ABSTRACTThis paper is motivated by the need to find reasons for the divergent findings reported in many studies that assessed the effects of social norms on IS security policy compliance, and answers multiple calls for additional research on this subject. In doing so, this paper contributes to the existing information security literature by presenting an integrated model that draws from the General Deterrence Theory, the Social Norms, and the Normality perspective. Specifically, this study investigates the effect of formal sanctions on information security policies compliance mediated by subjective, descriptive, and moral norms. The data were collected from the employees of five organizations in the Southern United States using the survey method. Quantitative analysis of the sampled data was conducted by using PLS to assess the various hypotheses. This study shows that descriptive and moral norms mediate the relationships between formal sanctions and information security compliance. The paper highlights the influence of moral norms on how IT users respond to IS security policies.KEYWORDS: Security policies compliancesocial normsorganizational punishmentmoral normspolicies complianceinformation systems security Disclosure statementNo potential conflict of interest was reported by the author(s).

Mohammad I. Merhi

Punit Ahluwalia

Journal of Computer Information Systems

计算机信息系统杂志 (JCIS) 旨在发表探索信息系统和技术研究的手稿，从而在全球范围内开发计算机信息系统。我们鼓励涵盖以下主题领域的手稿：-计算机信息中的分析、商业智能、决策支持系统系统 - 移动技术、移动应用程序 - 人机交互 - 信息和/或技术管理、组织行为与文化 - 数据管理、数据挖掘、数据库设计和开发 - 电子商务技术和计算机信息系统中的问题 - 计算机系统企业架构、企业资源规划 - IT 的伦理和法律问题 - 健康信息学 - 信息保障和安全 - 网络安全、网络取证 - IT 项目管理 - 计算机信息系统中的知识管理- 网络和/或电信 - 系统分析、设计和/或实施 - 网络编程和开发 - 课程问题、教学问题、顶峰课程、专业课程认证 - 电子学习技术、分析、未来

The Journal of Computer Information Systems aims to publish manuscripts that explore research in information systems and technology, thereby advancing the development of computer information systems globally. We encourage submissions covering the following areas: - Analytics and business intelligence in computer information - Decision support systems - Mobile technologies and applications - Human-computer interaction - Information and technology management, organizational behavior, and culture - Data management, data mining, database design, and development - E-commerce technologies and issues in computer information systems - Computer system architecture and enterprise resource planning - Ethical and legal issues in IT - Health informatics - Information assurance and security - Cybersecurity and digital forensics - IT project management - Knowledge management in computer information systems - Networking and telecommunications - Systems analysis, design, and implementation - Web programming and development - Curriculum issues, teaching issues, capstone courses, and professional course accreditation - E-learning technologies, analytics, and future trends.

《Journal of Computer Information Systems》旨在发表关于信息系统和技术研究的手稿，以推动全球计算机信息系统的发展。我们鼓励涵盖以下主题领域的稿件：- 计算机信息中的分析与商业智能 - 决策支持系统 - 移动技术与应用 - 人机交互 - 信息与技术管理、组织行为与文化 - 数据管理、数据挖掘、数据库设计与开发 - 电子商务技术及其在计算机信息系统中的应用 - 企业架构与企业资源规划 - IT伦理与法律问题 - 健康信息学 - 信息保障与安全 - 网络安全与网络取证 - IT项目管理 - 计算机信息系统中的知识管理 - 网络与电信 - 系统分析、设计与实施 - 网络编程与开发 - 课程问题、教学问题、顶峰课程与专业课程认证 - 电子学习技术、分析与未来发展

Category	Quartile
管理学	4
管理学, 计算机信息系统	4

Predicting Compliance of Security Policies: Norms and Sanctions

ivySCI AI Smartly Parses PDF, Answers Researchers' Questions, and Helps You Understand Papers in Seconds

Journal Info

Category	Quartile
COMPUTER SCIENCE, INFORMATION SYSTEMS	2