Siponen, 2010: Neutralization: New Insights into the Problem of Employee Information Systems Security Policy Violations

Topic:

A theoretical model in which the effects of neutralization techniques are tested alongside those of sanctions described by deterrence theory. Our empirical results highlight neutralization as an important factor to take into account with regard to developing and implementing organizational security policies and practices.

Survey with three scenarios, 1449 responses, Survey and scenarios in the Appendix

Constructs in this publication:

Construct	Cites	Category	Questions given?	Content validity	Pretests	Response type	Notes
Intention	Paternoster, 1996		yes	15 experts panel with three rounds of review	pretest	11 point scale
Denial of responsibility	Thurman, 1984	Neutralization	yes	16 experts panel with three rounds of review	pretest	11 point scale	2/3 items new
Denial of injury	Thurman, 1984	Neutralization	yes	17 experts panel with three rounds of review	pretest	11 point scale	2/3 items new
Condemnation of the condemners	Thurman, 1984	Neutralization	yes	18 experts panel with three rounds of review	pretest	11 point scale	2/3 items new
Defense of necessity	Thurman, 1984	Neutralization	yes	19 experts panel with three rounds of review	pretest	11 point scale	2/3 items new
Metaphor of the ledger	Eliason, 1999	Neutralization	yes	20 experts panel with three rounds of review	pretest	11 point scale	New item based on
Appeal to higher loyalties	Thurman, 1984	Neutralization	yes	21 experts panel with three rounds of review	pretest	11 point scale
Certainty	Nagin, 1993, Paternoster, 1996	Formal Sanctions	yes	22 experts panel with three rounds of review	pretest	11 point scale
Severity	Nagin, 1993, Paternoster, 1996	Formal Sanctions	yes	23 experts panel with three rounds of review	pretest	11 point scale
Certainty	Nagin, 1993, Paternoster, 1996	Informal Sanctions	yes	24 experts panel with three rounds of review	pretest	11 point scale
Severity	Nagin, 1993, Paternoster, 1996	Informal Sanctions	yes	25 experts panel with three rounds of review	pretest	11 point scale
Certainty of shame for oneself	Nagin, 1993, Paternoster, 1996		yes	26 experts panel with three rounds of review	pretest	11 point scale
Severity of shame for oneself	Nagin, 1993, Paternoster, 1996		yes	27 experts panel with three rounds of review	pretest	11 point scale

This publication is cited by the following publications:

• Cheng et al., 2013: Perceived certainty
• Cheng et al., 2013: Perceived severity
• D'Arcy et al., 2014: perceived sanctions
• Sommestad et al., 2014: Intention to misuse
• Sommestad et al., 2014: Neutralization
• Sommestad et al., 2014: Perceived risk of Shame
• Sommestad et al., 2014: Perceived informal risk
• Sommestad et al., 2014: Perceived formal Risk

Citation:

Mikko Siponen and Anthony Vance. Neutralization: New insights into the problem of employee information systems security policy violations. MIS quarterly, 34(3):487, 2010. doi:10.2307/25750688.

Bibtex

@article{siponen_neutralization_2010,
 abstract = {Employees' failure to comply with information systems security policies is a major concern for information technology security managers. In efforts to understand this problem, IS security researchers have traditionally viewed violations of IS security policies through the lens of deterrence theory. In this article, we show that neutralization theory, a theory prominent in Criminology but not yet applied in the context of IS, provides a compelling explanation for IS security policy violations and offers new insight into how employees rationalize this behavior. In doing so, we propose a theoretical model in which the effects of neutralization techniques are tested alongside those of sanctions described by deterrence theory. Our empirical results highlight neutralization as an important factor to take into account with regard to developing and implementing organizational security policies and practices.},
 author = {Siponen, Mikko and Vance, Anthony},
 doi = {10.2307/25750688},
 journal = {MIS quarterly},
 keywords = {Compliance,Deterrence theory,IS security,IS security policies,Neutralization theory},
 number = {3},
 pages = {487},
 title = {Neutralization: {{New}} Insights into the Problem of Employee Information Systems Security Policy Violations},
 volume = {34},
 year = {2010}
}

---