The Role of Extra-Role Behaviors and Social Controls in Information Security Policy Effectiveness

Jack Shih-Chieh Hsu (), Sheng-Pao Shih (), Yu Wen Hung () and Paul Benjamin Lowry ()
Additional contact information
Jack Shih-Chieh Hsu: Department of Information Management, National Sun Yat-sen University, Kaohsiung 80424, Taiwan
Sheng-Pao Shih: Department of Information Management, Tamkang University, New Taipei City 25137, Taiwan
Yu Wen Hung: Department of Information Management, National Sun Yat-sen University, Kaohsiung 80424, Taiwan
Paul Benjamin Lowry: Department of Information Systems, City University of Hong Kong, Kowloon, Hong Kong

Information Systems Research, 2015, vol. 26, issue 2, 282-300

Abstract: Although most behavioral security studies focus on organizational in-role behaviors such as information security policy (ISP) compliance, the role of organizational extra-role behaviors—security behaviors that benefit organizations but are not specified in ISPs—has long been overlooked. This study examines (1) the consequences of organizational in-role and extra-role security behaviors on the effectiveness of ISPs and (2) the role of formal and social controls in enhancing in-role and extra-role security behaviors in organizations. We propose that both in-role security behaviors and extra-role security behaviors contribute to ISP effectiveness. Furthermore, based on social control theory, we hypothesize that social control can boost both in- and extra-role security behaviors. Data collected from practitioners—including information systems (IS) managers and employees at many organizations—confirmed most of our hypotheses. Survey data from IS managers substantiated the importance of extra-role behaviors in improving ISP effectiveness. Paired data, collected from managers and employees in the same organizations, indicated that formal control and social control individually and interactively enhance both in- and extra-role security behaviors. We conclude by discussing the implications of this research for academics and practitioners, along with compelling future research possibilities.

Keywords: IS security; behavioral security; in-role behaviors; extra-role behaviors; social control theory; SCT; security management; information security policy; ISP; formal control; social control; organizations (search for similar items in EconPapers)
Date: 2015
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (15)

Downloads: (external link)
http://dx.doi.org/10.1287/isre.2015.0569 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:inm:orisre:v:26:y:2015:i:2:p:282-300

Access Statistics for this article

More articles in Information Systems Research from INFORMS Contact information at EDIRC.
Bibliographic data for series maintained by Chris Asher ().