Behavioral Compliance Theory : An Experimental and Behavioral Economics Approach to Information Security Policy Compliance

One of the most challenging problems modern firms face in maintaining information security is the behavior of employees: sharing working credentials with friends, telling friends and family private information, selling intellectual property to competitors, stealing credit card information, and disclosing classified information to the public. Much research focuses on policies firms should adopt to reduce or eliminate such employee behavior. This paper uses insights from behavioral economics that specific incentives operationalized as monetary rewards and punishments are effective in improving information security compliance. We use these insights to develop a behavioral compliance theory and test it using a scenario-based design with induced value rewards and punishments for compliance with a company’s information security policy. We also consider induced value rewards and punishments with a low probability of detection. Real monetary payments induce reward and punishment incentives and thus provide strong motivation. Our results show clearly that rewards alone and a combination of rewards and punishments are effective in improving information security policy compliance in both high and low detection environments, but punishments are not effective in our environment. We conclude that a compensation structure based on behavioral compliance theory performs well and outline future research to further test behavioral compliance theory in a business environment