{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,17]],"date-time":"2025-09-17T14:58:34Z","timestamp":1758121114472,"version":"3.41.0"},"reference-count":82,"publisher":"Association for Computing Machinery (ACM)","issue":"SI","license":[{"start":{"date-parts":[[2018,4,25]],"date-time":"2018-04-25T00:00:00Z","timestamp":1524614400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGMIS Database"],"published-print":{"date-parts":[[2018,4,25]]},"abstract":"<jats:p>While much of the extant InfoSec research relies on single assessment models that predict intent to act, this article proposes a multi-stage InfoSec Process Action Model (IPAM) that can positively change individual InfoSec behavior. We believe that this model will allow InfoSec researchers to focus more directly on the process that leads to action and develop better interventions that address problematic security behaviors. Building on successful healthcare efforts that resulted in smoking cessation, regular exercise, and a healthier diet, among others, IPAM is a hybrid predictive process approach to behavioral InfoSec improvement. IPAM formulates the motivational antecedents of intent as separate from the volitional drivers of behavior. Singular fear appeals often seen in InfoSec research are replaced by more nuanced treatments appropriately differentiated to support behavioral change as part of a process; phase-appropriate measures of self-efficacy are employed to more precisely assess the likelihood that a participant will act on good intentions; and decisional balance assessment of pro and con perceptions is monitored over time. These notions better align InfoSec research with both leading security practice and successful comparators in healthcare. We believe IPAM can both help InfoSec research models better explain actual behavior and better inform practical security behavior improvement initiatives.<\/jats:p>","DOI":"10.1145\/3210530.3210535","type":"journal-article","created":{"date-parts":[[2018,4,27]],"date-time":"2018-04-27T16:00:21Z","timestamp":1524844821000},"page":"49-66","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":11,"title":["InfoSec Process Action Model (IPAM)"],"prefix":"10.1145","volume":"49","author":[{"given":"Michael","family":"Curry","sequence":"first","affiliation":[{"name":"Washington State University, Pullman, WA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Byron","family":"Marshall","sequence":"additional","affiliation":[{"name":"Oregon State University, Corvallis, OR, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Robert E.","family":"Crossler","sequence":"additional","affiliation":[{"name":"Washington State University, Pullman, WA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"John","family":"Correia","sequence":"additional","affiliation":[{"name":"Washington State University, Pullman, WA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2018,4,25]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1002\/ejsp.730"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/0749-5978(91)90020-T"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1177\/0146167204264079"},{"key":"e_1_2_1_4_1","unstructured":"Ajzen I. &Fishbein M. (1975). Belief attitude intention and behavior: An introduction to theory and research. Reading MA: Addison-Wesley.  Ajzen I. &Fishbein M. (1975). Belief attitude intention and behavior: An introduction to theory and research. Reading MA: Addison-Wesley."},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1037\/0033-2909.127.1.142"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.5555\/2017470.2017481"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1080\/08870440008400299"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1037\/0033-295X.84.2.191"},{"key":"e_1_2_1_9_1","unstructured":"Bandura A. (1986). Social foundations of thought and action: A social cognitive theory. Englewood Cliffs NJ: Prentice-Hall.  Bandura A. (1986). Social foundations of thought and action: A social cognitive theory. Englewood Cliffs NJ: Prentice-Hall."},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1037\/0003-066X.44.9.1175"},{"key":"e_1_2_1_11_1","unstructured":"Bandura A. (1994). Self-efficacy. In V. Ramachaudran (Ed.) Encyclopedia of human behavior (pp. 71--81). New York: Academic Press.  Bandura A. (1994). Self-efficacy. In V. Ramachaudran (Ed.) Encyclopedia of human behavior (pp. 71--81). New York: Academic Press."},{"key":"e_1_2_1_12_1","unstructured":"Bandura A. (1997). Self-efficacy: The exercise of control. New York: W.H. Freeman&Co.  Bandura A. (1997). Self-efficacy: The exercise of control. New York: W.H. Freeman&Co."},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.4278\/0890-1171-16.3.146"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1093\/her\/17.5.659"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.25300\/MISQ\/2015\/39.4.5"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.5555\/2017470.2017477"},{"volume-title":"Proceedings of the International Conference for Information Systems. Atlanta, GA: Association for Information Systems.","year":"2012","author":"Burns M.","key":"e_1_2_1_17_1"},{"issue":"3","key":"e_1_2_1_18_1","first-page":"194","article-title":"Understanding Web-based learning continuance intention: The role of subjective task value","volume":"45","author":"Chiu C.","year":"2008","journal-title":"Information&Management"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF02895171"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.36.2.123"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2691517.2691521"},{"key":"e_1_2_1_22_1","first-page":"90","article-title":"Future directions for behavioral information security research","volume":"32","author":"Crossler R. E.","year":"2013","journal-title":"Computers&Security"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.2308\/isys-50704"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1080\/17437199.2014.941722"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1521\/jscp.1986.4.3.302"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.17705\/1jais.00133"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1559-1816.2000.tb02323.x"},{"issue":"3","key":"e_1_2_1_28_1","first-page":"347","article-title":"From 'I wish' to 'I will': Social-cognitive predictors of behavioral intentions","volume":"8","author":"Garcia K.","year":"2003","journal-title":"Journal of Health Psychology"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1158\/1055-9965.EPI-06-0914"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.4278\/0890-1171-11.2.87"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1037\/0003-066X.54.7.493"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0065-2601(06)38002-1"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ypmed.2007.11.006"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2009.6"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2009.6"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2011.10.007"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.5555\/2017470.2017478"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.25300\/MISQ\/2015\/39.1.06"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.2307\/1914185"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2010.07.009"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2009.11"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.5555\/2017410.2017417"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.17705\/1jais.00232"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1016\/0022-1031(83)90023-9"},{"key":"e_1_2_1_45_1","doi-asserted-by":"crossref","unstructured":"Marlatt G. Baer J. &Quigley L. (1997). Self-efficacy and addictive behavior. In A. Bandura (Ed.) Self-efficacy in changing societies (pp. 289--315). Cambridge UK: Cambridge University Press.  Marlatt G. Baer J. &Quigley L. (1997). Self-efficacy and addictive behavior. In A. Bandura (Ed.) Self-efficacy in changing societies (pp. 289--315). Cambridge UK: Cambridge University Press.","DOI":"10.1017\/CBO9780511527692.012"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.accinf.2015.11.005"},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1559-1816.2000.tb02308.x"},{"key":"e_1_2_1_48_1","first-page":"114","volume-title":"J. E. Maddux&J","author":"Oettingen G.","year":"2010"},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1521\/soco.2007.25.2.248"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1093\/her\/1.3.153"},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.4278\/0890-1171-12.1.38"},{"key":"e_1_2_1_52_1","first-page":"130","volume-title":"M. Gellman&J","author":"Prochaska J. O. J.","year":"2013"},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.4278\/0890-1171-12.1.38"},{"key":"e_1_2_1_54_1","unstructured":"Renner B. &Schwarzer R. (2005). Risk and health behaviors. Department of Health Psychology White paper. Berlin: Friei Universitat.  Renner B. &Schwarzer R. (2005). Risk and health behaviors. Department of Health Psychology White paper. Berlin: Friei Universitat."},{"volume-title":"Current","year":"2001","author":"Richardson W.","key":"e_1_2_1_55_1"},{"key":"e_1_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1080\/00223980.1975.9915803"},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1471-0153(00)00019-2"},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1093\/her\/cyl084"},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1177\/135910539900400208"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1464-0597.2007.00325.x"},{"key":"e_1_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1037\/a0024509"},{"key":"e_1_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1027\/1016-9040.13.2.141"},{"volume-title":"Current","year":"2003","author":"Schwarzer R.","key":"e_1_2_1_63_1"},{"key":"e_1_2_1_64_1","unstructured":"Security Awareness Program Special Interest Group (2014). Information supplement: Best practices for implementing a security awareness program. https:\/\/www.pcisecuritystandards.org\/documents\/PCI_DSS_V1.0_Best_Practices_for_Implementing_Security_Awareness_Program.pdf. Current February 2018.  Security Awareness Program Special Interest Group (2014). Information supplement: Best practices for implementing a security awareness program. https:\/\/www.pcisecuritystandards.org\/documents\/PCI_DSS_V1.0_Best_Practices_for_Implementing_Security_Awareness_Program.pdf. Current February 2018."},{"key":"e_1_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1080\/14792772143000003"},{"key":"e_1_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1037\/0033-2909.125.1.90"},{"issue":"2","key":"e_1_2_1_67_1","first-page":"143","article-title":"Bridging the intention--behavior gap: Planning, self-efficacy, and action control in the adoption and maintenance of physical exercise","volume":"20","author":"Sniehotta F. F. F.","year":"2005","journal-title":"Psychology&Health"},{"key":"e_1_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1046\/j.1360-0443.2001.96117513.x"},{"volume-title":"M. Conner&P","year":"2005","author":"Sutton S.","key":"e_1_2_1_69_1"},{"volume-title":"Current","year":"2014","author":"Toth P.","key":"e_1_2_1_70_1"},{"key":"e_1_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.im.2012.04.002"},{"key":"e_1_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1464-0597.2007.00327.x"},{"key":"e_1_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1540-5414.2006.00136.x"},{"key":"e_1_2_1_74_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1540-5915.2008.00192.x"},{"volume-title":"Current","year":"2017","author":"Walsh K.","key":"e_1_2_1_75_1"},{"key":"e_1_2_1_76_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF00845372"},{"key":"e_1_2_1_77_1","first-page":"123","volume-title":"K.Glanz, B. Rimer,&K","author":"Weinstein N. D.","year":"1988","edition":"4"},{"key":"e_1_2_1_78_1","doi-asserted-by":"publisher","DOI":"10.1037\/0278-6133.17.3.290"},{"key":"e_1_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1037\/0278-6133.11.3.170"},{"key":"e_1_2_1_80_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1360-0443.2005.01139.x"},{"volume-title":"Current","year":"2003","author":"Wilson M.","key":"e_1_2_1_81_1"},{"issue":"5","key":"e_1_2_1_82_1","first-page":"591","article-title":"A meta-analysis of fear appeals: Implications for effective public health campaigns","volume":"27","author":"Witte K.","year":"2000","journal-title":"Health Education&Behavior"}],"container-title":["ACM SIGMIS Database: the DATABASE for Advances in Information Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3210530.3210535","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3210530.3210535","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T02:13:13Z","timestamp":1750212793000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3210530.3210535"}},"subtitle":["Systematically Addressing Individual Security Behavior"],"short-title":[],"issued":{"date-parts":[[2018,4,25]]},"references-count":82,"journal-issue":{"issue":"SI","published-print":{"date-parts":[[2018,4,25]]}},"alternative-id":["10.1145\/3210530.3210535"],"URL":"https:\/\/doi.org\/10.1145\/3210530.3210535","relation":{},"ISSN":["0095-0033","1532-0936"],"issn-type":[{"type":"print","value":"0095-0033"},{"type":"electronic","value":"1532-0936"}],"subject":[],"published":{"date-parts":[[2018,4,25]]},"assertion":[{"value":"2018-04-25","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}