IMPACT OF HABITS ON INFORMATION SECURITY POLICY COMPLIANCE

Abstract

Information systems are an integral part of an organization. In recent years, security threats or malicious acts that aim to corrupt or steal data or disrupt an organization’s systems have become a major concern for organizational leadership. Information security policy provides a means for protecting information system resources. While creating information policy is an essential starting point, it is not enough to ensure employees’ compliance as employees are often the weakest link in information security. When developing security policy, organizational leadership needs to understand the impact of employees’ habits on information security policy compliance (ISPC) giving attention to factors such as information security policy (ISP) awareness, gender, age, and IT knowledge. This research sought to determine if there were significant differences between employee ISP awareness, gender, age, and IT knowledge and the impact of employees’ habits on ISPC. Using a survey adapted from previous research, 153 faculty and staff from a medium-sized university in the Southeast region of the USA were asked to respond to 8 items that define habit, regular tendency, or practice toward complying with the ISPC that does not require individuals’ awareness. Univariate Analysis of Variances (ANOVA) was used to analyze the data. Significant differences were found between each of the independent variables of awareness, gender, age, and IT knowledge and the impact of employee’s habits on information systems policy compliance. The results of this research will be useful to leadership as they develop policy and work to ensure security compliance within organizations.