efficacy - development of a measure and initial test. MIS Quarterly 19(2), 189-211.
19. COREN M (2005) Experts: Cyber-Crime Bigger Threat than Cyber-Terror. Cable News Network LP, LLLP, Atlanta, GA.
20. D'AQUILA JM (2001) Financial accountants' perceptions of management's ethical standards. Journal of Business Ethics 31(3), 233-244.
21. DAS TK and TENG BS (1998) Between trust and control: developing confidence in partner cooperation in alliances. Academy of Management Review 23(3), 491-512.
22. DECI EL and RYAN RM (2002) Handbook of Self-determination Research. University of Rochester Press, Rochester, NY.
23. DHILLON G (2001) Violation of safeguards by trusted personnel and understanding related information security concerns. Computers & Security 20(2), 165-1 72.
24. DOPUCH N, BIRNBERG JG and DEMSKI JS (1982) Cost Accounting: Accounting Data for Management's Decisions. Harcourt Brace Jovanovich, New York.
25. DUTTA Aand MCCROHAN K (2002) Management's role in information security in a cyber economy. California Management Review 45(1), 67-87.
26. EISENHARDT KM (1985) Control: organizational and economic approaches. Management Science 31(2), 134-149.
27. EISENHARDT KM (1988) Agency-theory and institutional-theory explanations - the case of retail sales compensation. Academy of Management Journal 31(3), 488-511.
28. FALK A and KOSFELD M (2004) Distrust - The Hidden Cost of Control. National Bureau of Economic Research, Cambridge, MA.
29. FORNELL C and LARCKER DF (1981) Evaluating structural equation models with unobservable variables and measurement error. Journal of Marketing Research 18(1), 39-50.
30. FREDERICKSON JR and WALLER W (2005) Carrot or stick? Contract frame and use of decision-influencing information in a principal-agent setting. Journal of Accounting Research 43(5), 709-733.
31. GARFINKEL S, SPAFFORD Gand SCHWARTZ A (2003) Practical Unix and Internet Security. O'Reilly, Beijing, Sebastopol, CA.
32. HARTWICK Jand BARKI H (1994) Explaining the role of user participation in information-system use. Management Science 40(4), 440-465.
33. HASAN B (2006) Delineating the effects of general and system-specific computer self-efficacy beliefs on is acceptance. Information & Management 43(5), 565-571.
34. HU Q, HART Pand COOKE D (2007) The role of external and internal influences on information systems security - a neo-institutional perspective. Journal of Strategic Information Systems 6(2), 153-172.
35. JAWORSKI BJ (1988) Toward a theory of marketing control: environmental context, control types, and consequences. Theory of Marketing Control 52, 23-39.
36. KADAM A (2002) Writing an information security policy. Network Magazine. Indian Express Group, Mumbai, India.
37. KARAHANNA E and STRAUB DW (1999) The psychological origins of perceived usefulness and ease-of-use. Information & Management 35(4), 237-250.
38. KELMAN HC (1958) Compliance, identification, and internationalization: three processes of attitude change? Journal of Conflict Resolution 2(1), 51-60.
39. KELMAN HC (1961) Processes of opinion change. Public Opinion Quarterly 25(1), 57-78.
40. KENNY DA, KASHY DA and BOLGER N (1998) The handbook of social psychology. In The Handbook of Social Psychology (GILBERT DT, FISKE ST and LINDZEYG, Eds), pp 233-265, McGraw-Hill, Boston, NY.
41. KIRSCH LJ (1996) The management of complex tasks in organizations: controlling the systems development process. Organization Science 7(1), 1-21.
42. KIRSCH LJ (1997) Portfolios of control modes and is project management. Information Systems Research 8(3), 215-239.
43. KIRSCH LJ (2004) Deploying common solutions globally: the dynamics of control. Information Systems Research 15(4), 374-395.
44. KIRSCH LJ, SAMBAMURTHY V, KO DG and PURVIS RL (2002) Controlling information systems development projects: the view from the client. Management Science 48(4), 484-498.
45. LIANG HG, SARAF N, HU Q and XUE YJ (2007) Assimilation of enterprise systems: the effect of institutional pressures and the mediating role of top management. MIS Quarterly 31(1), 59-87.
46. LIM VKG, TEO TSH and LOO GL (2002) How do I loaf here? Let me count the ways. Communications of the ACM 45(1), 66-70.
47. LORANGE P and SCOTT-MORTON MS (1974) A framework for management control systems. Sloan Management Review 16(1), 47-56.
48. LUFT J (1994) Bonus and penalty incentives contract choice by employees. Journal of Accounting & Economics 18(2), 181-206.
49. MACAULAY Sand COOK S (1994) Performance management as the key to customer service. Industrial and Commercial Training 26(11), 3-8.
50. MALHOTRA Yand GALLETTA D (2005) A multidimensional commitment model of volitional systems adoption and usage behavior. Journal of Management Information Systems 22(1), 117-151.
51. MALHOTRA Y, GALLETTA DF and KIRSCH LJ (2008) How endogenous motivations influence user intentions: beyond the dichotomy of extrinsic and intrinsic user motivations. Journal of Management Information Systems 25(1), 267-299.
52. MARKUS ML (1983) Power, politics, and mis implementation. Communications of the ACM 26(6), 430-444.
53. MATHIESON K, PEACOCK Eand CHIN WW (2001) Extending the technology acceptance model: the influence of perceived user resources. Database for Advances in Information Systems 32(3), 86-112.
54. MILGRAM S (1974) Obedience to Authority; an Experimental View. Harper & Row, New York.
55. NATIONAL CYBER SECURITY ALLIANCE (2005) Top Ten Cybersecurity Tips. National Cyber Security Alliance, Washington DC.
56. NATIONAL CYBER SECURITY ALLIANCE and MCAFEE CORPORATION (2008) Mcafee-ncsa Online Safety Study. National Cyber Security Alliance and McAfee Corporation, Washingtion DC.
57. NIDUMOLU SR and SUBRAMANI MR (2003) The matrix of control: combining process and structure approaches to managing software development. Journal of Management Information Systems 20(3), 159-196.
58. NUNNALLY JC and BERNSTEIN IH (1994) Psychometric Theory. McGraw-Hill, New York.
59. OUCHI WG (1977) Relationship between organizational-structure and organizational control. Administrative Science Quarterly 22(1), 95-113.
60. OUCHI WG (1979) Conceptual-framework for the design of organizational control mechanisms. Management Science 25(9), 833-848.
61. PETTER S, STRAUB Dand RAI A (2007) Specifying formative constructs in information systems research. MIS Quarterly 31(4), 623-656.
62. PODSAKOFF PM, MACKENZIE SB, LEE JY and PODSAKOFF NP (2003) Common method biases in behavioral research: a critical review of the literature and recommended remedies. Journal of Applied Psychology 88(5), 879-903.
63. RAWSTORNE P, JAYASURIYA Rand CAPUTI P (1998) An integrative model of information systems use in mandatory environments. in International Conference on Information Systems pp 325-330, Association for Computing Machinery, Helsinki, Finland.
64. ROSS ST (1999) Unix System Security Tools. McGraw-Hill, New York.
65. RYAN RM and DECI EL (2000) Self-determination theory and the facilitation of intrinsic motivation, social development, and well-being. American Psychologist 55(1), 68-78.
66. SCHNEDLER Wand VADOVIC R (2007) Legitimacy of Control. Institute for the Study of Labor (IZA), Bonn, Germany.
67. SCHNEIDER FW, GRUMAN JA and COUTTS LM (2005) Applied Social Psychology: Understanding and Addressing Social and Practical Problems. Sage Publications, Thousand Oaks, CA.
68. SHROUT PE and BOLGER N (2002) Mediation in experimental and nonexperimental studies: new procedures and recommendations. Psychological Methods 7(4), 422-445.
69. SNELL SA (1992) Control-theory in strategic human-resource management - the mediating effect of administrative information. Academyof Management Journal 35(2), 292-327.
70. STRAUB DW (1990) Effective is security: an empirical study. Information Systems Research 1(3), 255-273.
71. STRAUB DW and WELKE RJ (1998) Coping with systems risk: security planning models for management decision making. MIS Quarterly 22(4), 441-469.
72. SUSSMAN SW and SIEGAL WS (2003) Informational influence in organizations: an integrated approach to knowledge adoption. Information Systems Research 14(1), 47-65.
73. SYMANTEC CORPORATION (2007) Symantec Reports Rise in Data Theft, Data Leakage, and Targeted Attacks Leading to Hackers' Financial Gain. Symantec Corporation, Cupertino, CA.
74. TAYLOR Sand TODD P (1995) Assessing it usage: the role of prior experience. MIS Quarterly 19(4), 561-570.
75. VENKATESH Vand DAVIS FD (2000) A theoretical extension of the technology acceptance model: four longitudinal field studies. Management Science 46(2), 186-204.