The purpose of this study is to explore the effect of formal and social control on in-role and extra-role security behaviors. Following past studies, we reexamine the effect of formal control on behaviors. Based on social control theory, we further hypothesize the effect of social control on security behaviors. Data collected from 259 members of IS departments confirmed our hypotheses that both formal control and social control generate effects on both in-role and extrarole security behaviors. Implications for academia and practitioners are also provided.