Managing Employee Compliance with Information Security Policies: The Critical Role of Top Management and Organizational Culture

Decision Sciences

Volumn 43, Issue 4, 2012, Pages 615-660

  Hu, Qing ^a   Dinev, Tamara ^b   Hart, Paul ^b   Cooke, Donna ^c  

^a IOWA STATE UNIVERSITY   (United States)

^b FLORIDA ATLANTIC UNIVERSITY   (United States)

^c FLORIDA ATLANTIC UNIVERSITY   (United States)

Author keywords

Compliance Behavior; Information Security; Organizational Culture; Theory of Planned Behavior; Top Management

Indexed keywords

EID: 84863542038     PISSN: 00117315     EISSN: 15405915     Source Type: Journal    
DOI: 10.1111/j.1540-5915.2012.00361.x     Document Type: Article

References (95)

1. Anderson, J. C., & Gerbing, S. W. (1988). Structural equation modeling in practice: A review and recommended two-step approach. Psychological Bulletin, 103(3), 411-423.
2. Angst, C. M., & Agarwal, R. (2009). Adoption of electronic health records in the presence of privacy concerns: The elaboration likelihood model and individual persuasion. MIS Quarterly, 33(2), 339-370.
3. Ajzen, I. (2005). Attitudes, personality, and behavior (2nd ed.). New York, NY: Open University Press.
4. Albrechtsen, E. (2007). A qualitative study of users' view on information security. Computers & Security, 26(4), 276-289.
5. Armstrong, C., & Sambamurthy, V. (1999). Information technology assimilation in firms: The influence of senior leadership and IT infrastructures. Information Systems Research, 10(4), 304-327.
6. Bagozzi, R. P., & Yi, Y. (1988). On the evaluation of structural equation models. Journal of the Academy of Marketing Science, 16(1), 74-94.
7. Baron, R. M., & Kenny, D.A. (1986). The moderator-mediator variable distinction in social psychological research: Conceptual, strategic, and statistical considerations. Journal of Personality and Social Psychology, 51(6), 1173-1182.
8. Bass, B. M. (1998). Transformational leadership: Industrial, military, and educational impact. Mahwah, NJ: Erlbaum.
9. Bass, B. M., & Avolio, B. J. (1993). Transformational leadership and organizational culture. Public Administration Quarterly, 17(1), 112-121.
10. Björck, F. (2004). Institutional theory: A new perspective for research into IS/IT security. Proceedings of the 37th Hawaii International Conference on System Sciences (HICSS-37), Big Island, HI
11. Boss, S. R., Kirsch, L. J., Angermeier, I., Shingler, R. A., & Boss, R. W. (2009). If someone is watching, I'll do what I'm asked: Mandatoriness, control, and information security. European Journal of Information Systems, 18(2), 151-164.
12. Buenger, V., Daft, R. L., Conlon, E. J., & Austin, J. (1996). Competing values in organizations: Contextual influences and structural consequences. Organization Science, 7(5), 557-576.
13. Bulgurcu, B., Cavusoglu, H., & Benbasat, I. (2010). Information security policy compliance: An empirical study of rationality-based beliefs and information security awareness. MIS Quarterly, 34(3), 523-548.
14. Button, S. B., Mathieu, J. E., & Zajac, D. M. (1996). Goal orientation in organizational research: A conceptual and empirical foundation. Organizational Behavior and Human Decision Processes, 67(1), 26-48.
15. Cameron, K. S., & Quinn, R. E. (2005). Diagnosing and changing organizational culture. San Francisco, CA: Jossey-Bass.
16. Chang, S. E., & Lin, C.-S. (2007). Exploring organizational culture for information security management. Industrial Management & Data Systems, 107(3), 438-458.
17. Chin, W. W. (1998). The partial least squares approach to structural equation modeling. In G. A. Marcoulides (Ed.), Modern methods for business research. (pp. 295-336). Hillsdale, NJ: Erlbaum.
18. Christensen, A. J., & Smith, T. W. (1995). Personality and patient adherence: Correlated of the five-factor model in renal analysis. Journal of Behavioral Medicine, 18(3), 305-313.
19. Colquitt, J. A., & Simmering, M. J. (1998). Conscientiousness, goal orientation, and motivation to learn during the learning process: A longitudinal study. Journal of Applied Psychology, 83(4), 654-665.
20. Costa Jr., P., & McCrae, R. (1995). Domains and facets: Hierarchical personality assessment using the revised NEO personality inventory. Journal of Personality Assessment, 64(1), 21-50.
21. D'Arcy, J., Havav, A., & Galletta, D. (2009). User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach. Information Systems Research, 20(1), 79-98.
22. Denison, D. R. (1996). What is the difference between organizational culture and organizational climate? A native's point of view on a decade of paradigm wars. The Academy of Management Review, 21(3), 619-654.
23. Dinev, T., & Hu, Q. (2007). The centrality of awareness in the formation of user behavioral intentions towards preventive technologies in the context of voluntary use. Journal of the AIS, 8(7), 386-408.
24. Douglas, P. C., Davidson, R. A., & Schwartz, B. N. (2001). The effect of organizational culture and ethical orientation on accountants' ethical judgments. Journal of Business Ethics, 34(2), 101-121.
25. Dweck, C. S. (1986). Motivational processes affecting learning. American Psychologist, 41(10), 1040-1048.
26. Fornell, C., & Larcker, D. F. (1981). Evaluating structural equation models with unobservable variables and measurement error. Journal of Marketing Research, 18(1), 39-50.
27. Gefen, D., Karahanna, E., & Straub, D. W. (2003). Trust and TAM in online shopping: An integrated model. MIS Quarterly, 27(1), 51-90.
28. Gefen, D., Straub, D. W., & Boudreau, M.C. (2000). Structural equation modeling and regression: Guidelines for research practice. Communications of the AIS, 41, 1-78.
29. Harris, S. G. (1994). Organizational culture and individual sensemaking: A schema-based perspective. Organization Science, 5(3), 309-321.
30. Harrison, D. A., Mykytyn, P. P., & Riemenschneider, C. K. (1997). Executive decisions about adoption of information technology in small business: Theory and empirical tests. Information Systems Research, 8(2), 171-195.
31. Hartog, D. N. D., Muijen, J. J. V., & Koopman, P. L. (1996). Linking transformational leadership and organizational culture. Journal of Leadership & Organizational Studies, 3(4), 68-83.
32. Herath, T., & Rao, H. R. (2009a). Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness. Decision Support Systems, 47(2), 154-165.
33. Herath, T., & Rao, H. R. (2009b). Protection motivation and deterrence: A framework for security policy compliance in organisations. European Journal of Information Systems, 18(2), 106-125.
34. Heyman, G. D., & Dweck, C. S. (1992). Achievement goals and intrinsic motivation: Their relation and their role in adaptive motivation. Motivation and Emotion, 16(3), 231-247.
35. Hofstede, G., Neuijen, B., Ohayv, D. D., & Sanders, G. (1990). Measuring organizational cultures: A qualitative and quantitative study across twenty cases. Administrative Science Quarterly, 35(2), 286-316.
36. Holmes, A. (2008). Malicious thumb drives in justice. Retrieved from
37. Hu, Q., Hart, P., & Cooke, D. (2007). The role of external influences on organizational information security practices: An institutional perspective. Journal of Strategic Information Systems, 16(2), 153-172.
38. Hu, Q., Xu, Z. C., Dinev, T., & Ling, H. (2011). Does deterrence really work in reducing information security policy abuse by employees? Communications of the ACM, 54(6), 34-40.
39. Hulland, J. (1999). Use of partial least squares (PLS) in strategic management research: A review of four recent studies. Strategic Management Journal, 20(2), 195-204.
40. Iivari, J., & Huisman, M. (2007). The relationship between organizational culture and the deployment of systems development methodologies. MIS Quarterly, 31(1), 35-58.
41. James, H. S. (2000). Reinforcing ethical decision making through organizational structure. Journal of Business Ethics, 28(1), 43-58.
42. Jarvenpaa, S. L. & Ives, B. (1991). Executive involvement and participation in management information technology. MIS Quarterly, 15(2), 205-227.
43. Jaskyte, K. (2004). Transformational leadership, organizational culture, and innovativeness in nonprofit organizations. Nonprofit Management & Leadership, 15(2), 153-168.
44. Johnston, A. C., & Warkentin, M. (2010). Fear appeals and information security behaviors: An empirical study. MIS Quarterly, 33(4), 549-566.
45. Jones, R. A., Jimmieson, N. L., & Griffiths, A. (2005). The impact of organizational culture and reshaping capabilities on change implementation success: The mediating role of readiness for change. Journal of Management Studies, 42(2), 361-386.
46. Ke, W., & Wei, K. K. (2008). Organizational culture and leadership in ERP implementation. Decision Support Systems, 45(2), 208-218.
47. Kouzes, J.M., & Posner, B. Z. (1987). The leadership challenge: How to get extraordinary things done in organizations. San Francisco, CA: Jossey-Bass.
48. Leidner, D. E., & Kayworth, T. (2006). Review: A review of culture in information systems research: Toward a theory of information technology culture conflict. MIS Quarterly, 30(2), 357-399.
49. Liang, H., Saraf, H., Hu, Q., & Xue, Y. (2007). Assimilation of enterprise systems: The effect of institutional pressures and the mediating role of top management. MIS Quarterly, 31(1), 59-87.
50. Lin, S.-C., & Chang, J.-N. (2005). Goal orientation and organizational commitment as explanatory factors of employees' mobility. Personnel Review, 34(3), 331-353.
51. Liu, L. N., Feng, Y. Q., Hu, Q., & Huang, X. J. (2011). From transactional user to VIP: How organizational and cognitive factors affect ERP assimilation at individual level. European Journal of Information Systems, 20(2), 186-200.
52. Lund, D. B. (1986). Organizational culture and job satisfaction. Journal of Business & Industrial Marketing, 18(3), 219-236.
53. MacKinnon, D. P., Lockwood, C. M., Hoffman, J. M., West, S. G., & Sheets, V. (2002). A comparison of methods to test mediation and other intervening variable effects. Psychological Methods, 7(1), 83-104.
54. Markoff, J. (2010). Cyberattack on Google said to hit password system. New York Times, April 20, p. A1.
55. Mills, E. (2010). IBM: We distributed malware-ridden USB drives. Retrieved from
56. Mount, M. K., Oh, I., & Burns, M. (2008). Incremental validity of perceptual speed and accuracy over general mental ability. Personnel Psychology, 61(1), 113-139.
57. Myyry, L., Siponen, M., Pahnila, S., Vartiainen, T., & Vance, A. (2009). What levels of moral reasoning and values explain adherence to information security rules? An empirical study. European Journal of Information Systems, 18(2), 126-139.
58. Ouchi, W. G., & Wilkins, A. L. (1985). Organizational culture. Annual Review of Sociology, 11, 457-483.
59. Pavlou, P. A., & Fygenson, M. (2006). Understanding and predicting electronic commerce adoption: An extension of the theory of planned behavior. MIS Quarterly, 30(1), 115-143.
60. Payne, S. C., Youngcourt, S. S., & Beaubien, J. M. (2007). A meta-analytic examination of the goal orientation nomological net. Journal of Applied Psychology, 92(1), 128-150.
61. Podsakoff, P. M., MacKenzie, S. B., Lee, J-Y., & Podsakoff, N.P. (2003). Common method biases in behavioral research: A critical review of the literature and recommended remedies. Journal of Applied Psychology, 88(5), 879-903.
62. Puhakainen, P., & Siponen, M. (2010). Improving employees' compliance through information systems security training: An action research study. MIS Quarterly, 34(4), 757-778.
63. Quinn, R. E. (1988). Beyond Rational Management. San Francisco, CA: Jossey-Bass.
64. Quinn, R. E., & Rohrbaugh, J. (1983). A spatial model of effectiveness criteria: Towards a competing values approach to organizational analysis. Management Science, 29(3), 363-377.
65. Quinn, R. E., & Spreitzer, G. M. (1991). The psychometrics of the competing values culture instrument and an analysis of the impact of organization culture on quality of life. In W. A. Pasmore, & R. W. Woodman (Eds.), Research in Organizational Change and Development (Vol. 5, pp. 115-142). Greenwich, CT: JAI Press.
66. Raykov, T. (1998). Coefficient alpha and composite reliability with interrelated nonhomogeneous items. Applied Psychological Measurement, 22(4), 375-385.
67. Richardson, R. (2008). CSI computer crime and security survey. Retrieved from
68. Ringle, C. M., Wende, S., & Will, A. (2005). SmartPLS, 2.0 (beta), University of Hamburg, Hamburg, Germany Retrieved from
69. Schein, E. (2004). Organizational culture and leadership. (3rd ed.) San Francisco, CA: Jossey-Bass.
70. Schrodt, P. (2002). The relationship between organizational identification and organizational culture: Employee perceptions of culture and identification in a retail sales organization. Communication Studies, 53(2), 189-202.
71. Sharma, R., & Yetton, P. (2003). The contingent effects of management support and task interdependence on successful information systems implementation. MIS Quarterly, 27(4), 533-555.
72. Sheridan, J. E. (1992). Organizational culture and employee retention. Academy of Management Journal, 35(5), 1036-1056.
73. Siponen, M., & Vance, A.O. (2010). Neutralization: New insights into the problem of employee systems security policy violations. MIS Quarterly, 34(3), 87-502.
74. Smircich, L. (1983). Concepts of culture and organizational analysis. Administrative Science Quarterly, 28(3), 339-358.
75. Smith, S., Winchester, D. W., Bunker, D., & Jamieson, R. (2010). Circuits of power: A study of mandated compliance to an information systems security de jour standard in a government organization. MIS Quarterly, 34(3), 463-486.
76. Srite, M., & Karahanna, E. (2006). The role of espoused national cultural values in technology acceptance. MIS Quarterly, 30(3), 679-704.
77. Stilley, C. S., Sereika, S., Muldoon, M. F., Ryan, C. M., & Dunbar-Jacob, J. (2004). Psychological and cognitive function: Predictors of adherence with cholesterol lowering treatment. Annals of Behavioral Medicine, 27(2), 117-124.
78. Stone-Gross, B., Cova, M., Cavallaro, L., Gilbert, B., Szydlowski, M., Kemmerer, R., Kruegel, C., & Vigna, G. (2009). Your botnet is my botnet: Analysis of a botnet takeover. (pp. 635-647). Proceedings of the 16th ACM conference on computer and communications security (CCS'09), November 9-13, Chicago, IL
79. Straub, D. W. (1990). Effective IS security: An empirical study. Information Systems Research, 1(3), 255-276.
80. Straub, D., Boudreau, M.-C., & Gefen, D. (2004). Validation guidelines for IS positivist research. Communications of AIS, 13, 1380-427.
81. Symantec, & Ponemon (2009). More than half of ex-employees admit to stealing company data according to new study. Press release by Symantec Corporation and Ponemon Institute. Retrieved from
82. Taylor, S., & Todd, P. A. (1995). Understanding information technology usage: A test of competing models. Information Systems Research, 6(2), 144-176.
83. Trice, H. M., & Beyer, J. M. (1993). The Culture of work organizations. Englewood Cliff, NJ: Prentice Hall.
84. Tsui, A. S., Zhang, Z.-X., Wang, H., Xin, K. R., & Wu, J. B. (2006). Unpacking the relationship between CEO leadership behavior and organizational culture. The Leadership Quarterly, 17(2), 113-137.
85. Tyler, T. R. & Blader, S. L. (2005). Can businesses effectively regulate employee conduct? The antecedents of rule following in work settings. Academy of Management Journal, 48(6), 1143-1158.
86. Tyler, T. R., Callahan, P. E., & Frost, J. (2007). Armed, and dangerous (?): Motivating rule adherence among agents of social control. Law & Society Review, 41(2), 457-492.
87. Van Kessel, P. (2008). Moving beyond compliance-Ernst & Young 2008 global information security survey. Retrieved from
88. Van Muijen, J. J., Koopman, P., De Witte, K., De Cock, G., Susanj, Z., Lemoine, C., Bourantas, D., Papalexandris, N., Branyicski, I., Spaltro, E., Jesuino, J., Neves, J. G. D., Pitariu, H., Konrad, E., Peiró, J., González-Romá, V., & Turnipseed, D. (1999). Organizational culture: The focus questionnaire. European Journal of Work and Organizational Psychology, 8(4), 551-568.
89. Vandenberghe, C., & Peiro, J. M. (1999). Organizational and individual values: Their main and combined effects on work attitudes and perceptions. European Journal of Work & Organizational Psychology, 8(4), 569-581.
90. Von Solms, R., & Von Solms, B. (2004a). From policies to culture. Computers & Security, 23(4), 275-279.
91. Von Solms, B., & Von Solms, R. (2004b). The 10 deadly sins of information security management. Computers & Security, 23(5), 371-376.
92. Weaver, G. R., & Treviño, L. K. (1999). Compliance and values oriented ethics programs: Influences on employees' attitudes and behavior. Business Ethics Quarterly, 9(2), 315-335.
93. Willison, R., & Backhouse, J. (2006). Opportunities for computer crime: Considering systems risk from a criminological perspective. European Journal of Information Systems, 15(4), 403-414.
94. Wylder, J. O. (2003). Improving security from the ground up. Information Systems Security, 11(6), 29-38.
95. Young, R. F., & Windsor, J. (2010). Empirical evaluation of information security planning and integration. Communications of the AIS, 26, Article 13, 245-266.