1. ¹Department of Accountancy, Bentley University, U.S.A.
2. ²Joseph M. Katz Graduate School of Business & College of Business Administration, University of Pittsburgh, U.S.A.
3. ³Spartanburg Regional Medical Center, U.S.A.
4. ⁴Spartanburg Regional Medical Center, U.S.A.
5. ⁵Leeds School of Business, University of Colorado at Boulder, U.S.A.

Correspondence: Scott R. Boss, Department of Accountancy, Bentley University, 175 Forest Street, Waltham, MA 02452, U.S.A. Tel: +781 891 2353; Fax: +781 891 2896; E-mail: sboss@bentley.edu

Received 8 April 2008; Revised 15 August 2008; Re-revised 18 January 2009; Accepted 23 February 2009; Published online 31 March 2009.

Abstract

Information security has become increasingly important to organizations. Despite the prevalence of technical security measures, individual employees remain the key link – and frequently the weakest link – in corporate defenses. When individuals choose to disregard security policies and procedures, the organization is at risk. How, then, can organizations motivate their employees to follow security guidelines? Using an organizational control lens, we build a model to explain individual information security precaution-taking behavior. Specific hypotheses are developed and tested using a field survey. We examine elements of control and introduce the concept of 'mandatoriness,' which we define as the degree to which individuals perceive that compliance with existing security policies and procedures is compulsory or expected by organizational management. We find that the acts of specifying policies and evaluating behaviors are effective in convincing individuals that security policies are mandatory. The perception of mandatoriness is effective in motivating individuals to take security precautions, thus if individuals believe that management watches, they will comply.