Abstract:Purpose The aim of this study is to encourage management boards to recognize that employees play a major role in the management of information security. Thus, these issues need to be addressed efficiently, especially in organizations in which data are a valuable asset. Design/methodology/approach Before developing the instrument for the survey, first, effective measurement built upon existing literature review was identified and developed and the survey questionnaires were set according to past studies and the findings based on qualitative analyses. Data were collected by using cross-sectional questionnaire and a Likert scale, whereby each question was related to an item as in the work of Witherspoon et al. (2013). Data analysis was done using the SPSS.3B. Findings Based on the results from three surveys and findings, a principle of information security compliance practices was proposed based on the authors’ proposed nine-five-circle (NFC) principle that enhances information security management by identifying human conduct and IT security-related issues regarding the aspect of information security management. Furthermore, the authors’ principle has enabled closing the gap between technology and humans in this study by proving that the factors in the present study’s finding are interrelated and work together, rather than on their own. Research limitations/implications The main objective of this study was to address the lack of research evidence on what mobilizes and influences information security management development and implementation. This objective has been fulfilled by surveying, collecting and analyzing data and by giving an account of the attributes that hinder information security management. Accordingly, a major practical contribution of the present research is the empirical data it provides that enable obtaining a bigger picture and precise information about the real issues that cause information security management shortcomings. Practical implications In this sense, despite the fact that this study has limitations concerning the development of a diagnostic tool, it is obviously the main procedure for the measurements of a framework to assess information security compliance policies in the organizations surveyed. Social implications The present study’s discoveries recommend in actuality that using flexible tools that can be scoped to meet individual organizational needs have positive effects on the implementation of information security management policies within an organization. Accordingly, the research proposes that organizations should forsake the oversimplified generalized guidelines that neglect the verification of the difference in information security requirements in various organizations. Instead, they should focus on the issue of how to sustain and enhance their organization’s compliance through a dynamic compliance process that involves awareness of the compliance regulation, controlling integration and closing gaps. Originality/value The rapid growth of information technology (IT) has created numerous business opportunities. At the same time, this growth has increased information security risk. IT security risk is an important issue in industrial sectors, and in organizations that are innovating owing to globalization or changes in organizational culture. Previously, technology-associated risk assessments focused on various technology factors, but as of the early twenty-first century, the most important issue identified in technology risk studies is the human factor.

Security Awareness: The First Step in Information Security Compliance Behavior

Information Security Policy Noncompliance: an Integrative Social Influence Model.

"What Keeps People Secure is That They Met The Security Team": Deconstructing Drivers And Goals of Organizational Security Awareness

Eyes wide open: The role of situational information security awareness for security‐related behaviour

The effects of knowledge mechanisms on employees' information security threat construal

Cognitive Elaboration on Potential Outcomes and Its Effects on Employees' Information Security Policy Compliance Intention-Exploring the Key Antecedents.

Information security policies compliance in a global setting: An employee's perspective

An Investigation of Employees' Intention to Comply with Information Security System—A Mixed Approach Based on Regression Analysis and fsQCA

A Regressional Study on the Impact of Organizational Security Culture and Transformational Leadership on Social Engineering Awareness among Bank Employees: The Interplay of Security Education and Behavioral Change

Assessing Information Security Competencies of Firm Leaders towards Improving Procedural Information Security Countermeasure: Awareness and Cybersecurity Protective Behavior

Factors Affecting Perception of Information Security and Their Impacts on IT Adoption and Security Practices.

From Compliance to Impact: Tracing the Transformation of an Organizational Security Awareness Program

Security Awareness and Affective Feedback: Categorical Behaviour vs. Reported Behaviour

Investigating the Role of Socio-organizational Factors in the Information Security Compliance in Organizations

Information security management and the human aspect in organizations

Information Security Policy Compliance: Leadership, Trust, Role Values, and Awareness

Assessing the Moderating Effect of Security Technologies on Employees Compliance with Cybersecurity Control Procedures

The influence of social education level on cybersecurity awareness and behaviour: a comparative study of university students and working graduates

Security awareness of single sign-on account in the academic community: the roles of demographics, privacy concerns, and Big-Five personality

Factors That Influence Employees’ Security Policy Compliance: An Awareness-Motivation-Capability Perspective

Getting Users Smart Quick about Security: Results from 90 Minutes of Using a Persuasive Toolkit for Facilitating Information Security Problem Solving by Non-Professionals