Protection motivation and deterrence: a framework for security policy compliance in organisations

Key finding

Threat severity, response efficacy, self-efficacy and response costs shaped attitudes to security policy. Organisational commitment and social influence significantly drove compliance intentions, and available resources boosted self-efficacy. Employees underestimated how likely breaches were.

Why it matters

Shows that commitment, peer influence and self-efficacy drive compliance alongside threat and deterrence perceptions, so culture sits next to enforcement.

Informs

• Does not shame, punish, or publicly name people who click challenges

Cite

Herath, T., & Rao, H. R. (2009). Protection motivation and deterrence: a framework for security policy compliance in organisations. European Journal of Information Systems, 18(2). https://doi.org/10.1057/ejis.2009.6