Employees’ Post–Breach Information Security Policy Non-Compliance: An Organizational Legitimacy Perspective

Presenter Information

Siwei Jiang, Mississippi State UniversityFollow
Alaa Nehme, Mississippi State UniversityFollow

Paper Type

ERF

Abstract

With an upward trend of data breaches and their financial damages, organizations continue to increase investment in employees’ security awareness. Yet, 86% of breaches involve employees. This research uncovers the impact of data breaches on employees’ perceived legitimacy of information security governance and then their information security policy compliance behaviors. Drawing on the theory of the legitimacy process, we developed a mediation model of employees’ noncompliance behaviors post-breach. We plan to conduct a survey and test whether the perceived severity of data breaches decreases employees’ legitimacy perceptions of information security governance and ultimately leads to information security policy non-compliance post-breach.

Paper Number

1606

Author Connect URL

https://authorconnect.aisnet.org/conferences/AMCIS2024/papers/1606

Comments

SIGSEC

Recommended Citation

Jiang, Siwei and Nehme, Alaa, "Employees’ Post–Breach Information Security Policy Non-Compliance: An Organizational Legitimacy Perspective" (2024). AMCIS 2024 Proceedings. 3.
https://aisel.aisnet.org/amcis2024/security/security/3