{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,15]],"date-time":"2026-10-15T13:55:39Z","timestamp":1792072539879,"version":"4.4.0"},"reference-count":51,"publisher":"Emerald","issue":"4","license":[{"start":{"date-parts":[[2023,4,20]],"date-time":"2023-04-20T00:00:00Z","timestamp":1681948800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.emerald.com\/insight\/site-policies"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["ICS"],"published-print":{"date-parts":[[2023,10,30]]},"abstract":"\n Purpose<\/jats:title>\n Cybersecurity attacks on critical infrastructures, businesses and nations are rising and have reached the interest of mainstream media and the public\u2019s consciousness. Despite this increased awareness, humans are still considered the weakest link in the defense against an unknown attacker. Whatever the reason, na\u00efve-, unintentional- or intentional behavior of a member of an organization, the result of an incident can have a considerable impact. A security policy with guidelines for best practices and rules should guide the behavior of the organization\u2019s members. However, this is often not the case. This paper aims to provide answers to how cybersecurity-related behavior is assessed.<\/jats:p>\n <\/jats:sec>\n \n Design\/methodology\/approach<\/jats:title>\n Research questions were formulated, and a systematic literature review (SLR) was performed by following the recommendations of the Preferred Reporting Items for Systematic Reviews and Meta-Analyses statement. The SLR initially identified 2,153 articles, and the paper reviews and reports on 26 articles.<\/jats:p>\n <\/jats:sec>\n \n Findings<\/jats:title>\n The assessment of cybersecurity-related behavior can be classified into three components, namely, data collection, measurement scale and analysis. The findings show that subjective measurements from self-assessment questionnaires are the most frequently used method. Measurement scales are often composed based on existing literature and adapted by the researchers. Partial least square analysis is the most frequently used analysis technique. Even though useful insight and noteworthy findings regarding possible differences between manager and employee behavior have appeared in some publications, conclusive answers to whether such differences exist cannot be drawn.<\/jats:p>\n <\/jats:sec>\n \n Research limitations\/implications<\/jats:title>\n Research gaps have been identified, that indicate areas of interest for future work. These include the development and employment of methods for reducing subjectivity in the assessment of cybersecurity-related behavior.<\/jats:p>\n <\/jats:sec>\n \n Originality\/value<\/jats:title>\n To the best of the authors\u2019 knowledge, this is the first SLR on how cybersecurity-related behavior can be assessed. The SLR analyzes relevant publications and identifies current practices as well as their shortcomings, and outlines gaps that future research may bridge.<\/jats:p>\n <\/jats:sec>","DOI":"10.1108\/ics-08-2022-0139","type":"journal-article","created":{"date-parts":[[2023,4,18]],"date-time":"2023-04-18T09:15:42Z","timestamp":1681809342000},"page":"463-477","source":"Crossref","is-referenced-by-count":51,"title":["A systematic literature review of how cybersecurity-related behavior has been assessed"],"prefix":"10.1108","volume":"31","author":[{"given":"Kristian","family":"Kannel\u00f8nning","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sokratis K.","family":"Katsikas","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"140","published-online":{"date-parts":[[2023,4,20]]},"reference":[{"issue":"2","key":"key2023102616471347900_ref001","doi-asserted-by":"crossref","first-page":"179","DOI":"10.1016\/0749-5978(91)90020-T","article-title":"The theory of planned behavior","volume":"50","year":"1991","journal-title":"Organizational Behavior and Human Decision Processes"},{"key":"key2023102616471347900_ref002","doi-asserted-by":"crossref","first-page":"162687","DOI":"10.1109\/ACCESS.2021.3132574","article-title":"Exploring the influence of direct and indirect factors on information security policy compliance: a systematic literature review","volume":"9","year":"2021","journal-title":"IEEE Access"},{"key":"key2023102616471347900_ref003","first-page":"3317","article-title":"Security policy compliance: user acceptance perspective","volume-title":"2012 45th HI International Conference on System Sciences","year":"2012"},{"issue":"10","key":"key2023102616471347900_ref004","article-title":"Factors impacting users\u2019 compliance with information security policies: an empirical study","volume":"12","year":"2021","journal-title":"International Journal of Advanced Computer Science and Applications"},{"key":"key2023102616471347900_ref005","doi-asserted-by":"publisher","first-page":"106531","DOI":"10.1016\/j.chb.2020.106531","article-title":"Keeping customers\u2019 data secure: a cross-cultural study of cybersecurity compliance among the Gen-Mobile workforce","volume":"114","year":"2021","journal-title":"Computers in Human Behavior"},{"key":"key2023102616471347900_ref006","doi-asserted-by":"publisher","first-page":"145","DOI":"10.1016\/j.cose.2013.05.006","article-title":"Don\u2019t make excuses! Discouraging neutralization to reduce IT policy violation","volume":"39","year":"2013","journal-title":"Computers and Security"},{"key":"key2023102616471347900_ref007","first-page":"1","article-title":"Cyber security metrics and measures","volume-title":"Wiley Handbook of Science and Technology for Homeland Security","year":"2008"},{"issue":"1","key":"key2023102616471347900_ref008","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/0959-4752(91)90016-2","article-title":"Subjective competence, appraisals and self-assessment","volume":"1","year":"1991","journal-title":"Learning and Instruction"},{"issue":"3","key":"key2023102616471347900_ref009","doi-asserted-by":"publisher","first-page":"1043","DOI":"10.1287\/isre.2021.1014","article-title":"Understanding inconsistent employee compliance with information security policies through the lens of the extended parallel process model","volume":"32","year":"2021","journal-title":"Information Systems Research"},{"key":"key2023102616471347900_ref010","doi-asserted-by":"publisher","first-page":"102568","DOI":"10.1016\/j.cose.2021.102568","article-title":"Voluntary and instrumental information security policy compliance: an integrated view of prosocial motivation, self-regulation and deterrence","volume":"113","year":"2021","journal-title":"Computers and Security"},{"key":"key2023102616471347900_ref011","doi-asserted-by":"crossref","first-page":"289","DOI":"10.1109\/ICACSIS.2018.8618219","article-title":"Measuring information security awareness on employee using HAIS-Q: case study at XYZ firm","volume-title":"2018 International Conference on Advanced Computer Science and Information Systems (ICACSIS)","year":"2018"},{"key":"key2023102616471347900_ref012","volume-title":"How to Conduct Surveys: A Step-by-Step Guide","year":"2015"},{"key":"key2023102616471347900_ref013","volume-title":"Conducting Research Literature Reviews: From the Internet to Paper","year":"2019"},{"issue":"2","key":"key2023102616471347900_ref014","doi-asserted-by":"publisher","first-page":"5","DOI":"10.1016\/S1361-3723(09)70019-3","article-title":"From culture to disobedience: recognising the varying user acceptance of IT security","volume":"2009","year":"2009","journal-title":"Computer Fraud and Security"},{"key":"key2023102616471347900_ref015","first-page":"144","article-title":"Information security behavior: development of a measurement instrument based on the self-determination theory","volume-title":"International Symposium on Human Aspects of Information Security and Assurance","year":"2020"},{"issue":"4","key":"key2023102616471347900_ref016","doi-asserted-by":"publisher","first-page":"286","DOI":"10.1109\/TPC.2014.2374011","article-title":"A path to successful management of employee security compliance: an empirical study of information security climate","volume":"57","year":"2014","journal-title":"IEEE Transactions on Professional Communication"},{"issue":"2","key":"key2023102616471347900_ref017","doi-asserted-by":"publisher","first-page":"340","DOI":"10.1111\/isj.12202","article-title":"The impact of leadership on employees\u2019 intended information security behaviour: an examination of the full-range leadership theory","volume":"29","year":"2018","journal-title":"Information Systems Journal"},{"issue":"4","key":"key2023102616471347900_ref018","doi-asserted-by":"crossref","first-page":"283","DOI":"10.1207\/s15328031us0304_4","article-title":"A beginner\u2019s guide to partial least squares analysis","volume":"3","year":"2004","journal-title":"Understanding Statistics"},{"issue":"2","key":"key2023102616471347900_ref019","doi-asserted-by":"crossref","first-page":"106","DOI":"10.1057\/ejis.2009.6","article-title":"Protection motivation and deterrence: a framework for security policy compliance in organisations","volume":"18","year":"2009","journal-title":"European Journal of Information Systems"},{"issue":"5","key":"key2023102616471347900_ref020","doi-asserted-by":"publisher","first-page":"402","DOI":"10.1016\/S0167-4048(02)00504-7","article-title":"Information security policy \u2013 what do international information security standards say","volume":"21","year":"2002","journal-title":"Computers and Security"},{"issue":"1","key":"key2023102616471347900_ref021","doi-asserted-by":"crossref","first-page":"2","DOI":"10.1108\/OIR-11-2015-0358","article-title":"Why not comply with information security? An empirical approach for the causes of non-compliance","volume":"41","year":"2017","journal-title":"Online Information Review"},{"key":"key2023102616471347900_ref022","article-title":"ISO\/IEC 27002:2022, information security, cybersecurity and privacy protection \u2013 information security controls","author":"International Standardization Organization","year":"2022"},{"key":"key2023102616471347900_ref023","first-page":"67","article-title":"How individuals weigh their previous estimates to make a new estimate in the presence or absence of social influence","volume-title":"International Social Computing, Behavioral-Cultural Modeling and Prediction","year":"2014"},{"issue":"1","key":"key2023102616471347900_ref024","doi-asserted-by":"publisher","first-page":"E16775","DOI":"10.2196\/16775","article-title":"Why employees (still) click on phishing links: investigation in hospitals","volume":"22","year":"2020","journal-title":"Journal of Medical Internet Research"},{"key":"key2023102616471347900_ref025","article-title":"Socio-technical perspectives on cyber security and definitions of digital transformation \u2013 aliterature review","volume-title":"Proceedings of the 30th European Safety and Reliability Conference and the 15th Probabilistic Safety Assessment and Management Conference","year":"2020"},{"key":"key2023102616471347900_ref026","first-page":"1","article-title":"Acquiring sentiment towards information security policies through affective computing","volume-title":"2020 2nd International Multidisciplinary Information Technology and Engineering Conference (IMITEC)","year":"2020"},{"issue":"3","key":"key2023102616471347900_ref027","doi-asserted-by":"publisher","first-page":"445","DOI":"10.1108\/ICS-02-2019-0025","article-title":"Response biases in policy compliance research","volume":"28","year":"2019","journal-title":"Information and Computer Security"},{"key":"key2023102616471347900_ref028","doi-asserted-by":"publisher","first-page":"13","DOI":"10.1016\/j.ijinfomgt.2018.10.017","article-title":"Investigating the impact of cybersecurity policy awareness on employees\u2019 cybersecurity behavior","volume":"45","year":"2019","journal-title":"International Journal of Information Management"},{"key":"key2023102616471347900_ref029","doi-asserted-by":"publisher","first-page":"102152","DOI":"10.1016\/j.ijinfomgt.2020.102152","article-title":"Motivating information security policy compliance: the critical role of supervisor-subordinate guanxi and organizational commitment","volume":"54","year":"2020","journal-title":"International Journal of Information Management"},{"key":"key2023102616471347900_ref030","article-title":"A reliable measure of information security awareness and the identification of bias in responses","volume":"21","year":"2017","journal-title":"Australian Journal of Information Systems"},{"key":"key2023102616471347900_ref031","doi-asserted-by":"publisher","first-page":"151","DOI":"10.1016\/j.chb.2016.11.065","article-title":"Individual differences and information security awareness","volume":"69","year":"2016","journal-title":"Computers in Human Behavior"},{"key":"key2023102616471347900_ref032","volume-title":"\u2018The Nature of Attitudes and Attitude Change","year":"1969"},{"key":"key2023102616471347900_ref03300","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1016\/j.chb.2018.10.031","article-title":"Examining the impact of deterrence factors and norms on resistance to information systems security","volume":"92","year":"2019","journal-title":"Computers in Human Behavior"},{"issue":"1","key":"key2023102616471347900_ref033","article-title":"Toward a unified model of information security policy compliance","volume":"42","year":"2018","journal-title":"MIS Quarterly"},{"key":"key2023102616471347900_ref034","first-page":"4541","article-title":"Interpreting information security policy outcomes: a frames of reference perspective","volume-title":"2013 46th HI International Conference on System Sciences","year":"2013"},{"key":"key2023102616471347900_ref035","doi-asserted-by":"crossref","first-page":"51","DOI":"10.1201\/9781439822593.ch6","article-title":"Quantitative vs Subjective","volume-title":"Business Measurements for Safety Performance","year":"1999"},{"key":"key2023102616471347900_ref036","doi-asserted-by":"publisher","first-page":"N71","DOI":"10.1136\/bmj.n71","article-title":"The PRISMA 2020 statement: an updated guideline for reporting systematic reviews","volume":"372","year":"2021","journal-title":"Bmj"},{"key":"key2023102616471347900_ref037","doi-asserted-by":"crossref","first-page":"40","DOI":"10.1016\/j.cose.2017.01.004","article-title":"The human aspects of information security questionnaire (HAIS-Q): two further validation studies","volume":"66","year":"2017","journal-title":"Computers and Security"},{"key":"key2023102616471347900_ref038","doi-asserted-by":"publisher","first-page":"165","DOI":"10.1016\/j.cose.2013.12.003","article-title":"Determining employee awareness using the human aspects of information security questionnaire (HAIS-Q)","volume":"42","year":"2014","journal-title":"Computers and Security"},{"issue":"2","key":"key2023102616471347900_ref039","doi-asserted-by":"publisher","first-page":"117","DOI":"10.1177\/1555343415575152","article-title":"The influence of organizational information security culture on information security decision making","volume":"9","year":"2015","journal-title":"Journal of Cognitive Engineering and Decision Making"},{"key":"key2023102616471347900_ref040","doi-asserted-by":"crossref","first-page":"100427","DOI":"10.1016\/j.ijcip.2021.100427","article-title":"A systematic literature review on RAMS analysis for critical infrastructures protection","volume":"33","year":"2021","journal-title":"International Journal of Critical Infrastructure Protection"},{"issue":"5","key":"key2023102616471347900_ref041","doi-asserted-by":"crossref","first-page":"879","DOI":"10.1037\/0021-9010.88.5.879","article-title":"Common method biases in behavioral research: a critical review of the literature and recommended remedies","volume":"88","year":"2003","journal-title":"Journal of Applied Psychology"},{"issue":"2","key":"key2023102616471347900_ref042","doi-asserted-by":"publisher","first-page":"371","DOI":"10.1007\/s10111-021-00683-y","article-title":"Leveraging human factors in cybersecurity: an integrated methodological approach","volume":"24","year":"2021","journal-title":"Cognition, Technology and Work"},{"key":"key2023102616471347900_ref043","first-page":"232","article-title":"Whose risk Is it anyway: how do risk perception and organisational commitment affect employee information security awareness?","volume-title":"International Conference on Human-Computer Interaction","year":"2020"},{"issue":"1","key":"key2023102616471347900_ref044","doi-asserted-by":"crossref","first-page":"42","DOI":"10.1108\/IMCS-08-2012-0045","article-title":"Variables influencing information security policy compliance: a systematic review of quantitative studies","volume":"22","year":"2014","journal-title":"Information Management and Computer Security"},{"key":"key2023102616471347900_ref045","doi-asserted-by":"crossref","first-page":"1209","DOI":"10.23919\/MIPRO.2019.8756765","article-title":"Development of a new international behavioral-cognitive internet security questionnaire: preliminary results from Croatian and German samples","volume-title":"2019 42nd International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO)","year":"2019"},{"issue":"8","key":"key2023102616471347900_ref046","doi-asserted-by":"publisher","DOI":"10.13140\/RG.2.2.35453.87524","article-title":"Systematic literature review in computer science-a practical \u2018guide","volume":"1","year":"2016","journal-title":"Relat\u00f3rios T\u00e9cnicos Do DCC\/UFJF"},{"key":"key2023102616471347900_ref047","volume-title":"Case Study Research and Applications","year":"2018","edition":"6th ed"},{"issue":"4","key":"key2023102616471347900_ref048","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1007\/BF02293796","article-title":"Quantitative analysis of qualitative data","volume":"46","year":"1981","journal-title":"Psychometrika"},{"issue":"3","key":"key2023102616471347900_ref049","doi-asserted-by":"crossref","first-page":"523","DOI":"10.2307\/25750690","article-title":"Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness","volume":"34","year":"2010","journal-title":"MIS Quarterly"},{"key":"key2023102616471347900_ref050","first-page":"156b","article-title":"Employees\u2019 behavior towards IS security policy compliance","volume-title":"2007 40th Annual HI International Conference on System Sciences (HICSS\u201907)","year":"2007"}],"container-title":["Information & Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ICS-08-2022-0139\/full\/xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ICS-08-2022-0139\/full\/html","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,25]],"date-time":"2025-07-25T01:23:09Z","timestamp":1753406589000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.emerald.com\/ics\/article\/31\/4\/463-477\/111532"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,4,20]]},"references-count":51,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2023,4,20]]},"published-print":{"date-parts":[[2023,10,30]]}},"alternative-id":["10.1108\/ICS-08-2022-0139"],"URL":"https:\/\/doi.org\/10.1108\/ics-08-2022-0139","relation":{},"ISSN":["2056-4961","2056-4961"],"issn-type":[{"value":"2056-4961","type":"print"},{"value":"2056-4961","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,4,20]]}}}