Review of IS security policy compliance: Toward the building blocks of an IS asecurity theory

Puzant Balozian, Dorothy Leidner

Research output: Contribution to journalReview articlepeer-review

Abstract

An understanding of insider threats in information systems (IS) is important to help address one of the dangers lurking within organizations. This article provides a review of the literature on insider compliance (and failure of compliance) with information systems' policies in order to understand the status of IS research regarding negligent and malicious insiders. We begin by defining the terms, developing a new taxonomy of insiders, and then providing a comprehensive review of articles on IS policy compliance for the past 26 years. Grounding the analysis in the literature, we inductively identify four themes to foster Information Security policy compliance among employees. The themes are: 1) IS management philosophy, 2) procedural countermeasures, 3) technical countermeasures, and 4) environmental countermeasures. We propose that future research can draw upon these themes and use them as the building blocks of an indigenous IS security theory.

Original languageEnglish
Pages (from-to)11-43
Number of pages33
JournalData Base for Advances in Information Systems
Volume48
Issue number3
Publication statusPublished - 2017 Aug 1

Subject classification (UKÄ)

  • Information Systems, Social aspects

Free keywords

  • Compliance
  • Information Systems Security
  • Information Systems Security Policy
  • Insider Threat
  • Noncompliance
  • Review

Fingerprint

Dive into the research topics of 'Review of IS security policy compliance: Toward the building blocks of an IS asecurity theory'. Together they form a unique fingerprint.

Cite this