← Search

Neutralization: New Insights into the Problem of Employee Information Systems Security Policy Violations1

Mikko Siponen¹; Anthony Vance²

¹ Information Systems Security Research Centre, Department of Information Processing Science, University of Oulu, Linnanmaa, Oulu 3000, Finland · ² Information Systems Department, Marriott School of Management, Brigham Young University, Provo, Utah 84602, U.S.A.

Employees’ failure to comply with information systems security policies is a major concern for information technology security managers. In efforts to understand this problem, IS security researchers have traditionally viewed violations of IS security policies through the lens of deterrence theory. In this article, we show that neutralization theory, a theory prominent in Criminology but not yet applied in the context of IS, provides a compelling explanation for IS security policy violations and offers new insight into how employees rationalize this behavior. In doing so, we propose a theoretical model in which the effects of neutralization techniques are tested alongside those of sanctions described by deterrence theory. Our empirical results highlight neutralization as an important factor to take into account with regard to developing and implementing organizational security policies and practices.

DOI

10.2307/25750688

Volume

34 (3)

Pages

487-502

Language

en

Export

BibTeX

Sources

crossref