Protection Motivation and Deterrence: A Framework for Security Policy Compliance in Organisations

Enterprises establish computer security policies to ensure the security of information resources; however, if employees and end-users of organisational Information Systems (IS) are not keen or are unwilling to follow security policies, then these efforts are in vain. The study is informed by the literature on IS adoption, protection-motivation theory, deterrence theory, and organisational behavior, and is motivated by the fundamental premise that the adoption of information security practices and policies is affected by organisational, environmental, and behavioral factors.