The valued coexistence of protection motivation and stewardship in information security behaviors

Abstract

Organizations need to consider different managerial approaches to motivate security compliance behavior as more employees work outside of the office. This study examines two approaches for motivating security compliance behaviors in a changing work environment. We examine protection motivation and stewardship-based strategic approaches to determine their effectiveness towards influencing information security behaviors. Independently, each approach has received demonstrable evidence of contributing to organizational behaviors. However, as the nature of work changes (e.g., hoteling, traveling, working from home), it also changes the security risk landscape for organizations, rendering the effectiveness of previous security controls debatable. This study contends there is value to management in integrating both protection motivation and stewardship approaches in this context. A research model is developed that integrates both approaches; protection motivation and stewardship concepts. We find that constructs consistent with protection motivation theory are more likely to explain decreases in security policy violations than stewardship theory. Further, by combining protection motivation and stewardship perspectives, this study's results supplement our understanding of security policy violations in a changing work environment. We show that the two together account for 51 percent of the variance, and thus both have value. Our findings suggest that a PMT-based strategy is a stronger approach for influencing compliance behavior. Therefore, it is important for organizations to continue focusing their efforts on threat communications as well as enhancing employees’ abilities to respond. However, we also show that organizations should build a sense of belonging with their employees such that their employees become stewards of the organization's resources.