Positive Organizational Behaviour and Personal Strengths: Pillars for Increasing Employees’ Compliance with Information Security Policies

With the increase in the use of information systems, the threat of misuse and leaking of organization’s confidential data has also increased. Employees are the biggest asset of any organization but they are at the same time responsible for 90% of the information security breaches. To reduce employees’ information security violations, many theories such as General Deterrence Theory, Protection Motivation theory, Theory of Planned Behaviour and Rational Choice Theory have been introduced over the years. The majority of these theories and models focus on factors such as Job demands, Job Resources and effect of incentives to address employees’ Information security violations. However, Employees positive behaviour and individuals’ strengths have not been addressed in the literature to find their effects on employees’ security compliance. The authors developed a model which intends to increase the employees’ information security compliance within the organization based on their positive traits such as enthusiasm, happiness and Attitude and personal strengths such as past experiences, education and past knowledge. These traits and strengths should be imbedded in both the culture and the policies of the organization. Based on the model, the research explored the effects of employees’ Job demands, Job resources, Negative employee behaviour, personal strengths and positive traits on their intentions to comply with the information security policies of the organization. A questionnaire was developed and Data were collected from three organizations that participated in a confidential survey to test the developed hypothesis which were set based on the model. The research findings suggested that the employees’ Positive traits and personal strengths such as attitude, enthusiasm, happiness, know-how, past knowledge and expertise have considerable effects on their intentions to comply with the information security policies.