Out of fear or desire? Toward a better understanding of employees' motivation to follow IS security policies

Given the significant role of people in the management of security, attention has recently been paid to the issue of how to motivate employees to improve security performance of organizations. However, past work has been dependent on deterrence theory rooted in an extrinsic motivation model to help understand why employees do or do not follow security rules in their organization. We postulated that we could better explain employees' security-related rule-following behavior with an approach rooted in an intrinsic motivation model. We therefore developed a model of employees' motivation to comply with IS security policies which incorporated both extrinsic and intrinsic models of human behavior. It was tested with data collected through a survey of 602 employees in the United States. We found that variables rooted in the intrinsic motivation model contributed significantly more to the explained variance of employees' compliance than did those rooted in the extrinsic motivation model.