{"id":"https://openalex.org/W1494714906","doi":null,"title":"Which Factors Explain Employees\u2019 Adherence to Information Security Policies? An Empirical Study","display_name":"Which Factors Explain Employees\u2019 Adherence to Information Security Policies? An Empirical Study","publication_year":2007,"publication_date":"2007-12-01","ids":{"openalex":"https://openalex.org/W1494714906","mag":"1494714906"},"language":"en","primary_location":{"id":"mag:1494714906","doi":null,"is_oa":false,"landing_page_url":"http://www.pacis-net.org/file/2007/1273.pdf?origin=publication_detail","pdf_url":null,"source":{"id":"https://openalex.org/S4306420657","display_name":"Pacific Asia Conference on Information Systems","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":"Pacific Asia Conference on Information Systems","raw_type":null},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5012513695","display_name":"Seppo Pahnila","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I98381234","display_name":"University of Oulu","ror":"https://ror.org/03yj89h83","country_code":"FI","type":"education","lineage":["https://openalex.org/I98381234"]}],"countries":["FI"],"is_corresponding":false,"raw_author_name":"Seppo Pahnila","raw_affiliation_strings":["[Univ. of Oulu]"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"[Univ. of Oulu]","institution_ids":["https://openalex.org/I98381234"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058697220","display_name":"Mikko T. Siponen","orcid":"https://orcid.org/0000-0001-7041-1313","observed_orcids":["https://orcid.org/0000-0001-7041-1313"]},"institutions":[{"id":"https://openalex.org/I98381234","display_name":"University of Oulu","ror":"https://ror.org/03yj89h83","country_code":"FI","type":"education","lineage":["https://openalex.org/I98381234"]}],"countries":["FI"],"is_corresponding":false,"raw_author_name":"Mikko Siponen","raw_affiliation_strings":["[Univ. of Oulu]"],"raw_orcid":"https://orcid.org/0000-0001-7041-1313","affiliations":[{"raw_affiliation_string":"[Univ. of Oulu]","institution_ids":["https://openalex.org/I98381234"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5082616132","display_name":"M. Adam Mahmood","orcid":"https://orcid.org/0000-0001-9670-7649","observed_orcids":["https://orcid.org/0000-0001-9670-7649"]},"institutions":[{"id":"https://openalex.org/I86519309","display_name":"The University of Texas at Austin","ror":"https://ror.org/00hj54h04","country_code":"US","type":"education","lineage":["https://openalex.org/I86519309"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"M. Adam Mahmood","raw_affiliation_strings":["University of Texas at Austin#TAB#"],"raw_orcid":"https://orcid.org/0000-0001-9670-7649","affiliations":[{"raw_affiliation_string":"University of Texas at Austin#TAB#","institution_ids":["https://openalex.org/I86519309"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.8275,"has_fulltext":false,"cited_by_count":39,"citation_normalized_percentile":{"value":0.69119383,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":88,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"73","last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10068","display_name":"Technology Adoption and User Behaviour","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/information-security-policy-compliance","display_name":"information security policy compliance","score":0.9309999942779541},{"id":"https://openalex.org/keywords/protection-motivation-theory","display_name":"protection motivation theory","score":0.8370000123977661},{"id":"https://openalex.org/keywords/general-deterrence-theory","display_name":"general deterrence theory","score":0.9879999756813049},{"id":"https://openalex.org/keywords/theory-of-reasoned-action","display_name":"theory of reasoned action","score":0.996999979019165},{"id":"https://openalex.org/keywords/diffusion-of-innovation-theory","display_name":"diffusion of innovation theory","score":0.9890000224113464},{"id":"https://openalex.org/keywords/sanctions","display_name":"sanctions","score":0.6380000114440918},{"id":"https://openalex.org/keywords/reward","display_name":"reward","score":0.9810000061988831},{"id":"https://openalex.org/keywords/threat-appraisal","display_name":"threat appraisal","score":0.7200000286102295},{"id":"https://openalex.org/keywords/self-efficacy","display_name":"self-efficacy","score":0.9890000224113464},{"id":"https://openalex.org/keywords/normative-beliefs","display_name":"normative beliefs","score":0.9750000238418579},{"id":"https://openalex.org/keywords/intention-to-comply","display_name":"intention to comply","score":0.6579999923706055}],"concepts":[{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.7045956254005432},{"id":"https://openalex.org/C2778069335","wikidata":"https://www.wikidata.org/wiki/Q32098","display_name":"Sanctions","level":2,"score":0.6938508749008179},{"id":"https://openalex.org/C60643870","wikidata":"https://www.wikidata.org/wiki/Q1949683","display_name":"Deterrence theory","level":2,"score":0.6219484210014343},{"id":"https://openalex.org/C44725695","wikidata":"https://www.wikidata.org/wiki/Q288156","display_name":"Normative","level":2,"score":0.6128528714179993},{"id":"https://openalex.org/C123269153","wikidata":"https://www.wikidata.org/wiki/Q1897038","display_name":"Theory of reasoned action","level":2,"score":0.5954874753952026},{"id":"https://openalex.org/C148976360","wikidata":"https://www.wikidata.org/wiki/Q1662500","display_name":"Information security management","level":5,"score":0.5851557850837708},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.5380958914756775},{"id":"https://openalex.org/C139547956","wikidata":"https://www.wikidata.org/wiki/Q6031202","display_name":"Information security standards","level":5,"score":0.5232957005500793},{"id":"https://openalex.org/C2781460075","wikidata":"https://www.wikidata.org/wiki/Q1399332","display_name":"Compliance (psychology)","level":2,"score":0.5214121341705322},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.5100606083869934},{"id":"https://openalex.org/C2778652015","wikidata":"https://www.wikidata.org/wiki/Q7445019","display_name":"Security awareness","level":3,"score":0.49706223607063293},{"id":"https://openalex.org/C89785696","wikidata":"https://www.wikidata.org/wiki/Q2290753","display_name":"Theory of planned behavior","level":3,"score":0.49697020649909973},{"id":"https://openalex.org/C182306322","wikidata":"https://www.wikidata.org/wiki/Q1779371","display_name":"Order (exchange)","level":2,"score":0.46685105562210083},{"id":"https://openalex.org/C156325361","wikidata":"https://www.wikidata.org/wiki/Q1152864","display_name":"Grounded theory","level":3,"score":0.4466097354888916},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3569338023662567},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.35027551651000977},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.3217814564704895},{"id":"https://openalex.org/C117110713","wikidata":"https://www.wikidata.org/wiki/Q3394676","display_name":"Network security policy","level":4,"score":0.27551865577697754},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.24090677499771118},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.2386685609817505},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.23578307032585144},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.184177964925766},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.15984639525413513},{"id":"https://openalex.org/C190248442","wikidata":"https://www.wikidata.org/wiki/Q839486","display_name":"Qualitative research","level":2,"score":0.15414580702781677},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.1322559416294098},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.13130030035972595},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.10872098803520203},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"mag:1494714906","doi":null,"is_oa":false,"landing_page_url":"http://www.pacis-net.org/file/2007/1273.pdf?origin=publication_detail","pdf_url":null,"source":{"id":"https://openalex.org/S4306420657","display_name":"Pacific Asia Conference on Information Systems","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":"Pacific Asia Conference on Information Systems","raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.6601999998092651,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, justice, and strong institutions"}],"study_designs":[{"id":"https://openalex.org/study-designs/observational-study","display_name":"Observational Study"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":34,"referenced_works":["https://openalex.org/W1442323271","https://openalex.org/W1486549266","https://openalex.org/W1545612752","https://openalex.org/W1548408014","https://openalex.org/W1595575146","https://openalex.org/W1836311887","https://openalex.org/W1971368595","https://openalex.org/W1997603734","https://openalex.org/W2025332121","https://openalex.org/W2032876373","https://openalex.org/W2036389121","https://openalex.org/W2048584594","https://openalex.org/W2049370737","https://openalex.org/W2049571112","https://openalex.org/W2055789361","https://openalex.org/W2056075452","https://openalex.org/W2072047708","https://openalex.org/W2081363108","https://openalex.org/W2099697766","https://openalex.org/W2100379340","https://openalex.org/W2100408980","https://openalex.org/W2101699735","https://openalex.org/W2109706498","https://openalex.org/W2118345908","https://openalex.org/W2119587968","https://openalex.org/W2124421215","https://openalex.org/W2128734027","https://openalex.org/W2134049139","https://openalex.org/W2162061662","https://openalex.org/W2170554716","https://openalex.org/W2622838936","https://openalex.org/W2795596299","https://openalex.org/W2944944168","https://openalex.org/W3015634246"],"related_works":["https://openalex.org/W7100846677","https://openalex.org/W1578929691","https://openalex.org/W1987381312","https://openalex.org/W2007409322","https://openalex.org/W2185539055","https://openalex.org/W2010902645","https://openalex.org/W4362571332","https://openalex.org/W2466289763","https://openalex.org/W2345064326","https://openalex.org/W3195587946"],"abstract_inverted_index":{"It":[0],"is":[1,11],"widely":[2],"agreed":[3],"that":[4,32,82,132],"a":[5,41,79,163,177,192,213],"key":[6],"threat":[7,136],"to":[8,20,30,86,116,143,146,169,206],"information":[9,22,38,44,87],"security":[10,23,39,45,88,150,173,185,201,210,222],"caused":[12],"by":[13],"careless":[14],"employees":[15,33],"who":[16],"do":[17],"not":[18,161,190],"adhere":[19],"the":[21,36,53,75,95,99,103,108,144,157,167,199,204,220],"policies":[24,151,211],"of":[25,43,105],"their":[26],"organizations.":[27],"In":[28,114],"order":[29,115],"ensure":[31],"comply":[34,147,170,207],"with":[35,148,171,183,198,208,219],"organization\u2019s":[37],"procedures,":[40],"number":[42],"policy":[46],"compliance":[47,182,197,218],"measures":[48,61],"have":[49,162,176,191],"been":[50],"proposed":[51],"in":[52,73],"past.":[54],"Prior":[55],"research":[56],"has,":[57],"however,":[58],"criticized":[59],"these":[60],"as":[62],"lacking":[63],"theoretically":[64],"and":[65,93,112,141],"empirically":[66,117],"grounded":[67],"principles.":[68],"To":[69],"fill":[70],"this":[71,119],"gap":[72],"research,":[74],"present":[76],"study":[77],"advances":[78],"novel":[80],"model":[81,91],"explains":[83],"employees\u2019":[84],"adherence":[85],"policies.":[89,174,202,223],"This":[90],"modifies":[92],"combines":[94],"Protection":[96],"Motivation":[97],"Theory,":[98,102],"General":[100],"Deterrence":[101],"Theory":[104,111],"Reasoned":[106],"Action,":[107],"Innovation":[109],"Diffusion":[110],"Rewards.":[113],"validate":[118],"model,":[120],"we":[121],"collected":[122],"data":[123],"(N=917)":[124],"from":[125,135],"four":[126],"different":[127],"companies.":[128],"The":[129],"findings":[130],"show":[131],"direct":[133],"paths":[134],"appraisal,":[137],"self-efficacy,":[138],"normative":[139],"beliefs,":[140],"visibility":[142],"intention":[145,168,205],"IS":[149,172,184,200,209,221],"were":[152],"significant.":[153],"Response":[154],"efficacy,":[155],"on":[156,166,180,195,216],"other":[158],"hand,":[159],"did":[160,189],"significant":[164,178,193,214],"effect":[165,179,194,215],"Sanctions":[175],"actual":[181,196,217],"policies,":[186],"whereas":[187],"rewards":[188],"Finally,":[203],"has":[212]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":1},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":5},{"year":2019,"cited_by_count":5},{"year":2018,"cited_by_count":7},{"year":2017,"cited_by_count":2},{"year":2015,"cited_by_count":5},{"year":2014,"cited_by_count":1},{"year":2013,"cited_by_count":3},{"year":2012,"cited_by_count":3}],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2016-06-24T00:00:00"}