Conceptualizing a Framework to Enhance Information Security Culture and Compliance Behavior in Organizations through Protection Motivation Theory

Abstract

Ensuring information security compliance is essential for securing organizational data. However, comprehending the factors that impact employees' compliance behavior remains challenging. Scholars have proposed that an established Information Security Culture (ISC) in organization may impact employee compliance with policies of information security. Existing models often address only partial aspects of Information Security Culture (ISC) or lack integration of comprehensive behavioral theories. The aim of this study is to propose an enhanced conceptual framework that identifies all elements of ISC and their influence on employees' compliance with the policies of information security. Aligning with well-established concepts of organizational culture and ISC, the framework was developed by incorporating important elements from the literature. The employees’ information security behavior was explained by the Protection Motivation Theory (PMT) to offer comprehensive insights about compliance behavior. It is believed that this conceptual framework will provide more precise results on the correlations between ISC and compliance behavior of employees towards information security regulations.