Factors Influencing Information Security Policy Compliance Behavior in High Education Institutions: Systematic Literature Review
DOI:
https://doi.org/10.14738/assrj.117.17308Keywords:
Information and Communication technology, Information System Security, Security models, IT Compliance, Information securityAbstract
Information security policies and behaviors play a crucial role in organizations, particularly in higher education institutions. These policies outline guidelines and best practices to protect sensitive data, safeguard privacy, and prevent unauthorized access or misuse of information. In higher education institutions, they help secure research findings, intellectual property, and student records. By fostering a culture of security awareness and encouraging responsible behavior, organizations can safeguard their reputation, instill trust, and meet legal and regulatory requirements. This literature review has revealed challenges and highlighted the current trends of information security policy compliance, as well as the theories used for information security compliance from 2013 to 2023. Out of 50 research papers published on the topic of information security policy compliance, three influencing factors were identified through filtration: behavioral intention, awareness and culture, and human with organizational management. The findings show that there is a lack of information security policies in the higher education sector. This review contributes to the information security literature by providing a fully organized systematic review of conducted research in the last decade.
References
Yerby, J. and K. Floyd. Faculty and staff information security awareness and behaviors. in Journal of The Colloquium for Information Systems Security Education. 2018.
Lund, P., Information Security Awareness amongst students: A study about information security awareness at universities. 2018. p. 48.
Singh, A., A. Vaish, and P.K. Keserwani, Information security: Components and techniques. International Journal of Advanced Research in Computer Science and Software Engineering, 2014. 4(1).
Alhassan, M.M. and A. Adjei-Quaye, Information security in an organization. International Journal of Computer (IJC), 2017. 24(1): p. 100-116.
Hyatt, J.C., External, internal, and inherent factors affecting end-user security awareness within institutions of higher learning. 2015, Walden University.
Reddy, D. and V. Rao, Cybersecurity skills: The moderating role in the relationship between cybersecurity awareness and compliance. 2016.
Alghamdi, M.A.A., et al., Employee Well Being and Knowledge Sharing Behavior Among Employees of Saudi Aramco. Advances in Social Sciences Research Journal, 2021. 8(8). 270
Alghamdi, M.A.A., et al., Antecedents and Consequences of Employee Well-Being: Empirical Study on Saudi Aramco. Advances in Social Sciences Research Journal, 2021. 8(9).
Antokhina, J., et al., Confidentiality, Integrity and Accessibility in the Distance Education System. European Proceedings of Social and Behavioural Sciences, 2020.
Raval, S., Detsentralizovannye prilozheniya. Tekhnologiya Blockchain v deistvii [Decentralized Applications. Harnessing Bitcoin's Blockchain Technology]. St. Petersburg, Piter Publ, 2017.
Al-Sharif, A., et al., Effects of Innovation Capability and Environmental Dynamism on the Relationship between Entrepreneurial Leadership and Innovation Performance in the SMEs Service Industry. International Journal of Academic Research in Business and Social Sciences, 2023. 13: p. 1547-1570.
Al-Sharif, A.M., et al., The Role of Innovation Capability in the Relationship between Entrepreneurial Leadership and Innovation Performance in the SMEs Service Industry. Advances in Social Sciences Research Journal, 2023. 10(1).
Okoli, C. and K. Schabram, A guide to conducting a systematic literature review of information systems research. 2015.
Oliveira, B.E.É.R., Web Search Engines-A study on the evolution of user interfaces. 2021.
Abdulhadi, A.R., et al., The Impact of Internal Control on Project Management in Construction Site Among Small and Medium Enterprises in Iraq. Advances in Social Sciences Research Journal, 2023. 10(3).
Abdulhadi, A.R., et al., The Impact of Risk Management on The Dimensions of Project Management Among Small and Medium Enterprises in Iraq. Advances in Social Sciences Research Journal, 2022. 9(11).
Sulaiman, N.S., et al., Cyber–Information Security Compliance and Violation Behaviour in Organisations: A Systematic Review. Social Sciences, 2022. 11(9): p. 386.
Herath, T. and H.R. Rao, Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness. Decision Support Systems, 2009. 47(2): p. 154-165.
Chang, K.-C. and Y.M. Seow, Protective Measures and Security Policy Non-Compliance Intention: IT Vision Conflict as a Moderator. Journal of Organizational and End User Computing (JOEUC), 2019. 31(1): p. 1-21.
Boss, S.R., et al., What do systems users have to fear? Using fear appeals to engender threats and fear that motivate protective security behaviors. MIS quarterly, 2015. 39(4): p. 837-864.
Johnston, A.C., M. Warkentin, and M. Siponen, An enhanced fear appeal rhetorical framework. MIS quarterly, 2015. 39(1): p. 113-134.
Doherty, N.F. and S.T. Tajuddin, Towards a user-centric theory of value-driven information security compliance. Information Technology & People, 2018. 31(2): p. 348-367.
Gerber, N., et al. Understanding Information Security Compliance-Why Goal Setting and Rewards Might be a Bad Idea. in HAISA. 2016.
Sari, P.K. and N. Nurshabrina. Factor analysis on information security management in higher education institutions. in 2016 4th International Conference on Cyber and IT Service Management. 2016. IEEE.
Lankton, N.K., C. Stivason, and A. Gurung, Information protection behaviors: morality and organizational criticality. Information & Computer Security, 2019. 27(3): p. 468-488. 271
D'Arcy, J. and G. Greene, Security culture and the employment relationship as drivers of employees’ security compliance. Information Management & Computer Security, 2014. 22(5): p. 474-489.
Jandab, A., et al., The Influence of It Capability on It-Based Innovation: The Mediating Role Of Organizational Learning Capability. 2020: p. 2020.
Jandab, A., et al., IT-Based Innovation and New Product Development Performance in Yemen: The Moderating Role of Intellectual Property. International Journal of Business Society, 2019. 3(11): p. 1-8.
Hu, Q., et al., Managing Employee Compliance with Information Security Policies: The Critical Role of Top Management and Organizational Culture*. Decision Sciences, 2012. 43(4): p. 615-660.
Abdulsamad, A., et al., The Importance of Entrepreneurial Orientation's Dimensions in Influencing the Organizational Performance of Food and Beverage SMEs. Advances in Social Sciences Research Journal, 2020. 7: p. 81-99.
Abdulsamad, A., et al., The Impact of Market Orientation Components on Organizational Performance of SMEs. The single-industry approach "Food and Beverage Sector". Advances in Social Sciences Research Journal, 2021. 8: p. 504-516.
Bongiovanni, I., The least secure places in the universe? A systematic literature review on information security management in higher education. Computers & Security, 2019. 86: p. 350-357.
Hina, S. and P.D.D. Dominic, Information security policies’ compliance: a perspective for higher education institutions. Journal of Computer Information Systems, 2020. 60(3): p. 201-211.
Soomro, Z.A., M.H. Shah, and J. Ahmed, Information security management needs more holistic approach: A literature review. International Journal of Information Management, 2016. 36(2): p. 215-225.
Kuo, K.-M., P.C. Talley, and D.-Y.M. Lin, Hospital Staff’s Adherence to Information Security Policy: A Quest for the Antecedents of Deterrence Variables. INQUIRY: The Journal of Health Care Organization, Provision, and Financing, 2021. 58: p. 00469580211029599.
Sommestad, T., H. Karlzén, and J. Hallberg, A meta-analysis of studies on protection motivation theory and information security behaviour. International Journal of Information Security and Privacy (IJISP), 2015. 9(1): p. 26-46.
Tsohou, A. and P. Holtkamp, Are users competent to comply with information security policies? An analysis of professional competence models. Information Technology & People, 2018. 31(5): p. 1047-1068.
Lebek, B., et al., Information security awareness and behavior: a theory-based literature review. Management Research Review, 2014. 37(12): p. 1049-1092.
Karlsson, F., E. Kolkowska, and F. Prenkert, Inter-organisational information security: a systematic literature review. Information & Computer Security, 2016. 24(5): p. 418-451.
Padayachee, K., Taxonomy of compliant information security behavior. Computers & Security, 2012. 31(5): p. 673-680.
Sommestad, T., et al., Variables influencing information security policy compliance. Information Management & Computer Security, 2014. 22(1): p. 42-75.
Posey, C., et al., Insiders' protection of organizational information assets: Development of a systematicsbased taxonomy and theory of diversity for protection-motivated behaviors. Mis Quarterly, 2013: p. 1189-
D’Arcy, J. and P.-L. Teh, Predicting employee information security policy compliance on a daily basis: The interplay of security-related stress, emotions, and neutralization. Information & Management, 2019. 56(7): p. 103151.
Kajtazi, M., et al., Escalation of commitment as an antecedent to noncompliance with information security policy. Information & Computer Security, 2018. 26(2): p. 171-193.
Trang, S. and B. Brendel, A Meta-Analysis of Deterrence Theory in Information Security Policy Compliance Research. Information Systems Frontiers, 2019. 21(6): p. 1265-1284.
Nasir, A., et al., An analysis on the dimensions of information security culture concept: A review. Journal of Information Security and Applications, 2019. 44: p. 12-22.
Yazdanmehr, A., et al., The role of ethical climates in employee information security policy violations. Decision Support Systems, 2024. 177: p. 114086.
Rajab, M. and A. Eydgahi, Evaluating the explanatory power of theoretical frameworks on intention to comply with information security policies in higher education. Computers & Security, 2019. 80: p. 211-223.
Kam, H.-J., et al., Information security policy compliance in higher education: a neo-institutional perspective. 2013.
Kyobe, M. Towards a framework to guide compliance with IS security policies and regulations in a university. in 2010 Information Security for South Africa. 2010.
Siponen, M., S. Pahnila, and M.A. Mahmood, Compliance with information security policies: An empirical investigation. Computer, 2010. 43(2): p. 64-71.
Kranz, J. and F. Haeussinger, Why deterrence is not enough: The role of endogenous motivations on employees’ information security behavior. 2014.
Hsu, J.S.-C., et al., The Role of Extra-Role Behaviors and Social Controls in Information Security Policy Effectiveness. Information Systems Research, 2015. 26(2): p. 282-300.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2024 Aisha Aissa Ali Ahmed, Hafiza Abas
This work is licensed under a Creative Commons Attribution 4.0 International License.
