Original Research

Predicting communication constructs towards determining information security policies compliance

Tsholofelo Rantao, Kennedy Njenga
South African Journal of Information Management | Vol 22, No 1 | a1211 | DOI: https://doi.org/10.4102/sajim.v22i1.1211 | © 2020 Tsholofelo Rantao, Kennedy Njenga | This work is licensed under CC Attribution 4.0
Submitted: 26 February 2020 | Published: 12 October 2020

About the author(s)

Tsholofelo Rantao, Department of Applied Information Systems, College of Business and Economics, University of Johannesburg, Johannesburg, South Africa
Kennedy Njenga, Department of Applied Information Systems, College of Business and Economics, University of Johannesburg, Johannesburg, South Africa

Abstract

Background: Ineffective communication using inappropriate channels and poor listening skills have resulted in poor compliance with information security (InfoSec) policies. Lack of compliance with InfoSec policies minimises employee proficiency whilst also exposing organisations to business risk.

Objectives: This research addresses management’s concern regarding why employees do not comply with InfoSec policies and proposes that how policies are communicated is integral to compliance and that effective communication can serve to ameliorate compliance.

Method: The research adopts communication theories from knowledge management, psychology and information systems to draw on important constructs which are then tested in order to identify those that can strongly predict InfoSec policy compliance. The research was quantitative and used a survey to elicit responses from a sample of 100 employees selected from 6 organisations.

Results: Our findings suggest that of the 10 communication constructs used in the miscellany of perception and determinism (MPD) framework, half of these (five) constructs strongly predicated compliance, namely reasons for communication, media appropriateness, non-conflicting interpretations, feedback immediacy and personal focus. The rest of the constructs were weak predictors or could not predict compliance.

Conclusion: The research advances InfoSec literature by adapting the MPD model as integral to the development, communication and importantly, compliance with InfoSec policies. The MPD model is pertinent as it aggregates theories of communication from a number of academic disciplines and underpinnings not considered before, thereby improving our understanding on how we communicate InfoSec policies for better compliance.


Keywords

information security; policies; compliance; perception theories; determinism theories.

Metrics

Total abstract views: 2508
Total article views: 3075


Crossref Citations

No related citations found.