{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,11,19]],"date-time":"2024-11-19T16:52:30Z","timestamp":1732035150929},"reference-count":133,"publisher":"Wiley","issue":"5","license":[{"start":{"date-parts":[[2014,7,8]],"date-time":"2014-07-08T00:00:00Z","timestamp":1404777600000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/onlinelibrary.wiley.com\/termsAndConditions#vor"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information Systems Journal"],"published-print":{"date-parts":[[2015,9]]},"abstract":"Abstract<\/jats:title>Organisations increasingly rely on information and related systems, which are also a source of risk. Unfortunately, employees represent the greatest risk to organisational information because they are the most frequent source of information security breaches. To address this \u2018weak link\u2019 in organisational security, most organisations have strict information security policies (ISPs) designed to thwart employee information abuses. Regrettably, these ISPs are only partially effective because employees often ignore them, circumvent them or even do the opposite of what management desires. Research on attempts to increase ISP compliance has produced similarly mixed results. Lack of compliance with ISPs is a widespread organisational issue that increasingly bears disproportionately large direct and qualitative costs that undermine strategy.<\/jats:p>Consequently, the purpose of our study was to contribute to the understanding of both motivations to comply with new ISPs and motivations to react negatively against them. To do so, we proposed an innovative model, the control\u2010reactance compliance model (CRCM), which combines organisational control theory \u2013 a model that explains ISP compliance \u2013 with reactance theory \u2013 a model used to explain ISP noncompliance. To test CRCM, we used a sample of 320 working professionals in a variety of industries to examine the likely organisational outcomes of the delivery of a new ISP to employees in the form of a typical memo sent throughout an organisation. We largely found support for CRCM, and this study concludes with an explanation of the model's contributions to research and practice related to organisational ISP compliance.<\/jats:p>","DOI":"10.1111\/isj.12043","type":"journal-article","created":{"date-parts":[[2014,7,8]],"date-time":"2014-07-08T12:02:10Z","timestamp":1404820930000},"page":"433-463","source":"Crossref","is-referenced-by-count":158,"title":["Proposing the control\u2010reactance compliance model (CRCM) to explain opposing motivations to comply with organisational information security policies"],"prefix":"10.1111","volume":"25","author":[{"given":"Paul Benjamin","family":"Lowry","sequence":"first","affiliation":[{"name":"Information Systems Department, College of Business City University of Hong Kong P7912, Academic Building I, 83 Tat Chee Avenue Kowloon Tong Hong Kong, China"}]},{"given":"Gregory D.","family":"Moody","sequence":"additional","affiliation":[{"name":"University of Nevada Las Vegas Las Vegas NV 89154 USA"}]}],"member":"311","published-online":{"date-parts":[[2014,7,8]]},"reference":[{"key":"e_1_2_6_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/0749-5978(91)90020-T"},{"key":"e_1_2_6_3_1","doi-asserted-by":"publisher","DOI":"10.1207\/S15327957PSPR0602_02"},{"key":"e_1_2_6_4_1","doi-asserted-by":"publisher","DOI":"10.1086\/268432"},{"key":"e_1_2_6_5_1","doi-asserted-by":"publisher","DOI":"10.1037\/0021-9010.86.4.797"},{"key":"e_1_2_6_6_1","doi-asserted-by":"publisher","DOI":"10.1037\/0021-9010.91.1.221"},{"key":"e_1_2_6_7_1","doi-asserted-by":"publisher","DOI":"10.15288\/jsa.1994.55.34"},{"key":"e_1_2_6_8_1","doi-asserted-by":"publisher","DOI":"10.2307\/25750694"},{"key":"e_1_2_6_9_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijhcs.2011.01.003"},{"key":"e_1_2_6_10_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0378-7206(01)00121-5"},{"key":"e_1_2_6_11_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1365-2575.2011.00391.x"},{"key":"e_1_2_6_12_1","doi-asserted-by":"publisher","DOI":"10.2753\/MIS0742-1222240404"},{"key":"e_1_2_6_13_1","doi-asserted-by":"publisher","DOI":"10.1037\/0022-3514.41.4.607"},{"key":"e_1_2_6_14_1","doi-asserted-by":"publisher","DOI":"10.1037\/0021-9010.85.3.349"},{"key":"e_1_2_6_15_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2009.8"},{"key":"e_1_2_6_16_1","volume-title":"A Theory of Psychological Reactance","author":"Brehm J.W.","year":"1966"},{"key":"e_1_2_6_17_1","volume-title":"Response to Loss of Freedom: a Theory of Psychological Reactance","author":"Brehm J.W.","year":"1972"},{"key":"e_1_2_6_18_1","volume-title":"Psychological Reactance: a Theory of Freedom and Control","author":"Brehm J.W.","year":"1981"},{"key":"e_1_2_6_19_1","doi-asserted-by":"publisher","DOI":"10.2307\/25750690"},{"key":"e_1_2_6_20_1","doi-asserted-by":"publisher","DOI":"10.4135\/9781412976046.n12"},{"key":"e_1_2_6_21_1","doi-asserted-by":"publisher","DOI":"10.1037\/0021-9010.83.1.97"},{"key":"e_1_2_6_22_1","doi-asserted-by":"publisher","DOI":"10.1037\/0022-3514.84.5.1027"},{"key":"e_1_2_6_23_1","doi-asserted-by":"publisher","DOI":"10.1287\/isre.1050.0041"},{"key":"e_1_2_6_24_1","doi-asserted-by":"publisher","DOI":"10.2307\/20650323"},{"key":"e_1_2_6_25_1","doi-asserted-by":"publisher","DOI":"10.1080\/15536548.2005.10855772"},{"key":"e_1_2_6_26_1","doi-asserted-by":"publisher","DOI":"10.2190\/5UPE-80NP-W9WN-BE6W"},{"key":"e_1_2_6_27_1","unstructured":"Chin W.W. Marcolin B.L.&Newsted P.R.(1996)A partial least squares latent variable modeling approach for measuring interaction effects: results from a Monte Carlo simulation study and voice mail emotion\/adoption study.17th International Conference on Information Systems DeGross J. I. Jarvenpaa S. & Srinivasan A. (eds.) pp.21\u201341. AIS December 16\u201318 Cleveland OH."},{"key":"e_1_2_6_28_1","doi-asserted-by":"publisher","DOI":"10.1287\/isre.14.2.189.16018"},{"key":"e_1_2_6_29_1","doi-asserted-by":"publisher","DOI":"10.1075\/veaw.g11.01cla"},{"key":"e_1_2_6_30_1","doi-asserted-by":"publisher","DOI":"10.1086\/208782"},{"key":"e_1_2_6_31_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2012.09.010"},{"key":"e_1_2_6_32_1","doi-asserted-by":"publisher","DOI":"10.1080\/01639620500218286"},{"key":"e_1_2_6_33_1","doi-asserted-by":"publisher","DOI":"10.1287\/isre.1070.0160"},{"key":"e_1_2_6_34_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0167-4048(01)00209-7"},{"key":"e_1_2_6_35_1","doi-asserted-by":"publisher","DOI":"10.1046\/j.1365-2575.2001.00099.x"},{"key":"e_1_2_6_36_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1365-2575.2006.00219.x"},{"key":"e_1_2_6_37_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-8551.2006.00500.x"},{"key":"e_1_2_6_38_1","doi-asserted-by":"publisher","DOI":"10.1177\/009365000027004003"},{"key":"e_1_2_6_39_1","doi-asserted-by":"publisher","DOI":"10.1080\/03637750500111815"},{"key":"e_1_2_6_40_1","doi-asserted-by":"publisher","DOI":"10.2307\/20721433"},{"key":"e_1_2_6_41_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1365-2575.2007.00289.x"},{"key":"e_1_2_6_42_1","doi-asserted-by":"publisher","DOI":"10.2466\/pr0.1989.64.3c.1083"},{"key":"e_1_2_6_43_1","volume-title":"Belief, Attitude, Intention, and Behavior: an Introduction to Theory and Research","author":"Fishbein M.","year":"1975"},{"key":"e_1_2_6_44_1","doi-asserted-by":"publisher","DOI":"10.1287\/mksc.1030.0033"},{"key":"e_1_2_6_45_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0277-9536(97)00055-5"},{"key":"e_1_2_6_46_1","doi-asserted-by":"publisher","DOI":"10.1177\/002224378101800313"},{"key":"e_1_2_6_47_1","unstructured":"Forrester Research(2010)The value of corporate secrets: how compliance and collaboration affect enterprise perceptions of risk. Forrester Consulting retrieved date: December 30 2010 url:http:\/\/www.microsoft.com\/Presspass\/press\/2010\/apr10\/04\u201005MSRSAPR.mspx?rss_fdn=Press%20Releases"},{"key":"e_1_2_6_48_1","first-page":"91","article-title":"A practical guide to factorial validity using PLS\u2010Graph: tutorial and annotated example","volume":"16","author":"Gefen D.","year":"2005","journal-title":"Communications of the AIS"},{"key":"e_1_2_6_49_1","doi-asserted-by":"publisher","DOI":"10.2307\/249564"},{"key":"e_1_2_6_50_1","doi-asserted-by":"publisher","DOI":"10.1177\/1059601109350987"},{"key":"e_1_2_6_51_1","doi-asserted-by":"publisher","DOI":"10.2753\/MIS0742-1222280208"},{"key":"e_1_2_6_52_1","doi-asserted-by":"publisher","DOI":"10.2307\/249656"},{"key":"e_1_2_6_53_1","doi-asserted-by":"publisher","DOI":"10.1016\/0022-1031(76)90031-7"},{"key":"e_1_2_6_54_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2009.02.005"},{"key":"e_1_2_6_55_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2009.6"},{"key":"e_1_2_6_56_1","doi-asserted-by":"publisher","DOI":"10.2466\/pr0.1989.64.3c.1323"},{"key":"e_1_2_6_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/1953122.1953142"},{"key":"e_1_2_6_58_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1365-2575.2010.00361.x"},{"key":"e_1_2_6_59_1","doi-asserted-by":"publisher","DOI":"10.2307\/3172761"},{"key":"e_1_2_6_60_1","doi-asserted-by":"publisher","DOI":"10.2307\/25750691"},{"key":"e_1_2_6_61_1","doi-asserted-by":"publisher","DOI":"10.1006\/jesp.1996.1317"},{"key":"e_1_2_6_62_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0268-4012(02)00105-6"},{"key":"e_1_2_6_63_1","doi-asserted-by":"publisher","DOI":"10.1037\/h0032590"},{"key":"e_1_2_6_64_1","doi-asserted-by":"publisher","DOI":"10.1146\/annurev.ps.31.020180.002325"},{"key":"e_1_2_6_65_1","doi-asserted-by":"publisher","DOI":"10.1287\/isre.1040.0036"},{"key":"e_1_2_6_66_1","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.48.4.484.204"},{"key":"e_1_2_6_67_1","doi-asserted-by":"publisher","DOI":"10.1287\/orsc.1090.0458"},{"key":"e_1_2_6_68_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1745-9125.1989.tb01052.x"},{"key":"e_1_2_6_69_1","unstructured":"Kock N.(2013)WarpPLS 4.0 User Manual. ScriptWarp Systems retrieved date: May 23 2014 url:http:\/\/www.scriptwarp.com\/warppls\/UserManual_v_4_0.pdf"},{"key":"e_1_2_6_70_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.im.2003.08.001"},{"key":"e_1_2_6_71_1","doi-asserted-by":"publisher","DOI":"10.1037\/0022-3514.80.6.942"},{"key":"e_1_2_6_72_1","doi-asserted-by":"publisher","DOI":"10.1177\/0149206307300816"},{"key":"e_1_2_6_73_1","doi-asserted-by":"publisher","DOI":"10.1108\/09685220210424104"},{"key":"e_1_2_6_74_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.im.2009.07.005"},{"key":"e_1_2_6_75_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.im.2003.08.008"},{"key":"e_1_2_6_76_1","first-page":"76","article-title":"Reactance theory in consumer research: the past, present, and future","volume":"16","author":"Lessne G.","year":"1989","journal-title":"Advances in Consumer Research"},{"key":"e_1_2_6_77_1","doi-asserted-by":"crossref","first-page":"394","DOI":"10.17705\/1jais.00232","article-title":"Understanding security behaviors in personal computer usage: a threat avoidance perspective","volume":"11","author":"Liang H.","year":"2010","journal-title":"Journal of the Association for Information Systems"},{"key":"e_1_2_6_78_1","first-page":"12","article-title":"Managing information security","volume":"2","author":"Lohmeyer D.F.","year":"2002","journal-title":"McKinsey Quarterly, Special Edition: Risk and Resilience"},{"key":"e_1_2_6_79_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1365-2575.2009.00334.x"},{"key":"e_1_2_6_80_1","doi-asserted-by":"publisher","DOI":"10.2753\/MIS0742-1222300105"},{"key":"e_1_2_6_81_1","doi-asserted-by":"publisher","DOI":"10.1177\/0146167298244009"},{"key":"e_1_2_6_82_1","doi-asserted-by":"publisher","DOI":"10.2307\/23044045"},{"key":"e_1_2_6_83_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1751-9004.2011.00341.x"},{"key":"e_1_2_6_84_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1365-2575.2008.00302.x"},{"key":"e_1_2_6_85_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1468-2958.2007.00297_5.x"},{"key":"e_1_2_6_86_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1468-2958.2007.00297_5.x"},{"key":"e_1_2_6_87_1","unstructured":"Mishra S.&Dhillon G.(2006)Information systems security governance research: a behavioral perspective.1st Annual Symposium on Information Assurance Academic Track of the 9th Annual 2006 NYS Cyber Security Conference pp.18\u201326. June 14\u201315 New York NY."},{"key":"e_1_2_6_88_1","doi-asserted-by":"publisher","DOI":"10.2307\/259230"},{"key":"e_1_2_6_89_1","doi-asserted-by":"publisher","DOI":"10.2307\/41409968"},{"key":"e_1_2_6_90_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2009.10"},{"key":"e_1_2_6_91_1","volume-title":"Psychometric Theory","author":"Nunnally J.C.","year":"1994"},{"key":"e_1_2_6_92_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10551-005-2929-7"},{"key":"e_1_2_6_93_1","doi-asserted-by":"publisher","DOI":"10.1016\/0030-5073(74)90042-7"},{"key":"e_1_2_6_94_1","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.25.9.833"},{"key":"e_1_2_6_95_1","doi-asserted-by":"publisher","DOI":"10.2307\/2392023"},{"key":"e_1_2_6_96_1","doi-asserted-by":"publisher","DOI":"10.1037\/0033-2909.124.1.54"},{"key":"e_1_2_6_97_1","doi-asserted-by":"crossref","unstructured":"Pahnila S. Siponen M.&Mahmood A.(2007)Employees' behavior towards IS security policy compliance.40th Hawaii International Conference on Systems Sciences pp.1\u201310. IEEE January 3\u20136 Big Island Hawaii.","DOI":"10.1109\/HICSS.2007.206"},{"key":"e_1_2_6_98_1","first-page":"37","volume-title":"Routine Activity and Rational Choice: Advances in Criminological Theory","author":"Paternoster R.","year":"1993"},{"key":"e_1_2_6_99_1","doi-asserted-by":"publisher","DOI":"10.2307\/3054128"},{"key":"e_1_2_6_100_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1365-2575.2011.00390.x"},{"key":"e_1_2_6_101_1","doi-asserted-by":"publisher","DOI":"10.2307\/25148814"},{"key":"e_1_2_6_102_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1745-9125.2006.00053.x"},{"key":"e_1_2_6_103_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2010.15"},{"key":"e_1_2_6_104_1","first-page":"24","article-title":"When computer monitoring backfires: invasion of privacy and organizational injustice as precursors to computer abuse","volume":"7","author":"Posey C.","year":"2011","journal-title":"Journal of Information System Security"},{"key":"e_1_2_6_105_1","doi-asserted-by":"publisher","DOI":"10.25300\/MISQ\/2013\/37.4.09"},{"key":"e_1_2_6_106_1","doi-asserted-by":"publisher","DOI":"10.1177\/0093650290346797"},{"key":"e_1_2_6_107_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1468-2958.2007.00298_3.x"},{"key":"e_1_2_6_108_1","doi-asserted-by":"publisher","DOI":"10.1287\/isre.1080.0174"},{"key":"e_1_2_6_109_1","unstructured":"Ringle C.M. Wende S.&Will S.(2005)SmartPLS 2.0 (M3) Beta. retrieved date: September 17 2010 url:http:\/\/www.smartpls.de"},{"key":"e_1_2_6_110_1","doi-asserted-by":"publisher","DOI":"10.2307\/256693"},{"key":"e_1_2_6_111_1","doi-asserted-by":"publisher","DOI":"10.2307\/256963"},{"key":"e_1_2_6_112_1","doi-asserted-by":"publisher","DOI":"10.1037\/h0076917"},{"key":"e_1_2_6_113_1","doi-asserted-by":"publisher","DOI":"10.1177\/0734371X05278114"},{"key":"e_1_2_6_114_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1744-6570.1987.tb00609.x"},{"key":"e_1_2_6_115_1","doi-asserted-by":"publisher","DOI":"10.5465\/AMR.2006.22527466"},{"key":"e_1_2_6_116_1","doi-asserted-by":"publisher","DOI":"10.1207\/s15324834basp2703_9"},{"key":"e_1_2_6_117_1","doi-asserted-by":"publisher","DOI":"10.1057\/palgrave.ejis.3000537"},{"key":"e_1_2_6_118_1","doi-asserted-by":"publisher","DOI":"10.2307\/25750688"},{"key":"e_1_2_6_119_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2012.59"},{"key":"e_1_2_6_120_1","doi-asserted-by":"publisher","DOI":"10.1287\/orsc.4.3.367"},{"key":"e_1_2_6_121_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.im.2011.07.002"},{"key":"e_1_2_6_122_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1365-2575.2011.00378.x"},{"key":"e_1_2_6_123_1","doi-asserted-by":"publisher","DOI":"10.1207\/S15327043HUP1301_4"},{"key":"e_1_2_6_124_1","doi-asserted-by":"publisher","DOI":"10.1287\/isre.1.3.255"},{"key":"e_1_2_6_125_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-6494.1995.tb00810.x"},{"key":"e_1_2_6_126_1","doi-asserted-by":"publisher","DOI":"10.1177\/1362480604046657"},{"key":"e_1_2_6_127_1","doi-asserted-by":"publisher","DOI":"10.2307\/3857567"},{"key":"e_1_2_6_128_1","doi-asserted-by":"publisher","DOI":"10.4018\/joeuc.2012010102"},{"key":"e_1_2_6_129_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010710022834"},{"key":"e_1_2_6_130_1","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2009.12"},{"key":"e_1_2_6_131_1","doi-asserted-by":"publisher","DOI":"10.1080\/01973530802659711"},{"key":"e_1_2_6_132_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1559-1816.2009.00501.x"},{"key":"e_1_2_6_133_1","doi-asserted-by":"publisher","DOI":"10.1080\/108107396127988"},{"key":"e_1_2_6_134_1","doi-asserted-by":"publisher","DOI":"10.2753\/MIS0742-1222230404"}],"container-title":["Information Systems Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.wiley.com\/onlinelibrary\/tdm\/v1\/articles\/10.1111%2Fisj.12043","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1111\/isj.12043","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,10,2]],"date-time":"2023-10-02T00:49:28Z","timestamp":1696207768000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1111\/isj.12043"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,7,8]]},"references-count":133,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2015,9]]}},"alternative-id":["10.1111\/isj.12043"],"URL":"https:\/\/doi.org\/10.1111\/isj.12043","archive":["Portico"],"relation":{},"ISSN":["1350-1917","1365-2575"],"issn-type":[{"value":"1350-1917","type":"print"},{"value":"1365-2575","type":"electronic"}],"subject":[],"published":{"date-parts":[[2014,7,8]]}}}