The compliance budget: managing security behaviour in organisations

Key finding

Employees decide whether to comply by weighing the personal costs and benefits of compliance against perceived benefit to the organization. Proposes the 'Compliance Budget': a finite store of goodwill that security demands draw down and that must be managed.

Why it matters

Shows that piling on security demands exhausts employee goodwill, so security teams must spend people's effort deliberately.

Informs

• Raises security friction openly context
• Designs security rules people can actually follow supports

Cite

Beautement, A., Sasse, M. A., & Wonham, M. (2008). The compliance budget: managing security behaviour in organisations. Proceedings of the 2008 New Security Paradigms Workshop (NSPW '08). https://doi.org/10.1145/1595676.1595684