Work

Non-technical determinants of information security policy compliance: An integrated PMT-TPB model with psychological ownership, trust, and social influence

Year: 2026

Type: article

Abstract: Many assume personal attitudes are the main driver of information security policy (ISP) compliance, but this also rests on stewardship and norms inside organizations. With a focus on Saudi Arabia, a high power-distance, collectivist context, we integrate Protection Motivation Theory and the Theory of Planned Behavior with psychological ownership, trust in management, and social influence, we test a direct path from response efficacy to behavior. We surveyed 628 employees across Saudi organizations and analyzed the data with PLS-SEM (SmartPLS 4). Results show that intention is the strongest predictor of compliance behavior. Trust, psychological ownership, social influence, security awareness, and self-efficacy raise intention. Response efficacy, security awareness, and more weakly, perceived severity, shape attitude; perceived vulnerability does not. Response efficacy also increases compliance directly. Mediation tests indicate that intention carries most effects from stewardship, efficacy, awareness, and norms to behavior. These results fit a context where norms and stewardship weigh more than personal attitudes in forming intentions. The study offers theoretical and practical implications: build ownership and trust, leverage peer norms, as well as strengthen awareness and efficacy to raise compliance.

Source: Computers in Human Behavior Reports

DOI: 10.1016/j.chbr.2026.100947

Authors: Mohammad Mulayh Alshammari, Yaser Hasan Al-Mamary

Institution: University of Ha'il

Language: English

Topic: Information and Cyber Security

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

SDG: Peace, justice, and strong institutions

Open Access status: gold

Estimated APC paid: $1,880