Should i really do that? Using quantile regression to examine the impact of sanctions on information security policy compliance behavior

Deterrence theory is one of the most commonly used theories to study information security policy non-compliance behavior. However, the results of studies in the information security field are ambiguous. To further address this heterogeneity, various influencing factors have been considered in the context of de-terrence theory. However, a current challenge with these findings is that recent studies that quantitatively assess the effectiveness of deterrence have relied predominantly on methods that analyze the underlying data, starting from a regression-based approach. By applying quantile regression, we estimate the overall effect of deterrents, and uncover how their effect differs among employees with different inclinations to-ward ISP compliance behavior - a critical insight for determining security measures for specific employee groups. Based on longitudinal data gathered in the U.S., our findings show significantly different effects in the analyzed quantiles for both aspects of sanctions, namely certainty and severity. & COPY; 2023 The Authors. Published by Elsevier Ltd. This is an open access article under the CC BY license ( http://creativecommons.org/licenses/by/4.0/ )

Automated summary

Deterrence theory is commonly used to study non-compliance behavior in information security policy. However, the results of studies in this field are ambiguous. To address this, various influencing factors have been considered, and quantile regression has been applied to estimate the overall effect of deterrents. Based on longitudinal data from the U.S., our findings reveal significant differences in the effects of sanctions certainty and severity among employees with different inclinations towards ISP compliance behavior.