The Impact of Challenge Information Security Stress on Information Security Policy Compliance: The Mediating Roles of Emotions
Lin Chen,Zongxiao Xie,Jie Zhen,Kunxiang Dong
DOI: https://doi.org/10.2147/prbm.s359277
IF: 3.974
2022-05-12
Psychology Research and Behavior Management
Abstract:Lin Chen, 1 Zongxiao Xie, 2 Jie Zhen, 3 Kunxiang Dong 4 1 College of Humanities and Law, Shandong University of Science and Technology, Qingdao, 266590, People's Republic of China; 2 China Financial Certification Authority, Beijing, 100054, People's Republic of China; 3 School of Management Science and Engineering, Chongqing Technology and Business University, Chongqing, 400067, People's Republic of China; 4 School of Management Science and Engineering, Shandong University of Finance and Economics, Jinan, 250014, People's Republic of China Correspondence: Zongxiao Xie, China Financial Certification Authority, 20-3, South Street of Caishikou, Xicheng District, Beijing, 100054, People's Republic of China, Tel +86 18901086108, Email Introduction: Information security policy (ISP) compliance of employees has a profound impact on organization. In the context of information technology innovation and information systems upgrade, employees' information security behavior is one of the most crucial elements in the information security management of organizations. Based on the two-dimensional model of challenge−hindrance stressor theory and affective events theory, this study explores the mediating effects of emotions on the relationship between challenge information security stress and ISP compliance. Methods: A field quasi-experimental method was used in this study. Materials include the Challenge Information Security Stress Scale, Information System Security Policy Compliance Scale, and Emotions Scale, which were used to form the two-stage questionnaire surveys. Data of 217 employees from three Chinese companies in Shanghai and Beijing that had passed certifications for information security management system (GB/t22080-2008/ISO/IEC 27001:2005) were collected. Bootstrapping method for multiple mediation models and the Process 3.0 plug-in of SPSS 20.0 were used for data analysis. Results: The findings indicate that challenge information security stress has a positive effect on ISP compliance. Challenge information security stress has a positive effect on positive emotions and a negative effect on negative emotions. Positive emotions have mediating effect between challenge information security stress and ISP compliance, but negative emotions have no mediating effect. Conclusion: The research results expand the research scope of challenging stress in the two-dimensional model of challenge−hindrance stressor theory in the context of organizational information security. The findings reveal the mediating effect of positive emotions in challenge information security stress and ISP compliance relationship, which provides empirical support for the application of positive psychology in the field of management. Keywords: challenge information security stress, information security policy compliance, positive emotions, negative emotions Organizations increasingly use information technology, which has become the key resource for an organization. An organization needs to ensure that information is not disclosed or inadvertently modified. 1,2 In addition to technical means, the most basic way to protect the information resources of an organization is to formulate an ISP to regulate the information security behaviors of employees. In the past 30 years, most information system researchers have focused on ISP violations. 3–5 Recently, an increasing number of researches have explored the influence mechanism of ISP compliance, 6–8 and with the continuous improvement of enterprise information security, the growing attention given to information security has brought stress to employees. In particular, when the security requirements of ISP exceed employees' working ability, it will cause employees to feel information security stress. 9,10 According to challenge-hindrance stressor theory, 11,12 the positive components of information security stress are shown as challenge information security stress, which refers to the stress caused by work requirements that can bring individual growth opportunities or benefits to employees in the information security workflow. However, not much work has been done to explore the relationship between employees' challenge information security stress and their ISP compliance. Thus, this study aims to explore how challenge information security stress influence ISP compliance. Collectively, most prior studies are based on deterrence theory, protection motivation theory, rational choice theory, and theory of planned behavior to explore the influencing factors that lead to information security compliance and violation. However, limited research is available on its moderation effect and mediation effe -Abstract Truncated-
psychology, clinical, multidisciplinary