Designs security rules people can actually follow

Keeps the effort that policies demand within what people can sustain alongside their real work.

People weigh the cost of compliance against their work; when rules cost too much, they reasonably skip them or build workarounds.

How to observe it: Friction reports; workaround discovery; time-cost estimates for key policies.

Supporting evidence

• Learning from “Shadow Security:” Why Understanding Non-Compliant Behaviors Provides the Basis for Effective Security Kirlappos et al., 2014
• So long, and no thanks for the externalities: the rational rejection of security advice by users Herley, 2009
• The compliance budget: managing security behaviour in organisations Beautement et al., 2008
• Users are not the enemy Adams & Sasse, 1999