A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Studies included <s> We develop an individual behavioral model that integrates the role of top management and organizational culture into the theory of planned behavior in an attempt to better understand how top management can influence security compliance behavior of employees. Using survey data and structural equation modeling, we test hypotheses on the relationships among top management participation, organizational culture, and key determinants of employee compliance with information security policies. We find that top management participation in information security initiatives has significant direct and indirect influences on employees’ attitudes towards, subjective norm of, and perceived behavioral control over compliance with information security policies. We also find that the top management participation strongly influences organizational culture which in turn impacts employees’ attitudes towards and perceived behavioral control over compliance with information security policies. Furthermore, we find that the effects of top management participation and organizational culture on employee behavioral intentions are fully mediated by employee cognitive beliefs about compliance with information security policies. Our findings extend information security research literature by showing how top management can play a proactive role in shaping employee compliance behavior in addition to the deterrence oriented remedies advocated in the extant literature. Our findings also refine the theories about the role of organizational culture in shaping employee compliance behavior. Significant theoretical and practical implications of these findings are discussed. <s> BIB001 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Studies included <s> The corporate information systems users often engage in risky behavior that can threaten the security and integrity of an organization by exposing sensitive information or weakening the existing technological perimeter security. This risky user behavior can be intentional or unintentional, but in either case can cause severe damage to an organization's reputation as well as potentially extending harm to the organization's clients and customers. Information systems users not following the corporate security policies, even though they know the policies, is known as user omissive behavior, also known as the knowing-doing gap. This research examines the information assurance understanding and security awareness at the user level by developing a structured model of the user knowing-doing gap. The model examines the role of organizational narcissism and its affect on user attitudes towards following the organization's information security policies and procedures. It also includes perceived threat as a factor affecting user attitudes towards following information security rules, as well as subjective norms and perceived behavior control consistent with the theory of planned behavior. This structured model provides a framework and description of user information security behavior and the knowing-doing gap. <s> BIB002
The aim of this review is to include all quantitative studies of security policy compliance and violation that investigate variable relationships described by the TPB. This systematic review based its search process on the search process performed (and described) in  . The systematic review of  surveyed quantitative peer-reviewed research regarding security policy compliance and violation published until early 2012. It used structured phrases in Scopus, Inspec, and Complendex, which were complemented with manual searches on the Internet and in databases and review of citations made in the identified studies. The structured search phrases yielded 461 publications, manual searches yielded 6 publications, and reviews of citations yielded 5 publications. These results were filtered by four reviewers to identify the studies that met the well-defined inclusion criteria; i.e., they should (1) explicitly study security policy compliance behaviour, (2) present quantitative results, and (3) be peerreviewed. The four reviewers found 29 studies that satisfied these criteria  . Of the 29 studies included in  , 14 studies included relationships associated with the TPB and were therefore included in this review. The authors of this paper also reiterated the search procedure performed in  during January 2013 to identify recent contributions related to the TPB and security policy compliance and violation. Two additional studies ( BIB001 and BIB002  ) were found from the structured search queries. Table 1 includes information about the consequence studied (Compliance or Violation), the TPB variables included, other variables included, and the sample size (N).