A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Continuation of Table 5 <s> This paper describes and reviews the theory of planned behavior (TPB). The focus is on evidence supporting the further extension of the TPB in various ways. Empirical and theoretical evidence to support the addition of 6 variables to the TPB is reviewed: belief salience measures, past behaviodhabit, perceived behavioral control (PBC) vs. selfefficacy, moral norms, self-identity, and affective beliefs. In each case there appears to be growing empirical evidence to support their addition to the TPB and some understanding of the processes by which they may be related to other TPB variables, intentions, and behavior. Two avenues for expansion of the TPB are presented. First, the possibility of incorporating the TPB into a dual-process model of attitude-behavior relationships is reviewed. Second, the expansion of the TPB to include consideration of the volitional processes determining how goal intentions may lead to goal achievement is discussed. <s> BIB001 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Continuation of Table 5 <s> The literature agrees that the major threat to IS security is constituted by careless employees who do not comply with organizations' IS security policies and procedures. To address this concern, different approaches for ensuring employees' IS security policy compliance have been proposed. Prior research on IS security compliance has criticized these extant IS security awareness approaches as lacking theoretically and empirically grounded principles to ensure that employees comply with IS security policies. To fill this gap, this study proposes a theoretical model that contains the factors that explain employees' IS security policy compliance. Data (N=245) from a Finnish company provides empirical support for the model. The results suggest that information quality has a significant effect on actual IS security policy compliance. Employees' attitude, normative beliefs and habits have significant effect on intention to comply with IS security policy. Threat appraisal and facilitating conditions have significant impact on attitude towards complying, while coping appraisal does not have a significant effect on employees' attitude towards complying. Sanctions have insignificant effect on intention to comply with IS security policy and awards do not have a significant effect on actual compliance with IS security policy <s> BIB002 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Continuation of Table 5 <s> AbstractEnterprises establish computer security policies to ensure the security of information resources; however, if employees and end-users of organisational information systems (IS) are not keen or are unwilling to follow security policies, then these efforts are in vain. Our study is informed by the literature on IS adoption, protection-motivation theory, deterrence theory, and organisational behaviour, and is motivated by the fundamental premise that the adoption of information security practices and policies is affected by organisational, environmental, and behavioural factors. We develop an Integrated Protection Motivation and Deterrence model of security policy compliance under the umbrella of Taylor-Todd's Decomposed Theory of Planned Behaviour. Furthermore, we evaluate the effect of organisational commitment on employee security compliance intentions. Finally, we empirically test the theoretical model with a data set representing the survey responses of 312 employees from 78 organisations. Our r... <s> BIB003 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Continuation of Table 5 <s> End users are said to be "the weakest link" in information systems (IS) security management in the workplace. They often knowingly engage in certain insecure uses of IS and violate security policies without malicious intentions. Few studies, however, have examined end user motivation to engage in such behavior. To fill this research gap, in the present study we propose and test empirically a nonmalicious security violation (NMSV) model with data from a survey of end users at work. The results suggest that utilitarian outcomes (relative advantage for job performance, perceived security risk), normative outcomes (workgroup norms), and self-identity outcomes (perceived identity match) are key determinants of end user intentions to engage in NMSVs. In contrast, the influences of attitudes toward security policy and perceived sanctions are not significant. This study makes several significant contributions to research on security-related behavior by (1) highlighting the importance of job performance goals and security risk perceptions on shaping user attitudes, (2) demonstrating the effect of workgroup norms on both user attitudes and behavioral intentions, (3) introducing and testing the effect of perceived identity match on user attitudes and behavioral intentions, and (4) identifying nonlinear relationships between constructs. This study also informs security management practices on the importance of linking security and business objectives, obtaining user buy-in of security measures, and cultivating a culture of secure behavior at local workgroup levels in organizations. <s> BIB004 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Continuation of Table 5 <s> This research investigated information systems security policy (ISSP) compliance by drawing upon two relevant theories i.e. the theory of planned behavior (TPB) and the protection motivation theory (PMT). A research model that fused constituents of the aforementioned theories was proposed and validated. Relevant hypotheses were developed to test the research conceptualization. Data analysis was performed using the partial least squares (PLS) technique. Using a survey of 124 business managers and IS professionals, this study showed that factors such as self-efficacy, attitude toward compliance, subjective norms, response efficacy and perceived vulnerability positively influence ISSP behavioral compliance intentions of employees. The data analysis did not support perceived severity and response cost as being predictors of ISSP behavioral compliance intentions. The study's implications for research and practice are discussed. <s> BIB005 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Continuation of Table 5 <s> The corporate information systems users often engage in risky behavior that can threaten the security and integrity of an organization by exposing sensitive information or weakening the existing technological perimeter security. This risky user behavior can be intentional or unintentional, but in either case can cause severe damage to an organization's reputation as well as potentially extending harm to the organization's clients and customers. Information systems users not following the corporate security policies, even though they know the policies, is known as user omissive behavior, also known as the knowing-doing gap. This research examines the information assurance understanding and security awareness at the user level by developing a structured model of the user knowing-doing gap. The model examines the role of organizational narcissism and its affect on user attitudes towards following the organization's information security policies and procedures. It also includes perceived threat as a factor affecting user attitudes towards following information security rules, as well as subjective norms and perceived behavior control consistent with the theory of planned behavior. This structured model provides a framework and description of user information security behavior and the knowing-doing gap. <s> BIB006
Varying regression coefficients for TPB variables. The regression coefficients are weakened because of multicollinearity and inclusion of many variables. The regression coefficients are inflated because of multicollinearity and because TPB variables are omitted from the model. Likely. Large regression coefficients are reported by studies with few variables ( BIB004  ). However, studies with correlated variables (e.g., habits in BIB002 ) also report large regression coefficients. Furthermore, neither  nor  included additional variables, but they produced comparably small regression coefficients. In some studies, PBC has little effect on intentions and behaviour. Self-efficacy is measured, and this operationalisation excludes external sources BIB001 or perceived autonomy  . Possible. Studies that used PBC (i.e., [8-10, 14, 16] ) yielded greater coefficients on intentions than studies that used self-efficacy, (β=0.27 and r=0.47) vs. (β=0.21 and r=0.42). However, for regression coefficients, PBC seems to have less influence on behaviour than selfefficacy. In some studies, the antecedents of intentions seem less important The "principle of compatibility" is not fulfilled, i.e., the action, target, context and time should be the same when all variables are measured     Unlikely. In BIB005 , a mix of questions regarding general security behaviour and compliance behaviour is used; in BIB006  , following rules and taking precautions are mixed; and in BIB003 , technology questions are mixed with questions regarding compliance behaviour. Their unweighted correlation coefficients (ATT=0.47, SN=0.66, and PBC=0.46) are even greater than the correlation coefficients of those with compatible questions (ATT=0.47, SN=0.48, and PBC=0.43). The regression coefficients point in different directions.