Moral evaluation dimensions of information security policy compliance

Purpose We examine information systems security policy (ISSP) compliance through the lens of ethical decision-making to uncover new insights into employee ISSP compliance and recommend managerial practices that improve ISSP compliance. Design/methodology/approach We anchored our theoretical framework to moral intensity theory and developed hypotheses based on deontological ethics, utilitarian ethics and construal level theory. Scenario-based surveys were conducted to test the research model. Findings We found that employees would align their compliance motivation with organizational information security interests even at a cost to themselves if negative consequences to the organization from data breaches are well understood and if a pro-compliance social consensus among coworkers is evident. Employees tend to develop a sufficient understanding of the negative consequences of data breaches if they feel psychologically close to the organization and if they perceive that damage from data breaches will occur sooner rather than later. Practical implications To improve compliance, we recommend that organizations align employee compliance motivation with organizational security interests through clear communications of potential security breach damages, fostering a pro-compliance culture and reducing the psychological distance employees feel from the organization. Originality/value Theoretically, our ethical decision-making perspective on ISSP compliance complements the cost-benefit analysis framework widely adopted in ISSP compliance research. Our research model offers a new framework for analyzing employee ISSP compliance. Managerially, highlighting the effects of psychological distance and social consensus among coworkers contributes to the management of employee ISSP compliance.