Work

Differential Effects of Challenge versus Hindrance Information Security Policy Demands on Employees' Security-related Precaution Taking Behaviors

Year: 2026

Type: article

Abstract: Information security policies (ISP) are essential organizational mechanisms for managing security risks, yet their demands may shape employees' security-related behaviors in complex ways. Drawing on the challenge–hindrance stressor framework and job demands–resources theory, this study develops a theoretical model to examine how challenge and hindrance ISP demand stressors relate to employees' security-related precaution taking. We further introduce organizational security climate and security mindfulness as job and personal resources that condition these relationships. By focusing on precaution taking, this study moves beyond compliance-centered perspectives and captures both prescribed and discretionary protective actions through which employees contribute to organizational information security. This study contributes to information systems security research by offering a more nuanced understanding of ISP demands and by explaining how organizational and individual resources may shape employees' responses to ISP implementation.

Source: Journal of the Association for Information Systems

Authors: Tong, Hao, Shou, Minghuan, Jia, Furong, Yu, Jie (Joseph), Yao, Zeng

Institutions: University of Nottingham Ningbo China, Hangzhou Dianzi University, Xi’an Jiaotong-Liverpool University

Language: English

Topic: Information and Cyber Security

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

SDG: Peace, justice, and strong institutions

Open Access status: green

OpenAlex ID: W7164795165

FWCI: