Abstract:Employee security compliance behavior has become an important safeguard to protect the security of corporate information assets. Focusing on human factors, this paper discusses how to regulate and guide employees' compliance with information security systems through effective methods. Based on protection motivation theory (PMT), a model of employees' intention to comply with the information security system was constructed. A questionnaire survey was adopted to obtain 224 valid data points, and SPSS 26.0 was applied to verify the hypotheses underlying the research model. Then, based on the results of a regression analysis, fuzzy set qualitative comparative analysis (fsQCA) was used to explore the conditional configurations that affect employees' intention to comply with the information security system from a holistic perspective. The empirical results demonstrated that perceived severity, perceived vulnerability, response efficacy, and self-efficacy all positively influenced the employees' intention to comply with the information security system; while rewards and response costs had a negative effect. Threat appraisal had a greater effect on employees' intention to comply with the information security system compared to response appraisal. The fsQCA results showed that individual antecedent conditions are not necessary to influence employees' intention to comply with an information security system. Seven pathways exist that influence an employees' intention to comply with an information security system, with reward, self-efficacy, and response cost being the core conditions having the highest probability of occurring in each configuration of pathways, and with perceived severity and self-efficacy appearing in the core conditions of configurations with an original coverage greater than 40%. Theoretically, this study discusses the influence of the elements of PMT on employees' intention to comply with an information security system, reveals the mechanism of influence of the combination of the influencing factors on the outcome variables, and identifies the core factors and auxiliary factors in the condition configurations, providing a new broader perspective for the study of information security compliance behavior and providing some theoretical support for strengthening enterprise security management. Practically, targeted suggestions are proposed based on the research results, to increase the intention of enterprise employees to comply with information security systems, thereby improving the effectiveness of enterprise information security management and the degree of information security in enterprises.

Employees' Intention to Comply with Information Security Policies: The Impacts of Loafing and Commitment

Information Security Policy Noncompliance: an Integrative Social Influence Model.

Cognitive Elaboration on Potential Outcomes and Its Effects on Employees' Information Security Policy Compliance Intention-Exploring the Key Antecedents.

Ensuring Employees' Information Security Policy Compliance by Carrot and Stick: the Moderating Roles of Organizational Commitment and Gender

Motivating information security policy compliance: The critical role of supervisor-subordinate guanxi and organizational commitment

An Investigation of Employees' Intention to Comply with Information Security System—A Mixed Approach Based on Regression Analysis and fsQCA

A Framework for Analyzing and Improving ISP Compliance

Believe It or Not: Employees Intend to Comply With Information Security Policy Because of the Desire for Trade-Offs

The Effects and Moderators of Cyber-Loafing Controls: an Empirical Study of Chinese Public Servants

Factors That Influence Employees’ Security Policy Compliance: An Awareness-Motivation-Capability Perspective

From hindrance to challenge

The relationship between servant leadership and cyberloafing: an investigation of meaningful work versus citizenship pressure

Cyberloafing in the Workplace: Mitigation Tactics and Their Impact on Individuals’ Behavior

Cognitive‐affective drivers of employees' daily compliance with information security policies: A multilevel, longitudinal study

Hospital Staff’s Adherence to Information Security Policy: A Quest for the Antecedents of Deterrence Variables

Sanction Severity and Employees' Information Security Policy Compliance: Investigating Mediating, Moderating, and Control Variables

Psychological Capital and Information Security Policy Compliance

Exploring the effects of organizational justice, personal ethics and sanction on internet use policy compliance

Does Perceived Overqualification Lead to Cyberloafing? A Moderated-Mediation Model Based on Social Cognitive Theory

Peers Matter: the Moderating Role of Social Influence on Information Security Policy Compliance.

Employees' Information Security Policy Compliance: A Norm Activation Perspective