{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,26]],"date-time":"2026-09-26T15:24:20Z","timestamp":1790436260782,"version":"4.1.0"},"reference-count":97,"publisher":"Emerald","issue":"3","license":[{"start":{"date-parts":[[2019,6,3]],"date-time":"2019-06-03T00:00:00Z","timestamp":1559520000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.emerald.com\/insight\/site-policies"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["ITP"],"published-print":{"date-parts":[[2019,6,3]]},"abstract":"<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Purpose<\/jats:title>\n<jats:p>The purpose of this paper is to unfold the perceptions around additional security in cloud environments by highlighting the importance of controlling mechanisms as an approach to the ethical use of the systems. The study focuses on the effects of the controlling mechanisms in maintaining an overall secure position for the cloud and the mediating role of the ethical behavior in this relationship.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Design\/methodology\/approach<\/jats:title>\n<jats:p>A case study was conducted, examining the adoption of managed cloud security services as a means of control, as well as a large-scale survey with the views of IT decision makers about the effects of such adoption to the overall cloud security.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Findings<\/jats:title>\n<jats:p>The findings indicate that there is indeed a positive relationship between the adoption of controlling mechanisms and the maintenance of overall cloud security, which increases when the users follow an ethical behavior in the use of the cloud. A framework based on the findings is built suggesting a research agenda for the future and a conceptualization of the field.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Research limitations\/implications<\/jats:title>\n<jats:p>One of the major limitations of the study is the fact that the data collection was based on the perceptions of IT decision makers from a cross-section of industries; however the proposed framework should also be examined in industry-specific context. Although the firm size was indicated as a high influencing factor, it was not considered for this study, as the data collection targeted a range of organizations from various sizes.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Originality\/value<\/jats:title>\n<jats:p>This study extends the research of IS security behavior based on the notion that individuals (clients and providers of cloud infrastructure) are protecting something separate from themselves, in a cloud-based environment, sharing responsibility and trust with their peers. The organization in this context is focusing on managed security solutions as a proactive measurement to preserve cloud security in cloud environments.<\/jats:p>\n<\/jats:sec>","DOI":"10.1108\/itp-04-2017-0131","type":"journal-article","created":{"date-parts":[[2018,7,12]],"date-time":"2018-07-12T10:59:21Z","timestamp":1531393161000},"page":"516-537","source":"Crossref","is-referenced-by-count":16,"title":["Organizational cloud security and control: a proactive approach"],"prefix":"10.1108","volume":"32","author":[{"given":"Konstantina","family":"Spanaki","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zeynep","family":"G\u00fcrg\u00fc\u00e7","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Catherine","family":"Mulligan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Emil","family":"Lupu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"140","reference":[{"issue":"2","key":"key2020092313345673300_ref001","doi-asserted-by":"crossref","first-page":"179","DOI":"10.1016\/0749-5978(91)90020-T","article-title":"The theory of planned behavior","volume":"50","year":"1991","journal-title":"Organizational Behavior and Human Decision Processes"},{"key":"key2020092313345673300_ref002","doi-asserted-by":"crossref","first-page":"357","DOI":"10.1016\/j.ins.2015.01.025","article-title":"Security in cloud computing: opportunities and challenges","volume":"305","year":"2015","journal-title":"Information Sciences"},{"issue":"3","key":"key2020092313345673300_ref003","doi-asserted-by":"crossref","first-page":"250","DOI":"10.1108\/17410391311325225","article-title":"Cloud computing adoption by SMEs in the North East of England: a multi\u2010perspective framework","volume":"26","year":"2013","journal-title":"Journal of Ent Info Management"},{"key":"key2020092313345673300_ref004","first-page":"5490","article-title":"Cloud computing security: from single to multi-clouds","year":"2012"},{"issue":"3","key":"key2020092313345673300_ref005","doi-asserted-by":"crossref","first-page":"613","DOI":"10.2307\/25750694","article-title":"Practicing safe computing: a multimedia empirical examination of home computer user security behavioral intentions","volume":"34","year":"2010","journal-title":"MIS Quarterly"},{"issue":"3","key":"key2020092313345673300_ref006","doi-asserted-by":"crossref","first-page":"411","DOI":"10.1037\/0033-2909.103.3.411","article-title":"Structural equation modeling in practice: a review and recommended two-step approach","volume":"103","year":"1988","journal-title":"Psychological Bulletin"},{"issue":"4","key":"key2020092313345673300_ref007","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1145\/1721654.1721672","article-title":"A view of cloud computing","volume":"53","year":"2010","journal-title":"Communications of the ACM"},{"issue":"3","key":"key2020092313345673300_ref008","doi-asserted-by":"crossref","first-page":"243","DOI":"10.2307\/4132332","article-title":"Evidence of the effect of trust building technology in electronic markets: price premiums and buyer behavior","volume":"26","year":"2002","journal-title":"MIS Quarterly"},{"issue":"1","key":"key2020092313345673300_ref009","doi-asserted-by":"crossref","first-page":"74","DOI":"10.1007\/BF02723327","article-title":"On the evaluation of structural equation models","volume":"16","year":"1988","journal-title":"Journal of the Academy of Marketing Science"},{"issue":"2","key":"key2020092313345673300_ref010","doi-asserted-by":"crossref","first-page":"155","DOI":"10.1108\/ITP-11-2011-0068","article-title":"An emote opportunity model of computer abuse","volume":"27","year":"2014","journal-title":"Info Technology & People"},{"issue":"3","key":"key2020092313345673300_ref011","doi-asserted-by":"crossref","first-page":"369","DOI":"10.2307\/248684","article-title":"The case research strategy in studies of information systems","volume":"11","year":"1987","journal-title":"MIS Quarterly"},{"issue":"4","key":"key2020092313345673300_ref012","doi-asserted-by":"crossref","first-page":"837","DOI":"10.25300\/MISQ\/2015\/39.4.5","article-title":"What do users have to fear? Using fear appeals to engender threats and fear that motivate protective security behaviors","volume":"39","year":"2015","journal-title":"MIS Quarterly (MISQ)"},{"issue":"2","key":"key2020092313345673300_ref013","doi-asserted-by":"crossref","first-page":"151","DOI":"10.1057\/ejis.2009.8","article-title":"If someone is watching, I\u2019ll do what I\u2019m asked: mandatoriness, control, and information security","volume":"18","year":"2009","journal-title":"European Journal of Information Systems"},{"key":"key2020092313345673300_ref014","volume-title":"Transforming Qualitative Information: Thematic Analysis and Code Development","year":"1998"},{"issue":"2","key":"key2020092313345673300_ref015","doi-asserted-by":"crossref","first-page":"77","DOI":"10.1191\/1478088706qp063oa","article-title":"Using thematic analysis in psychology","volume":"3","year":"2006","journal-title":"Qualitative Research in Psychology"},{"issue":"3","key":"key2020092313345673300_ref016","doi-asserted-by":"crossref","first-page":"523","DOI":"10.2307\/25750690","article-title":"Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness","volume":"34","year":"2010","journal-title":"MIS Quarterly: Management Information Systems"},{"issue":"6","key":"key2020092313345673300_ref017","doi-asserted-by":"crossref","first-page":"599","DOI":"10.1016\/j.future.2008.12.001","article-title":"Cloud computing and emerging IT platforms: vision, hype, and reality for delivering computing as the 5th utility","volume":"25","year":"2009","journal-title":"Future Generation Computer Systems"},{"issue":"2","key":"key2020092313345673300_ref018","doi-asserted-by":"crossref","first-page":"198","DOI":"10.1287\/isre.1080.0180","article-title":"Configuration of and interaction between information security technologies: the case of firewalls and intrusion detection systems","volume":"20","year":"2009","journal-title":"Information Systems Research"},{"issue":"4","key":"key2020092313345673300_ref019","doi-asserted-by":"crossref","first-page":"49","DOI":"10.1080\/07421222.2014.1001257","article-title":"The behavioral roots of information systems security: exploring key factors related to unethical it use","volume":"31","year":"2015","journal-title":"Journal of Management Information Systems"},{"issue":"1","key":"key2020092313345673300_ref020","doi-asserted-by":"crossref","first-page":"205","DOI":"10.25300\/MISQ\/2016\/40.1.09","article-title":"Individual\u2019s internet security perceptions and behaviors: polycontextual contrasts between the United States and China","volume":"40","year":"2016","journal-title":"Management Information Systems Quarterly"},{"issue":"3","key":"key2020092313345673300_ref021","doi-asserted-by":"crossref","first-page":"157","DOI":"10.2753\/MIS0742-1222290305","article-title":"Organizations\u2019 information security policy compliance: stick or carrot approach?","volume":"29","year":"2012","journal-title":"Journal of Management Information Systems"},{"issue":"1","key":"key2020092313345673300_ref022","doi-asserted-by":"crossref","first-page":"64","DOI":"10.1177\/002224377901600110","article-title":"Paradigm of for developing constructs measures","volume":"16","year":"1979","journal-title":"Journal of Marketing Research"},{"issue":"3","key":"key2020092313345673300_ref023","doi-asserted-by":"crossref","first-page":"623","DOI":"10.1046\/j.1365-2648.1997.t01-25-00999.x","article-title":"Sampling in qualitative research. Purposeful and theoretical sampling; merging or clear boundaries?","volume":"26","year":"1997","journal-title":"Journal of Advanced Nursing"},{"key":"key2020092313345673300_ref024","unstructured":"CSA (2015), \u201cCloud adoption practices & priorities survey report\u201d, available at: https:\/\/cloudsecurityalliance.org\/research\/surveys\/ (accessed December 10, 2017)."},{"issue":"6","key":"key2020092313345673300_ref025","doi-asserted-by":"crossref","first-page":"643","DOI":"10.1057\/ejis.2011.23","article-title":"A review and analysis of deterrence theory in the IS security literature: making sense of the disparate findings","volume":"20","year":"2011","journal-title":"European Journal of Information Systems"},{"issue":"2","key":"key2020092313345673300_ref026","doi-asserted-by":"crossref","first-page":"285","DOI":"10.2753\/MIS0742-1222310210","article-title":"Understanding employee responses to stressful information security requirements: a coping perspective","volume":"31","year":"2014","journal-title":"Journal of Management Information Systems"},{"issue":"1","key":"key2020092313345673300_ref027","doi-asserted-by":"crossref","first-page":"79","DOI":"10.1287\/isre.1070.0160","article-title":"User awareness of security countermeasures and its impact on information systems misuse: a deterrence approach","volume":"20","year":"2009","journal-title":"Information Systems Research"},{"issue":"6","key":"key2020092313345673300_ref028","doi-asserted-by":"crossref","first-page":"449","DOI":"10.1016\/j.ijinfomgt.2009.05.003","article-title":"The information security policy unpacked: a critical study of the content of university policies","volume":"29","year":"2009","journal-title":"International Journal of Information Management"},{"key":"key2020092313345673300_ref029","first-page":"214","article-title":"A literature review on cloud computing adoption issues in enterprises","year":"2014"},{"issue":"3","key":"key2020092313345673300_ref030","doi-asserted-by":"crossref","first-page":"272","DOI":"10.1037\/1082-989X.4.3.272","article-title":"Evaluating the use of exploratory factor analysis in psychological research","volume":"4","year":"1999","journal-title":"Psychological Methods"},{"issue":"3","key":"key2020092313345673300_ref031","doi-asserted-by":"crossref","first-page":"382","DOI":"10.1177\/002224378101800313","article-title":"Structural equation models with unobservable variables and measurement error: algebra and statistics","volume":"18","year":"1981","journal-title":"Journal of Marketing Research"},{"issue":"2","key":"key2020092313345673300_ref032","doi-asserted-by":"crossref","first-page":"186","DOI":"10.1287\/isre.1050.0053","article-title":"The economic incentives for sharing security information","volume":"16","year":"2005","journal-title":"Information Systems Research"},{"issue":"9","key":"key2020092313345673300_ref033","doi-asserted-by":"crossref","first-page":"62","DOI":"10.1145\/2330667.2330685","article-title":"Success factors for deploying cloud computing","volume":"55","year":"2012","journal-title":"Communications of the ACM"},{"issue":"2","key":"key2020092313345673300_ref034","doi-asserted-by":"crossref","first-page":"iii","DOI":"10.2307\/23044042","article-title":"An update and extension to SEM guidelines for admnistrative and social science research","volume":"35","year":"2011","journal-title":"MIS Quarterly"},{"issue":"2","key":"key2020092313345673300_ref035","doi-asserted-by":"crossref","first-page":"92","DOI":"10.1108\/09593840910962186","article-title":"Developing expertise for network intrusion detection","volume":"22","year":"2009","journal-title":"Info Technology & People"},{"issue":"1","key":"key2020092313345673300_ref036","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1186\/2192-113X-1-19","article-title":"Trust as a facilitator in cloud computing: a survey","volume":"1","year":"2012","journal-title":"Journal of Cloud Computing: Advances, Systems and Applications"},{"key":"key2020092313345673300_ref037","year":"2016","journal-title":"A Primer on Partial Least Squares Structural Equation Modeling (PLS-SEM)"},{"issue":"3","key":"key2020092313345673300_ref038","doi-asserted-by":"crossref","first-page":"337","DOI":"10.2753\/MIS0742-1222250310","article-title":"Investments in information security: a real options perspective with bayesian postaudit","volume":"25","year":"2008","journal-title":"Journal of Management Information Systems"},{"issue":"2","key":"key2020092313345673300_ref039","doi-asserted-by":"crossref","first-page":"106","DOI":"10.1057\/ejis.2009.6","article-title":"Protection motivation and deterrence: a framework for security policy compliance in organisations","volume":"18","year":"2009","journal-title":"European Journal of Information Systems"},{"issue":"3","key":"key2020092313345673300_ref040","first-page":"918","article-title":"Institutional influences on information systems security innovations","volume":"23","year":"2012","journal-title":"Information Systems Research"},{"issue":"2","key":"key2020092313345673300_ref041","doi-asserted-by":"crossref","first-page":"282","DOI":"10.1287\/isre.2015.0569","article-title":"The role of extra-role behaviors and social controls in information security policy effectiveness","volume":"26","year":"2015","journal-title":"Information Systems Research"},{"issue":"4","key":"key2020092313345673300_ref042","doi-asserted-by":"crossref","first-page":"6","DOI":"10.1080\/07421222.2014.1001255","article-title":"The role of self-control in information security violations: insights from a cognitive neuroscience perspective","volume":"31","year":"2015","journal-title":"Journal of Management Information Systems"},{"issue":"1","key":"key2020092313345673300_ref043","doi-asserted-by":"crossref","first-page":"9","DOI":"10.1186\/2192-113X-2-9","article-title":"Trust mechanisms for cloud computing","volume":"2","year":"2013","journal-title":"Journal of Cloud Computing: Advances, Systems and Applications"},{"issue":"3","key":"key2020092313345673300_ref044","doi-asserted-by":"crossref","first-page":"549","DOI":"10.2307\/25750691","article-title":"Fear appeals and Information security behaviors: an empirical study","volume":"34","year":"2010","journal-title":"MIS Quarterly"},{"issue":"1","key":"key2020092313345673300_ref045","doi-asserted-by":"crossref","first-page":"113","DOI":"10.25300\/MISQ\/2015\/39.1.06","article-title":"An enhanced fear appeal rhetorical framework: leveraging threats to the human asset through sanctioning rhetoric","volume":"39","year":"2015","journal-title":"MIS Quarterly"},{"issue":"3","key":"key2020092313345673300_ref046","doi-asserted-by":"crossref","first-page":"135","DOI":"10.1007\/s12599-011-0153-9","article-title":"Secure and sustainable benchmarking in clouds","volume":"3","year":"2011","journal-title":"Business & Information Systems Engineering"},{"key":"key2020092313345673300_ref047","first-page":"169","article-title":"Exploratory and confirmatory factor analysis","year":"2013","journal-title":"Applied Quantitative Analysis in Education and the Social Sciences"},{"issue":"3","key":"key2020092313345673300_ref048","doi-asserted-by":"crossref","first-page":"71","DOI":"10.1145\/1325555.1325569","article-title":"Promoting personal responsibility for internet safety","volume":"51","year":"2008","journal-title":"Communications of the ACM"},{"issue":"1","key":"key2020092313345673300_ref049","doi-asserted-by":"crossref","first-page":"70","DOI":"10.1287\/isre.2015.0607","article-title":"Mandatory standards and organizational information security","volume":"27","year":"2016","journal-title":"Information Systems Research"},{"issue":"2","key":"key2020092313345673300_ref050","doi-asserted-by":"crossref","first-page":"177","DOI":"10.1057\/ejis.2009.11","article-title":"Threat or coping appraisal: determinants of SMB executives\u2019 decision to adopt anti-malware software","volume":"18","year":"2009","journal-title":"European Journal of Information Systems"},{"issue":"1","key":"key2020092313345673300_ref051","doi-asserted-by":"crossref","first-page":"71","DOI":"10.2307\/20650279","article-title":"Avoidance of information technology threats: a theoretical perspective","volume":"33","year":"2009","journal-title":"MIS Quarterly: Management Information Systems"},{"issue":"7","key":"key2020092313345673300_ref052","doi-asserted-by":"crossref","first-page":"394","DOI":"10.17705\/1jais.00232","article-title":"Understanding security behaviors in personal computer usage: a threat avoidance perspective","volume":"11","year":"2010","journal-title":"Journal of the Association for Information Systems"},{"issue":"1","key":"key2020092313345673300_ref053","doi-asserted-by":"crossref","first-page":"62","DOI":"10.1016\/S0167-4048(02)00109-8","article-title":"Insider threat prediction tool: evaluating the probability of IT misuse","volume":"21","year":"2001","journal-title":"Computers & Security"},{"issue":"1","key":"key2020092313345673300_ref054","doi-asserted-by":"crossref","first-page":"176","DOI":"10.1016\/j.dss.2010.12.006","article-title":"Cloud computing \u2014 the business perspective","volume":"51","year":"2011","journal-title":"Decision Support Systems"},{"key":"key2020092313345673300_ref055","first-page":"145","article-title":"The NIST definition of cloud computing","volume":"800,","year":"2011","journal-title":"NIST Special Publication"},{"issue":"4","key":"key2020092313345673300_ref056","doi-asserted-by":"crossref","first-page":"657","DOI":"10.1016\/j.compind.2014.01.017","article-title":"The challenge of networked enterprises for cloud computing interoperability","volume":"65","year":"2014","journal-title":"Computers in Industry"},{"key":"key2020092313345673300_ref057","volume-title":"Qualitative Data Analysis: An Expanded Sourcebook","year":"1994","edition":"2nd ed."},{"issue":"3","key":"key2020092313345673300_ref058","doi-asserted-by":"crossref","first-page":"606","DOI":"10.1287\/isre.1100.0341","article-title":"When hackers talk: managing information security under variable attack rates and knowledge dissemination","volume":"22","year":"2011","journal-title":"Information Systems Research"},{"issue":"2","key":"key2020092313345673300_ref059","doi-asserted-by":"crossref","first-page":"126","DOI":"10.1057\/ejis.2009.10","article-title":"What levels of moral reasoning and values explain adherence to information security rules? An empirical study\u201d","volume":"18","year":"2009","journal-title":"European Journal of Information Systems"},{"key":"key2020092313345673300_ref060","volume-title":"Psychometric Theory","year":"1978"},{"key":"key2020092313345673300_ref061","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1287\/isre.2.1.1","article-title":"Studying information technology in organizations: research approaches and assumptions","volume":"2","year":"1991","journal-title":"Information Systems Research"},{"issue":"2","key":"key2020092313345673300_ref062","first-page":"1","article-title":"What is rotating in exploratory factor analysis?","volume":"20","year":"2015","journal-title":"Practical Assessment, Research & Evaluation"},{"issue":"7","key":"key2020092313345673300_ref063","first-page":"1","article-title":"Best practices in exploratory factor analysis: four recommendations for getting the most from your analysis","volume":"10","year":"2005","journal-title":"Practical Assessment, Research & Evaluation"},{"key":"key2020092313345673300_ref064","first-page":"63","volume-title":"A Conceptual FrameWork for the Design of Organizational Control Mechanisms","year":"1979"},{"key":"key2020092313345673300_ref065","first-page":"156b","article-title":"Employees\u2019 behavior towards IS security policy compliance","year":"2007"},{"key":"key2020092313345673300_ref066","first-page":"230","article-title":"Designing qualitative studies","year":"2002","journal-title":"Qualitative Research Evaluation Methods"},{"issue":"1","key":"key2020092313345673300_ref067","doi-asserted-by":"crossref","first-page":"115","DOI":"10.2307\/25148720","article-title":"Understanding and predicting electronic commerce adoption: an extension of the theory of planned behavior","volume":"30","year":"2006","journal-title":"MIS Quarterly"},{"key":"key2020092313345673300_ref068","first-page":"3","volume-title":"Privacy, Security and Trust in Cloud Computing","year":"2013"},{"issue":"5","key":"key2020092313345673300_ref069","doi-asserted-by":"crossref","first-page":"879","DOI":"10.1037\/0021-9010.88.5.879","article-title":"Common method biases in behavioral research: a critical review of the literature and recommended remedies","volume":"88","year":"2003","journal-title":"Journal of Applied Psychology"},{"issue":"4","key":"key2020092313345673300_ref070","doi-asserted-by":"crossref","first-page":"757","DOI":"10.2307\/25750704","article-title":"Improving employees\u2019 compliance through information systems security training: an action research study","volume":"34","year":"2010","journal-title":"MIS Quarterly"},{"key":"key2020092313345673300_ref071","article-title":"A secure cloud internetwork model with economic and social incentives (SCIMES)","year":"2012"},{"key":"key2020092313345673300_ref072","doi-asserted-by":"crossref","first-page":"44","DOI":"10.1016\/j.infsof.2014.10.003","article-title":"Empirical evaluation of a cloud computing information security governance framework","volume":"58","year":"2015","journal-title":"Information and Software Technology"},{"issue":"1","key":"key2020092313345673300_ref073","first-page":"96","article-title":"Building safe PaaS clouds: a survey on security in multitenant software platforms","volume":"1","year":"2012","journal-title":"Computers & Security"},{"key":"key2020092313345673300_ref074","doi-asserted-by":"crossref","first-page":"357","DOI":"10.1016\/j.procs.2014.08.053","article-title":"State-of-the-art survey on cloud computing security challenges, approaches and solutions","volume":"37","year":"2014","journal-title":"Procedia Computer Science"},{"issue":"1","key":"key2020092313345673300_ref075","doi-asserted-by":"crossref","first-page":"20","DOI":"10.5465\/amj.2007.24160882","article-title":"Persuasion with case studies","volume":"50","year":"2007","journal-title":"Academy of Management Journal"},{"issue":"7","key":"key2020092313345673300_ref076","doi-asserted-by":"crossref","first-page":"445","DOI":"10.17705\/1jais.00095","article-title":"Six design theories for is security policies and guidelines","volume":"7","year":"2006","journal-title":"Journal of the Association for Information Systems"},{"issue":"3","key":"key2020092313345673300_ref077","doi-asserted-by":"crossref","first-page":"487","DOI":"10.2307\/25750688","article-title":"Neutralization: new insights into the problem of employee information systems security policy violations","volume":"34","year":"2010","journal-title":"MIS Quarterly: Management Information Systems"},{"issue":"11","key":"key2020092313345673300_ref078","doi-asserted-by":"crossref","first-page":"725","DOI":"10.17705\/1jais.00107","article-title":"A design theory for secure information systems design methods","volume":"7","year":"2006","journal-title":"Journal of the Association for Information Systems"},{"issue":"1","key":"key2020092313345673300_ref079","doi-asserted-by":"crossref","first-page":"77","DOI":"10.1111\/j.1365-2575.2011.00378.x","article-title":"Information security policies in the UK healthcare sector: a critical evaluation","volume":"22","year":"2012","journal-title":"Information Systems Journal"},{"issue":"2","key":"key2020092313345673300_ref080","doi-asserted-by":"crossref","first-page":"219","DOI":"10.1287\/isre.2016.0634","article-title":"Examining the continuance of secure behavior: a longitudinal field study of mobile device authentication","volume":"27","year":"2016","journal-title":"Information Systems Research"},{"issue":"4","key":"key2020092313345673300_ref081","first-page":"441","article-title":"Coping with systems risk: security planning models for management decision making","volume":"32","year":"1998","journal-title":"MIS Quarterly"},{"issue":"3","key":"key2020092313345673300_ref082","doi-asserted-by":"crossref","first-page":"255","DOI":"10.1287\/isre.1.3.255","article-title":"Effective IS security: an empirical study","volume":"1","year":"1990","journal-title":"Information Systems Research"},{"issue":"1","key":"key2020092313345673300_ref083","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.jnca.2010.07.006","article-title":"A survey on security issues in service delivery models of cloud computing","volume":"34","year":"2011","journal-title":"Journal of Network and Computer Applications"},{"issue":"2","key":"key2020092313345673300_ref084","doi-asserted-by":"crossref","first-page":"63","DOI":"10.3316\/QRJ1102063","article-title":"Purposeful sampling in qualitative research synthesis","volume":"11","year":"2011","journal-title":"Qualitative Research Journal"},{"issue":"1","key":"key2020092313345673300_ref085","doi-asserted-by":"crossref","first-page":"395","DOI":"10.3102\/0034654308326349","article-title":"Advancements in research synthesis methods: from a methodologically inclusive perspective","volume":"79","year":"2009","journal-title":"Review of Educational Research"},{"key":"key2020092313345673300_ref086","first-page":"5500","article-title":"Policy management as a service: an approach to manage policy heterogeneity in cloud computing environment","year":"2012"},{"issue":"6","key":"key2020092313345673300_ref087","doi-asserted-by":"crossref","first-page":"24","DOI":"10.1109\/MSP.2010.186","article-title":"Security and privacy challenges in cloud computing environments","volume":"8","year":"2010","journal-title":"IEEE Security and Privacy"},{"issue":"3","key":"key2020092313345673300_ref088","doi-asserted-by":"crossref","first-page":"327","DOI":"10.1108\/09593841211254358","article-title":"Analyzing trajectories of information security awareness","volume":"25","year":"2012","journal-title":"Info Technology & People"},{"issue":"3","key":"key2020092313345673300_ref089","first-page":"190","article-title":"Motivating IS security compliance: insights from habit and protection motivation theory","volume":"49","year":"2012","journal-title":"Information & Management"},{"issue":"1","key":"key2020092313345673300_ref090","doi-asserted-by":"crossref","first-page":"93","DOI":"10.1007\/s00607-010-0140-x","article-title":"Locking the sky: a survey on IaaS cloud security","volume":"91","year":"2011","journal-title":"Computing"},{"issue":"1","key":"key2020092313345673300_ref091","doi-asserted-by":"crossref","first-page":"91","DOI":"10.25300\/MISQ\/2015\/39.1.05","article-title":"Insider threats in a financial institution: analysis of attack-proneness of information systems applications","volume":"39","year":"2015","journal-title":"MIS Quarterly"},{"issue":"3","key":"key2020092313345673300_ref092","doi-asserted-by":"crossref","first-page":"194","DOI":"10.17705\/1jais.00424","article-title":"Neural correlates of protection motivation for secure IT behaviors: an fMRI examination","volume":"17","year":"2016","journal-title":"Journal of the Association for Information Systems"},{"issue":"6","key":"key2020092313345673300_ref093","doi-asserted-by":"crossref","first-page":"2799","DOI":"10.1016\/j.chb.2008.04.005","article-title":"Security lapses and the omission of information security measures: a threat control model and empirical test","volume":"24","year":"2008","journal-title":"Computers in Human Behavior"},{"key":"key2020092313345673300_ref094","volume-title":"Case Study Research: Design and Methods","year":"2009","edition":"4th ed."},{"issue":"4","key":"key2020092313345673300_ref095","doi-asserted-by":"crossref","first-page":"401","DOI":"10.1108\/ITP-12-2012-0147","article-title":"Understanding computer security behavioral intention in the workplace: an empirical study of Korean firms","volume":"26","year":"2013","journal-title":"Info Technology & People"},{"key":"key2020092313345673300_ref096","volume-title":"Access Control and Trust Management for Emerging Multidomain Environments","year":"2009"},{"issue":"3","key":"key2020092313345673300_ref097","doi-asserted-by":"crossref","first-page":"583","DOI":"10.1016\/j.future.2010.12.006","article-title":"Addressing cloud computing security issues","volume":"28","year":"2012","journal-title":"Future Generation Computer Systems"}],"container-title":["Information Technology &amp; People"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ITP-04-2017-0131\/full\/xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ITP-04-2017-0131\/full\/html","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,24]],"date-time":"2025-07-24T21:54:36Z","timestamp":1753394076000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.emerald.com\/itp\/article\/32\/3\/516-537\/184242"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,6,3]]},"references-count":97,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2019,6,3]]}},"alternative-id":["10.1108\/ITP-04-2017-0131"],"URL":"https:\/\/doi.org\/10.1108\/itp-04-2017-0131","relation":{},"ISSN":["0959-3845"],"issn-type":[{"value":"0959-3845","type":"print"}],"subject":[],"published":{"date-parts":[[2019,6,3]]}}}