{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,12]],"date-time":"2026-07-12T03:54:03Z","timestamp":1783828443048,"version":"3.55.0"},"reference-count":53,"publisher":"Emerald","issue":"1","license":[{"start":{"date-parts":[[2014,3,4]],"date-time":"2014-03-04T00:00:00Z","timestamp":1393891200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.emerald.com\/insight\/site-policies"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2014,3,4]]},"abstract":"\n Purpose<\/jats:title>\n \u2013 The purpose of this paper is to identify variables that influence compliance with information security policies of organizations and to identify how important these variables are. <\/jats:p>\n <\/jats:sec>\n \n Design\/methodology\/approach<\/jats:title>\n \u2013 A systematic review of empirical studies described in extant literature is performed. This review found 29 studies meeting its inclusion criterion. The investigated variables in these studies and the effect size reported for them were extracted and analysed. <\/jats:p>\n <\/jats:sec>\n \n Findings<\/jats:title>\n \u2013 In the 29 studies, more than 60 variables have been studied in relation to security policy compliance and incompliance. Unfortunately, no clear winners can be found among the variables or the theories they are drawn from. Each of the variables only explains a small part of the variation in people's behaviour and when a variable has been investigated in multiple studies the findings often show a considerable variation. <\/jats:p>\n <\/jats:sec>\n \n Research limitations\/implications<\/jats:title>\n \u2013 It is possible that the disparate findings of the reviewed studies can be explained by the sampling methods used in the studies, the treatment\/control of extraneous variables and interplay between variables. These aspects ought to be addressed in future research efforts. <\/jats:p>\n <\/jats:sec>\n \n Practical implications<\/jats:title>\n \u2013 For decision makers who seek guidance on how to best achieve compliance with their information security policies should recognize that a large number of variables probably influence employees' compliance. In addition, both their influence strength and interplay are uncertain and largely unknown. <\/jats:p>\n <\/jats:sec>\n \n Originality\/value<\/jats:title>\n \u2013 This is the first systematic review of research on variables that influence compliance with information security policies of organizations.<\/jats:p>\n <\/jats:sec>","DOI":"10.1108\/imcs-08-2012-0045","type":"journal-article","created":{"date-parts":[[2014,1,25]],"date-time":"2014-01-25T00:28:10Z","timestamp":1390609690000},"page":"42-75","source":"Crossref","is-referenced-by-count":160,"title":["Variables influencing information security policy compliance"],"prefix":"10.1108","volume":"22","author":[{"given":"Teodor","family":"Sommestad","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jonas","family":"Hallberg","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kristoffer","family":"Lundholm","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Johan","family":"Bengtsson","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"140","reference":[{"key":"key2021010301431759300_b1","doi-asserted-by":"crossref","unstructured":"Ajzen, I.\n (1991), \u201cThe theory of planned behavior\u201d, Organizational Behavior and Human Decision Processes, Vol. 50 No. 2, pp. 179-211.","DOI":"10.1016\/0749-5978(91)90020-T"},{"key":"key2021010301431759300_b2","unstructured":"Ajzen, I.\n and \n Fishbein, M.\n (1979), Understanding Attitudes and Predicting Social Behavior, Nebraska Symposium on Motivation, Vol. 27, Prentice-Hall, Englewood Cliffs, NJ, pp. 65-116."},{"key":"key2021010301431759300_b3","unstructured":"Asgharpour, F.\n , \n Liu, D.\n and \n Camp, L.J.\n (2007), \u201cExperimental evaluations of expert and non-expert computer users' mental models of security risks\u201d, The Workshop on the Economics of Information Security (WEIS), Pittsburgh, PA, pp. 1-24, available at: http:\/\/citeseerx.ist.psu.edu\/viewdoc\/download?doi=10.1.1.144.1585&rep=rep1&type=pdf."},{"key":"key2021010301431759300_b4","unstructured":"Beautement, A.\n , \n Sasse, M.A.\n and \n Wonham, M.\n (2009), \u201cThe compliance budget: managing security behaviour in organisations\u201d, Proceedings New Security Paradigms Workshop, Lake Tahoe, CA, USA, pp. 47-58."},{"key":"key2021010301431759300_b5","doi-asserted-by":"crossref","unstructured":"Becker, B.J.\n and \n Wu, M.-J.\n (2007), \u201cThe synthesis of regression slopes in meta-analysis\u201d, Statistical Science, Vol. 22 No. 3, pp. 414-429.","DOI":"10.1214\/07-STS243"},{"key":"key2021010301431759300_b6","doi-asserted-by":"crossref","unstructured":"Brereton, P.\n , \n Kitchenham, B.\n , \n Budgen, D.\n , \n Turner, M.\n and \n Khalil, M.\n (2007), \u201cLessons from applying the systematic literature review process within the software engineering domain\u201d, Journal of Systems and Software, Vol. 80 No. 4, pp. 571-583.","DOI":"10.1016\/j.jss.2006.07.009"},{"key":"key2021010301431759300_b7","doi-asserted-by":"crossref","unstructured":"Bulgurcu, B.\n , \n Cavusoglu, H.\n and \n Benbasat, I.\n (2009), \u201cEffects of individual and organization based beliefs and the moderating role of work experience on insiders' good security behaviors\u201d, Proceedings \u2013 12th IEEE International Conference on Computational Science and Engineering, CSE, Vancouver, BC, Canada, Vol. 3, pp. 476-481.","DOI":"10.1109\/CSE.2009.484"},{"key":"key2021010301431759300_b8","doi-asserted-by":"crossref","unstructured":"Bulgurcu, B.\n , \n Cavusoglu, H.\n and \n Benbasat, I.\n (2010a), \u201cInformation security policy compliance: an empirical study of rationality-based beliefs and information security awareness\u201d, MIS Quarterly: Management Information Systems, Vol. 34, Special Issue 3, pp. 523-548.","DOI":"10.2307\/25750690"},{"key":"key2021010301431759300_b9","doi-asserted-by":"crossref","unstructured":"Bulgurcu, B.\n , \n Cavusoglu, H.\n and \n Benbasat, I.\n (2010b), \u201cQuality and fairness of an information security policy as antecedents of employees' security engagement in the workplace: an empirical investigation\u201d, Proceedings of the Annual Hawaii International Conference on System Sciences, Piscataway, NJ, USA, Shidler College of Business, University of Hawai'I, Honolulu, HI, pp. 1-7.","DOI":"10.1109\/HICSS.2010.312"},{"key":"key2021010301431759300_b10","doi-asserted-by":"crossref","unstructured":"Chan, M.\n and \n Woon, I.\n (2005), \u201cPerceptions of information security in the workplace: linking information security climate to compliant behavior\u201d, Journal of Information Privacy and Security, Vol. 1 No. 3, pp. 18-41.","DOI":"10.1080\/15536548.2005.10855772"},{"key":"key2021010301431759300_b11","doi-asserted-by":"crossref","unstructured":"Chipperfield, C.\n and \n Furnell, S.\n (2010), \u201cFrom security policy to practice: sending the right messages\u201d, Computer Fraud & Security, Vol. 2010 No. 3, pp. 13-19.","DOI":"10.1016\/S1361-3723(10)70025-7"},{"key":"key2021010301431759300_b13","doi-asserted-by":"crossref","unstructured":"D'Arcy, J.\n and \n Herath, T.\n (2011), \u201cA review and analysis of deterrence theory in the IS security literature: making sense of the disparate findings\u201d, European Journal of Information Systems, Vol. 20 No. 6, pp. 643-658.","DOI":"10.1057\/ejis.2011.23"},{"key":"key2021010301431759300_b14","doi-asserted-by":"crossref","unstructured":"D'Arcy, J.\n and \n Hovav, A.\n (2007), \u201cDeterring internal information systems misuse\u201d, Communications of the ACM, Vol. 50 No. 10, pp. 113-117.","DOI":"10.1145\/1290958.1290971"},{"key":"key2021010301431759300_b15","doi-asserted-by":"crossref","unstructured":"D'Arcy, J.\n , \n Hovav, A.\n and \n Galletta, D.\n (2008), \u201cUser awareness of security countermeasures and its impact on information systems misuse: a deterrence approach\u201d, Information Systems Research, Vol. 20 No. 1, pp. 79-98.","DOI":"10.1287\/isre.1070.0160"},{"key":"key2021010301431759300_b12","unstructured":"Dugo, T.M.\n (2007), \u201cThe insider threat to organizational information security: a structural model and empirical test\u201d, Auburn University, available at: http:\/\/etd.auburn.edu\/etd\/handle\/10415\/1345."},{"key":"key2021010301431759300_b16","doi-asserted-by":"crossref","unstructured":"Guo, K.H.\n , \n Yuan, Y.\n , \n Archer, N.P.\n and \n Connelly, C.E.\n (2011), \u201cUnderstanding nonmalicious security violations in the workplace: a composite behavior model\u201d, Journal of Management Information Systems, Vol. 28 No. 2, pp. 203-236.","DOI":"10.2753\/MIS0742-1222280208"},{"key":"key2021010301431759300_b17","unstructured":"Harrington, S.\n (1996), \u201cThe effect of codes of ethics and personal denial of responsibility on computer abuse judgments and intentions\u201d, MIS Quarterly, Vol. 20 No. 3, pp. 257-278, available at: www.jstor.org\/stable\/10.2307\/249656."},{"key":"key2021010301431759300_b19","doi-asserted-by":"crossref","unstructured":"Herath, T.\n and \n Rao, H.R.\n (2009a), \u201cEncouraging information security behaviors in organizations: role of penalties, pressures and perceived effectiveness\u201d, Decision Support Systems, Vol. 47 No. 2, pp. 154-165.","DOI":"10.1016\/j.dss.2009.02.005"},{"key":"key2021010301431759300_b18","doi-asserted-by":"crossref","unstructured":"Herath, T.\n and \n Rao, H.R.\n (2009b), \u201cProtection motivation and deterrence: a framework for security policy compliance in organizations\u201d, European Journal of Information Systems, Vol. 18 No. 2, pp. 106-125.","DOI":"10.1057\/ejis.2009.6"},{"key":"key2021010301431759300_b20","unstructured":"Higgins, J.\n and \n Green, S.\n (2011), Cochrane Handbook for Systematic Reviews of Interventions, available at: www.cochrane-handbook.org; www.cochrane-handbook.org."},{"key":"key2021010301431759300_b21","doi-asserted-by":"crossref","unstructured":"Hu, Q.\n , \n Xu, Z.\n , \n Dinev, T.\n and \n Ling, H.\n (2011), \u201cDoes deterrence work in reducing information security policy abuse by employees?\u201d, Communications of the ACM, Vol. 54 No. 6, pp. 54-60.","DOI":"10.1145\/1953122.1953142"},{"key":"key2021010301431759300_b23","doi-asserted-by":"crossref","unstructured":"Ifinedo, P.\n (2012), \u201cUnderstanding information systems security policy compliance: an integration of the theory of planned behavior and the protection motivation theory\u201d, Computers and Security, Vol. 31, pp. 83-95.","DOI":"10.1016\/j.cose.2011.10.007"},{"key":"key2021010301431759300_b22","unstructured":"ISO\/IEC\n (2009), Information Technology \u2013 Security Techniques \u2013 Information Security Management Measurements, ISO\/IEC 27004, Geneva."},{"key":"key2021010301431759300_b24","doi-asserted-by":"crossref","unstructured":"Johnston, A.C.\n and \n Warkentin, M.\n (2010), \u201cThe influence of perceived source credibility on end user attitudes and intentions to comply with recommended IT actions\u201d, Journal of Organizational and End User Computing, Vol. 22 No. 3, pp. 1-21.","DOI":"10.4018\/joeuc.2010070101"},{"key":"key2021010301431759300_b25","unstructured":"Kitchenham, B.\n (2004), Procedures for Performing Systematic Reviews, Citeseer, Keele, p. -."},{"key":"key2021010301431759300_b26","doi-asserted-by":"crossref","unstructured":"Kohlberg, L.\n (1973), \u201cThe claim to moral adequacy of a highest stage of moral judgment\u201d, The Journal of Philosophy, Vol. 70 No. 18, p. -.","DOI":"10.2307\/2025030"},{"key":"key2021010301431759300_b27","unstructured":"Lamsa, T.\n (2010), \u201cLeadership styles and decision-making in Finnish and Swedish organizations\u201d, Review of International Comparative Management, Vol. 11 No. 1, pp. 139-149, available at: http:\/\/rmci.ase.ro\/ro\/no11vol1\/Vol11_No1_Article13.pdf."},{"key":"key2021010301431759300_b28","doi-asserted-by":"crossref","unstructured":"Lee, S.M.\n , \n Lee, S.-G.\n and \n Yoo, S.\n (2004), \u201cAn integrative model of computer abuse based on social control and general deterrence theories\u201d, Information & Management, Vol. 41 No. 6, pp. 707-718.","DOI":"10.1016\/j.im.2003.08.008"},{"key":"key2021010301431759300_b29","doi-asserted-by":"crossref","unstructured":"Li, H.\n , \n Zhang, J.\n and \n Sarathy, R.\n (2010), \u201cUnderstanding compliance with internet use policy from the perspective of rational choice theory\u201d, Decision Support Systems, Vol. 48 No. 4, pp. 635-645.","DOI":"10.1016\/j.dss.2009.12.005"},{"key":"key2021010301431759300_b30","unstructured":"Malhotra, M.\n and \n Grover, V.\n (1998), \u201cAn assessment of survey research in POM: from constructs to theory\u201d, Journal of Operations Management, Vol. 16 No. 4, pp. 407-425, available at: www.sciencedirect.com\/science\/article\/pii\/S0272696398000217."},{"key":"key2021010301431759300_b31","doi-asserted-by":"crossref","unstructured":"Myyry, L.\n , \n Siponen, M.\n , \n Pahnila, S.\n , \n Vartiainen, T.\n and \n Vance, A.\n (2009), \u201cWhat levels of moral reasoning and values explain adherence to information security rules? An empirical study\u201d, European Journal of Information Systems, Vol. 18 No. 2, pp. 126-139.","DOI":"10.1057\/ejis.2009.10"},{"key":"key2021010301431759300_b32","unstructured":"Norman, P.\n , \n Boer, H.\n and \n Seydel, E.R.\n (2005), \u201cProtection motivation theory\u201d, in \n Conner, M.\n and \n Norman, P.\n (Eds), Predicting Health Behaviour: Research and Practice with Social Cognition Models, Open University Press, Buckingham, pp. 81-126."},{"key":"key2021010301431759300_b33","unstructured":"Nye, F.I.\n (1958), Family Relationships and Delinquent Behavior, Wiley, Oxford."},{"key":"key2021010301431759300_b34","doi-asserted-by":"crossref","unstructured":"Padayachee, K.\n (2012), \u201cTaxonomy of compliant information security behavior\u201d, Computers & Security, Vol. 31 No. 5, pp. 673-680.","DOI":"10.1016\/j.cose.2012.04.004"},{"key":"key2021010301431759300_b35","doi-asserted-by":"crossref","unstructured":"Pahnila, S.\n , \n Siponen, M.\n and \n Mahmood, A.\n (2007), \u201cEmployees' behavior towards IS security policy compliance\u201d, Proceedings of the Annual Hawaii International Conference on System Sciences, Big Island, HI, p. -.","DOI":"10.1109\/HICSS.2007.206"},{"key":"key2021010301431759300_b36","doi-asserted-by":"crossref","unstructured":"Rest, J.\n , \n Thoma, S.\n and \n Edwards, L.\n (1997), \u201cDesigning and validating a measure of moral judgment: stage preference and stage consistency approaches\u201d, Journal of Educational Psychology, Vol. 89 No. 1, pp. 5-28.","DOI":"10.1037\/0022-0663.89.1.5"},{"key":"key2021010301431759300_b37","doi-asserted-by":"crossref","unstructured":"Schwartz, S.H.\n (1973), \u201cNormative explanations of helping behavior: a critique, proposal, and empirical test\u201d, Journal of Experimental Social Psychology, Vol. 9 No. 4, pp. 349-364.","DOI":"10.1016\/0022-1031(73)90071-1"},{"key":"key2021010301431759300_b38","doi-asserted-by":"crossref","unstructured":"Schwartz, S.H.\n , \n Lehmann, A.\n and \n Roccas, S.\n (1999), \u201cMultimethod probes of basic human values\u201d, in \n Adamo-Pouls, J.\n and \n Kashima, Y.\n (Eds), Social Psychology and Cultural Context, Sage, Thousand Oaks, CA, pp. 107-123.","DOI":"10.4135\/9781452220550.n8"},{"key":"key2021010301431759300_b42","unstructured":"Siponen, M.\n and \n Vance, A.\n (2010), \u201cNeutralization: new insights into the problem of employee information systems security policy violations\u201d, MIS Quarterly: Management Information Systems, Vol. 34, Special Issue 3, pp. 487-502, available at: www.scopus.com\/inward\/record.url?eid=2-s2.0-77957068563&partnerID=40&md5=c6ecfa7e63590aa13b8e6870bbc9c576."},{"key":"key2021010301431759300_b39","doi-asserted-by":"crossref","unstructured":"Siponen, M.\n , \n Pahnila, S.\n and \n Mahmood, A.\n (2006), \u201cFactors influencing protection motivation and IS security policy a compliance\u201d, 2006 Innovations in Information Technology, IIT, Dubai, United Arab Emirates, p. -.","DOI":"10.1109\/INNOVATIONS.2006.301907"},{"key":"key2021010301431759300_b40","doi-asserted-by":"crossref","unstructured":"Siponen, M.\n , \n Pahnila, S.\n and \n Mahmood, A.\n (2007), \u201cEmployees' adherence to information security policies: an empirical study\u201d, in \n Venter Eloff, E.L.S.\n (Ed.), IFIP International Federation for Information Processing, Vol. 232, Springer, Berlin, pp. 133-144.","DOI":"10.1007\/978-0-387-72367-9_12"},{"key":"key2021010301431759300_b41","doi-asserted-by":"crossref","unstructured":"Siponen, M.\n , \n Pahnila, S.\n and \n Mahmood, A.\n (2010), \u201cCompliance with information security policies: an empirical investigation\u201d, Computer, Vol. 43 No. 2, pp. 64-71.","DOI":"10.1109\/MC.2010.35"},{"key":"key2021010301431759300_b43","doi-asserted-by":"crossref","unstructured":"Son, J.-Y.\n (2011), \u201cOut of fear or desire? Toward a better understanding of employees' motivation to follow IS security policies\u201d, Information & Management, Vol. 48 No. 7, pp. 296-302.","DOI":"10.1016\/j.im.2011.07.002"},{"key":"key2021010301431759300_b44","doi-asserted-by":"crossref","unstructured":"Staples, M.\n and \n Niazi, M.\n (2007), \u201cExperiences using systematic review guidelines\u201d, Journal of Systems and Software, Vol. 80 No. 9, pp. 1425-1437.","DOI":"10.1016\/j.jss.2006.09.046"},{"key":"key2021010301431759300_b45","doi-asserted-by":"crossref","unstructured":"Straub, D.W.\n and \n Welke, R.J.\n (1998), \u201cCoping with systems risk: security planning models for management decision making\u201d, MIS Quarterly, Vol. 22 No. 4, pp. 441-469.","DOI":"10.2307\/249551"},{"key":"key2021010301431759300_b46","unstructured":"The Cochrane Collaboration\n (2002), \u201cDiversity and heterogeneity\u201d, Cochrane Collaboration Open Learning Material for Reviewers, available at: www.cochrane-net.org\/openlearning\/html\/mod13-4.htm (accessed 24 March 2012)."},{"key":"key2021010301431759300_b49","unstructured":"Vance, A.\n (2010a), \u201cIS security policy violations: a rational choice perspective\u201d, Why Do Employees Violate is Security Policies? Insights from Multiple Theoretical Perspectives, Faculty of Science, Department of Information Processing Science, University of Oulu, Oulu, pp. 77-92."},{"key":"key2021010301431759300_b48","unstructured":"Vance, A.\n (2010b), \u201cMotivating IS security compliance: insights from habit and protection motivation theory\u201d, Why Do Employees Violate is Security Policies? Insights from Multiple Theoretical Perspectives, Faculty of Science, Department of Information Processing Science, University of Oulu, Oulu, pp. 93-110."},{"key":"key2021010301431759300_b47","unstructured":"Vance, A.\n (2010c), \u201cNeutralization: new insight into the problem of employee IS security policy violations\u201d, Why Do Employees Violate is Security Policies? Insights from Multiple Theoretical Perspectives, Faculty of Science, Department of Information Processing Science, University of Oulu, Oulu, pp. 47-76."},{"key":"key2021010301431759300_b50","unstructured":"Wiatrowski, M.\n , \n Griswold, D.\n and \n Roberts, M.\n (1981), \u201cSocial control theory and delinquency\u201d, American Sociological Review, Vol. 46 No. 5, pp. 525-541, available at: www.jstor.org\/stable\/10.2307\/2094936."},{"key":"key2021010301431759300_b51","doi-asserted-by":"crossref","unstructured":"Workman, M.\n and \n Gathegi, J.\n (2007), \u201cPunishment and ethics deterrents: a study of insider security contravention\u201d, Journal of the American Society for Information Science and Technology, Vol. 58 No. 2, pp. 212-222.","DOI":"10.1002\/asi.20474"},{"key":"key2021010301431759300_b52","doi-asserted-by":"crossref","unstructured":"Xue, Y.\n , \n Liang, H.\n and \n Wu, L.\n (2010), \u201cPunishment, justice, and compliance in mandatory IT settings\u201d, Information Systems Research, Vol. 22 No. 2, pp. 400-414.","DOI":"10.1287\/isre.1090.0266"},{"key":"key2021010301431759300_b53","doi-asserted-by":"crossref","unstructured":"Zhang, J.\n , \n Reithel, B.J.\n and \n Li, H.\n (2009), \u201cImpact of perceived technical protection on security behaviors\u201d, Information Management & Computer Security, Vol. 17 No. 4, pp. 330-340.","DOI":"10.1108\/09685220910993980"}],"container-title":["Information Management & Computer Security"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/www.emeraldinsight.com\/doi\/full-xml\/10.1108\/IMCS-08-2012-0045","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/IMCS-08-2012-0045\/full\/xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/IMCS-08-2012-0045\/full\/html","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,24]],"date-time":"2025-07-24T21:50:47Z","timestamp":1753393847000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.emerald.com\/ics\/article\/22\/1\/42-75\/176022"}},"subtitle":["A systematic review of quantitative studies"],"short-title":[],"issued":{"date-parts":[[2014,3,4]]},"references-count":53,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2014,3,4]]}},"alternative-id":["10.1108\/IMCS-08-2012-0045"],"URL":"https:\/\/doi.org\/10.1108\/imcs-08-2012-0045","relation":{},"ISSN":["0968-5227"],"issn-type":[{"value":"0968-5227","type":"print"}],"subject":[],"published":{"date-parts":[[2014,3,4]]}}}