{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,22]],"date-time":"2026-10-22T00:31:32Z","timestamp":1792629092077,"version":"4.5.0"},"reference-count":110,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2017,8,2]],"date-time":"2017-08-02T00:00:00Z","timestamp":1501632000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGMIS Database"],"published-print":{"date-parts":[[2017,8,2]]},"abstract":"<jats:p>Despite the importance of information security, far too many organizations, in particular banks, are facing behavioral information security incidents. In the context given by the headquarters of a large European banking organization, this single case study investigates whether individual behavioral compliance with the information security policy is influenced by accumulated security information and information security awareness embedded within the theory of reasoned action in an extended norms approach. We collected empirical data through a three-staged process in which we conducted semi-structured interviews, implemented a survey to test the developed research hypotheses, and engaged in interactive presentations to discuss the results. In particular, the qualitative interviews strengthened internal validity of survey constructs related to neutralization techniques and internal channel use for information acquisition. We found that the attitude toward information security policy compliance, and not only social norms but also personal norms related to neutralization techniques, are all significant variables potentially mitigating the knowing-doing gap reported in related information security research. Besides emphasizing the importance of extended norms, which should be accounted for in information security awareness programs, we also highlight the use of internal and external channels to acquire information as initial drivers of awareness. The empirical findings provide implications to practice and advance theoretical development by generally supporting the developed model that accounts for compliant information security behavior at an international bank.<\/jats:p>","DOI":"10.1145\/3130515.3130519","type":"journal-article","created":{"date-parts":[[2017,8,2]],"date-time":"2017-08-02T19:36:12Z","timestamp":1501702572000},"page":"44-68","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":82,"title":["From Information Security Awareness to Reasoned Compliant Action"],"prefix":"10.1145","volume":"48","author":[{"given":"Stefan","family":"Bauer","sequence":"first","affiliation":[{"name":"WU-Vienna University of Economics and Business, Vienna, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Edward W.N.","family":"Bernroider","sequence":"additional","affiliation":[{"name":"WU-Vienna University of Economics and Business, Vienna, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2017,8,2]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1080\/0144929X.2012.708787"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.2308\/jis.2006.20.1.187"},{"key":"e_1_2_1_3_1","first-page":"11","volume-title":"Heidelberg: Springer","author":"Ajzen I.","year":"1985"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1016\/0749-5978(91)90020-T"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2009.12.005"},{"key":"e_1_2_1_6_1","first-page":"798","volume-title":"MA: Clark University Press","author":"Allport G. W.","year":"1935"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1348\/014466601164939"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1038\/oby.2003.222"},{"issue":"2","key":"e_1_2_1_9_1","first-page":"285","article-title":"The Partial Least Squares (PLS) Approach to Causal Modeling: Personal Computer Adoption and Use as an Illustration","volume":"2","author":"Barclay D.","year":"1995","journal-title":"Technology Studies"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.05.006"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1037\/0022-3514.51.6.1173"},{"key":"e_1_2_1_12_1","first-page":"30","volume-title":"Lisbon","author":"Bauer S.","year":"2013"},{"key":"e_1_2_1_13_1","first-page":"154","article-title":"The Effects of Awareness Programs on Information Security in Banks: The Roles of Protection Motivation and Monitoring,\" in Human Aspects of Information Security, Privacy, and Trust","volume":"9190","author":"Bauer S.","year":"2015","journal-title":"Springer International Publishing"},{"key":"e_1_2_1_14_1","unstructured":"Bauer S. Bernroider E. W. N. & Chudzikowski K. (2013). \"End User Information Security Awareness Programs for Improving Information Security in Banking Organizations: Preliminary Results from an Exploratory Study.\" AIS SIGSEC Workshop on Information Security & Privacy (WISP'13) Milano.  Bauer S. Bernroider E. W. N. & Chudzikowski K. (2013). \"End User Information Security Awareness Programs for Improving Information Security in Banking Organizations: Preliminary Results from an Exploratory Study.\" AIS SIGSEC Workshop on Information Security & Privacy (WISP'13) Milano."},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-49944-4_10"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2009.8"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.5555\/2017470.2017477"},{"key":"e_1_2_1_18_1","first-page":"94","volume-title":"New York: McGraw-Hill","author":"Campbell D. T.","year":"1963"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.5555\/2017434.2017440"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/2544415.2544420"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1177\/009365086013003006"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.chb.2014.05.043"},{"key":"e_1_2_1_23_1","first-page":"295","volume-title":"New Jersey: Lawrence Erlbaum Associates","author":"Chin W. W.","year":"1998"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-6486.2006.00647.x"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.2753\/MIS0742-1222280208"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.chb.2012.05.003"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1108\/JCOM-05-2012-0035"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2012.09.010"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1287\/isre.1070.0160"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1037\/0022-3514.49.5.1184"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1108\/09685229910292664"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1365-2575.2007.00289.x"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.4135\/9781446201008.n2"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.5465\/amr.1989.4308385"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.istr.2010.05.002"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1037\/0022-3514.90.4.556"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.im.2008.11.007"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1080\/09540120050042918"},{"key":"e_1_2_1_39_1","unstructured":"Fishbein M. & Ajzen I. (1975). Belief Attitude Intention and Behavior. Reading MA: Addison-Wesley.  Fishbein M. & Ajzen I. (1975). Belief Attitude Intention and Behavior. Reading MA: Addison-Wesley."},{"key":"e_1_2_1_40_1","doi-asserted-by":"crossref","unstructured":"Fishbein M. & Ajzen I. (2010). Predicting and Changing Behavior: The Reasoned Action Approach. Psychology Press Taylor & Francis Group.  Fishbein M. & Ajzen I. (2010). Predicting and Changing Behavior: The Reasoned Action Approach. Psychology Press Taylor & Francis Group.","DOI":"10.4324\/9780203838020"},{"issue":"7","key":"e_1_2_1_41_1","first-page":"1","article-title":"Structural Equation Modeling and Regression: Guidelines for Research Practice","volume":"4","author":"Gefen D.","year":"2000","journal-title":"Communications of the Association for Information Systems"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.17705\/1jais.00275"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2012.10.003"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.2753\/MIS0742-1222280208"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1108\/09685221111153537"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1108\/09685220810908796"},{"key":"e_1_2_1_47_1","unstructured":"Hair J. F. Hult G. T. M. Ringle C. M. & Sarstedt M. (2014). A Primer on Partial Least Squares Structural Equation Modeling (PLS-SEM). Thousand Oaks: SAGE Publications Ltd.  Hair J. F. Hult G. T. M. Ringle C. M. & Sarstedt M. (2014). A Primer on Partial Least Squares Structural Equation Modeling (PLS-SEM). Thousand Oaks: SAGE Publications Ltd."},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11747-011-0261-6"},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.2307\/249656"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1365-2575.2012.00420.x"},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2009.02.005"},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2009.6"},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1057\/jit.2013.15"},{"key":"e_1_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1540-5915.2012.00361.x"},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2011.10.007"},{"key":"e_1_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.im.2013.10.001"},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/1104004.1104010"},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.5555\/2017470.2017478"},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.03.003"},{"issue":"26","key":"e_1_2_1_60_1","first-page":"10862","article-title":"Effectiveness of Information Security Awareness Methods Based on Psychological Theories","volume":"5","author":"Khan B.","year":"2011","journal-title":"African Journal of Business Management"},{"key":"e_1_2_1_61_1","unstructured":"Lanier M. Henry S. & Desire'JM A. (2004). Essential Criminology (4 ed.). Boulder: Perseus Books Group.  Lanier M. Henry S. & Desire'JM A. (2004). Essential Criminology (4 ed.). Boulder: Perseus Books Group."},{"key":"e_1_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1108\/MRR-04-2013-0085"},{"key":"e_1_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2009.12.005"},{"key":"e_1_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1002\/job.161"},{"key":"e_1_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.2308\/isys-10395"},{"key":"e_1_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPC.2014.2312452"},{"key":"e_1_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.1060.0597"},{"key":"e_1_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1086\/655355"},{"key":"e_1_2_1_69_1","first-page":"1","volume-title":"Orlando","author":"Merhi M. I.","year":"2012"},{"key":"e_1_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1177\/002242788101800206"},{"key":"e_1_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.mar.2005.03.001"},{"key":"e_1_2_1_72_1","first-page":"197","volume-title":"New York: John Wiley & Sons","author":"Moore D. L.","year":"2002"},{"key":"e_1_2_1_73_1","unstructured":"Pahnila S. Karjalainen M. & Siponen M. (2013). \"Information Security Behavior: Towards Multi-stage Models.\" Proceedings of the Pacific Asia Conference on Information Systems (PACIS) Jeju Island (Korea).  Pahnila S. Karjalainen M. & Siponen M. (2013). \"Information Security Behavior: Towards Multi-stage Models.\" Proceedings of the Pacific Asia Conference on Information Systems (PACIS) Jeju Island (Korea)."},{"key":"e_1_2_1_74_1","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2007.206"},{"issue":"1","key":"e_1_2_1_75_1","first-page":"233","article-title":"Investigating Information Systems with Positivist Case Research","volume":"13","author":"Pare G.","year":"2004","journal-title":"The Communications of the Association for Information Systems"},{"key":"e_1_2_1_76_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.2044-8309.1995.tb01053.x"},{"key":"e_1_2_1_77_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.12.003"},{"key":"e_1_2_1_78_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2011.12.010"},{"key":"e_1_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1037\/0021-9010.88.5.879"},{"key":"e_1_2_1_80_1","unstructured":"Podsakoff P. M. & Organ D. W. (1986). \"Self-reports in Organizational Research: Problems and Prospects.\" Journal of Management Vol. No. 12: pp. 69--82.  Podsakoff P. M. & Organ D. W. (1986). \"Self-reports in Organizational Research: Problems and Prospects.\" Journal of Management Vol. No. 12: pp. 69--82."},{"key":"e_1_2_1_81_1","unstructured":"PricewaterhouseCoopers. (2014). \"Information Security Breaches Survey.\" The Department for Business Innovation and Skills BIS\/14\/767.  PricewaterhouseCoopers. (2014). \"Information Security Breaches Survey.\" The Department for Business Innovation and Skills BIS\/14\/767."},{"key":"e_1_2_1_82_1","unstructured":"Quagliata K. (2011). \"Impact of Security Awareness Training Components on Perceived Security Effectiveness.\" ISACA Journal [Online Exclusive] 4. Retrieved from http:\/\/www.isaca.org\/Journal\/archives\/2011\/Volume-4\/Pages\/JOnline-Impact-of-Security-Awareness-Training-Components-on-Perceived-Security-Effectiveness.aspx [accessed 31 December 2015]  Quagliata K. (2011). \"Impact of Security Awareness Training Components on Perceived Security Effectiveness.\" ISACA Journal [Online Exclusive] 4. Retrieved from http:\/\/www.isaca.org\/Journal\/archives\/2011\/Volume-4\/Pages\/JOnline-Impact-of-Security-Awareness-Training-Components-on-Perceived-Security-Effectiveness.aspx [accessed 31 December 2015]"},{"key":"e_1_2_1_83_1","doi-asserted-by":"publisher","DOI":"10.1108\/13522750310470055"},{"key":"e_1_2_1_84_1","unstructured":"Ringle C. Wende S. & Will A. (2005). SmartPLS 2.0 (beta). Retrieved 12.1.2012 from University of Hamburg http:\/\/www.smartpls.de  Ringle C. Wende S. & Will A. (2005). SmartPLS 2.0 (beta). Retrieved 12.1.2012 from University of Hamburg http:\/\/www.smartpls.de"},{"key":"e_1_2_1_85_1","doi-asserted-by":"publisher","DOI":"10.1007\/s12144-003-1018-2"},{"key":"e_1_2_1_86_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0953-5438(98)00068-X"},{"key":"e_1_2_1_87_1","unstructured":"Rocha Flores W. & Antonsen E. (2013). \"The Development of an Instrument for Assessing Information Security in Organizations: Examining the Content Validity Using Quantitative Methods.\" Proceedings of the International Conference on Information Resource Management 2013 (Conf-IRM) Natal Brazil pp. 1--15.  Rocha Flores W. & Antonsen E. (2013). \"The Development of an Instrument for Assessing Information Security in Organizations: Examining the Content Validity Using Quantitative Methods.\" Proceedings of the International Conference on Information Resource Management 2013 (Conf-IRM) Natal Brazil pp. 1--15."},{"key":"e_1_2_1_88_1","doi-asserted-by":"publisher","DOI":"10.2753\/MTP1069-6679190202"},{"key":"e_1_2_1_89_1","doi-asserted-by":"publisher","DOI":"10.1037\/1082-989X.7.4.422"},{"key":"e_1_2_1_90_1","doi-asserted-by":"publisher","DOI":"10.1108\/09685220010371394"},{"key":"e_1_2_1_91_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.im.2013.08.006"},{"key":"e_1_2_1_92_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2010.35"},{"key":"e_1_2_1_93_1","doi-asserted-by":"publisher","DOI":"10.5555\/2017470.2017475"},{"key":"e_1_2_1_94_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2012.59"},{"key":"e_1_2_1_95_1","first-page":"290","volume-title":"Washington DC: American Sociological Association","author":"Sobel M. E.","year":"1982"},{"key":"e_1_2_1_96_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-39218-4_20"},{"key":"e_1_2_1_97_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0272-6963(02)00022-0"},{"key":"e_1_2_1_98_1","doi-asserted-by":"publisher","DOI":"10.2307\/2089195"},{"key":"e_1_2_1_99_1","doi-asserted-by":"publisher","DOI":"10.1108\/09685229810227649"},{"key":"e_1_2_1_100_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2013.27"},{"key":"e_1_2_1_101_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1751-3243(06)01018-2"},{"key":"e_1_2_1_102_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2009.10.005"},{"key":"e_1_2_1_103_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2010.72"},{"key":"e_1_2_1_104_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2009.12"},{"key":"e_1_2_1_105_1","doi-asserted-by":"publisher","DOI":"10.1348\/014466608X295207"},{"key":"e_1_2_1_106_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1540-4560.1969.tb00619.x"},{"key":"e_1_2_1_107_1","doi-asserted-by":"publisher","DOI":"10.25300\/MISQ\/2013\/37.1.01"},{"key":"e_1_2_1_108_1","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-50"},{"key":"e_1_2_1_109_1","first-page":"1","volume-title":"Amsterdam: North-Holland","author":"Wold H.","year":"1982"},{"key":"e_1_2_1_110_1","unstructured":"Yin R. K. (2014). Case Study Research: Design and Methods. 5 ed. Thousand Oaks: Sage Publications Inc.  Yin R. K. (2014). Case Study Research: Design and Methods. 5 ed. Thousand Oaks: Sage Publications Inc."}],"container-title":["ACM SIGMIS Database: the DATABASE for Advances in Information Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3130515.3130519","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3130515.3130519","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T02:26:17Z","timestamp":1750213577000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3130515.3130519"}},"subtitle":["Analyzing Information Security Policy Compliance in a Large Banking Organization"],"short-title":[],"issued":{"date-parts":[[2017,8,2]]},"references-count":110,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2017,8,2]]}},"alternative-id":["10.1145\/3130515.3130519"],"URL":"https:\/\/doi.org\/10.1145\/3130515.3130519","relation":{},"ISSN":["0095-0033","1532-0936"],"issn-type":[{"value":"0095-0033","type":"print"},{"value":"1532-0936","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,8,2]]},"assertion":[{"value":"2017-08-02","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}