Predicting communication constructs towards determining information security policies compliance
Background: Ineffective communication using inappropriate channels and poor listening skills have resulted in poor compliance with information security (InfoSec) policies. Lack of compliance with InfoSec policies minimises employee proficiency whilst also exposing organisations to business risk. Ob...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
AOSIS
2020-10-01
|
| Series: | South African Journal of Information Management |
| Subjects: | |
| Online Access: | https://sajim.co.za/index.php/sajim/article/view/1211 |
| _version_ | 1828869096969601024 |
|---|---|
| author | Tsholofelo Rantao Kennedy Njenga |
| author_facet | Tsholofelo Rantao Kennedy Njenga |
| author_sort | Tsholofelo Rantao |
| collection | DOAJ |
| description | Background: Ineffective communication using inappropriate channels and poor listening skills have resulted in poor compliance with information security (InfoSec) policies. Lack of compliance with InfoSec policies minimises employee proficiency whilst also exposing organisations to business risk.
Objectives: This research addresses management’s concern regarding why employees do not comply with InfoSec policies and proposes that how policies are communicated is integral to compliance and that effective communication can serve to ameliorate compliance.
Method: The research adopts communication theories from knowledge management, psychology and information systems to draw on important constructs which are then tested in order to identify those that can strongly predict InfoSec policy compliance. The research was quantitative and used a survey to elicit responses from a sample of 100 employees selected from 6 organisations.
Results: Our findings suggest that of the 10 communication constructs used in the miscellany of perception and determinism (MPD) framework, half of these (five) constructs strongly predicated compliance, namely reasons for communication, media appropriateness, non-conflicting interpretations, feedback immediacy and personal focus. The rest of the constructs were weak predictors or could not predict compliance.
Conclusion: The research advances InfoSec literature by adapting the MPD model as integral to the development, communication and importantly, compliance with InfoSec policies. The MPD model is pertinent as it aggregates theories of communication from a number of academic disciplines and underpinnings not considered before, thereby improving our understanding on how we communicate InfoSec policies for better compliance. |
| first_indexed | 2024-12-13T05:44:07Z |
| format | Article |
| id | doaj.art-509d759dcccc4267a939c270edc116b2 |
| institution | Directory Open Access Journal |
| issn | 2078-1865 1560-683X |
| language | English |
| last_indexed | 2024-12-13T05:44:07Z |
| publishDate | 2020-10-01 |
| publisher | AOSIS |
| record_format | Article |
| series | South African Journal of Information Management |
| spelling | doaj.art-509d759dcccc4267a939c270edc116b22022-12-21T23:57:43ZengAOSISSouth African Journal of Information Management2078-18651560-683X2020-10-01221e1e1010.4102/sajim.v22i1.1211656Predicting communication constructs towards determining information security policies complianceTsholofelo Rantao0Kennedy Njenga1Department of Applied Information Systems, College of Business and Economics, University of Johannesburg, JohannesburgDepartment of Applied Information Systems, College of Business and Economics, University of Johannesburg, JohannesburgBackground: Ineffective communication using inappropriate channels and poor listening skills have resulted in poor compliance with information security (InfoSec) policies. Lack of compliance with InfoSec policies minimises employee proficiency whilst also exposing organisations to business risk. Objectives: This research addresses management’s concern regarding why employees do not comply with InfoSec policies and proposes that how policies are communicated is integral to compliance and that effective communication can serve to ameliorate compliance. Method: The research adopts communication theories from knowledge management, psychology and information systems to draw on important constructs which are then tested in order to identify those that can strongly predict InfoSec policy compliance. The research was quantitative and used a survey to elicit responses from a sample of 100 employees selected from 6 organisations. Results: Our findings suggest that of the 10 communication constructs used in the miscellany of perception and determinism (MPD) framework, half of these (five) constructs strongly predicated compliance, namely reasons for communication, media appropriateness, non-conflicting interpretations, feedback immediacy and personal focus. The rest of the constructs were weak predictors or could not predict compliance. Conclusion: The research advances InfoSec literature by adapting the MPD model as integral to the development, communication and importantly, compliance with InfoSec policies. The MPD model is pertinent as it aggregates theories of communication from a number of academic disciplines and underpinnings not considered before, thereby improving our understanding on how we communicate InfoSec policies for better compliance.https://sajim.co.za/index.php/sajim/article/view/1211information securitypoliciescomplianceperception theoriesdeterminism theories. |
| spellingShingle | Tsholofelo Rantao Kennedy Njenga Predicting communication constructs towards determining information security policies compliance South African Journal of Information Management information security policies compliance perception theories determinism theories. |
| title | Predicting communication constructs towards determining information security policies compliance |
| title_full | Predicting communication constructs towards determining information security policies compliance |
| title_fullStr | Predicting communication constructs towards determining information security policies compliance |
| title_full_unstemmed | Predicting communication constructs towards determining information security policies compliance |
| title_short | Predicting communication constructs towards determining information security policies compliance |
| title_sort | predicting communication constructs towards determining information security policies compliance |
| topic | information security policies compliance perception theories determinism theories. |
| url | https://sajim.co.za/index.php/sajim/article/view/1211 |
| work_keys_str_mv | AT tsholofelorantao predictingcommunicationconstructstowardsdetermininginformationsecuritypoliciescompliance AT kennedynjenga predictingcommunicationconstructstowardsdetermininginformationsecuritypoliciescompliance |