A3 Refereed book chapter or chapter in a compilation book

Enacting Information Security Policies in Practice – Three Modes of Policy Compliance




SubtitleThree Modes of Policy Compliance

AuthorsMarko Niemimaa, Anna Elina Laaksonen

EditorsFrancois-Xavier de Vaujany, Nathalie Mitev, Giovan Francesco Lanzara, Anouk Mukherjee

Publication year2015

Book title Materiality, Rules and Regulation: New Trends in Management and Organization Studies

First page 223

Last page249

Number of pages27

ISBN978-1-137-55262-4

eISBN978-1-137-55264-8

Web address http://www.palgrave.com/page/detail/materiality,-rules-and-regulation-francoisxavier-de-vaujany/?sf1=barcode&st1=9781137552648


Abstract

While information security policies are widely recognized as the core of organizational information security, their potential arises from employees' compliance with the policies. It is thus no wonder past information systems literature has devoted much time and effort in studying policy compliance. In particular, the past literature has focused on identifying (socio-)psychological factors that anticipate employees' policy compliance. As such, the research has overly emphasized res cogenta (the mental) over res extensa (the material) leading to a tendency to consider the policies as invisible in policy compliance. In this study, we explore the material grounds of policy compliance through sociomaterial theorizing. We build our research on agential realist assumptions and turn to concepts of reification and fetishization as templates to theorize the materialization of policies in conditions of ontological uncertainty. Following an abductive logic, we elaborate and illustrate our theorizing through a case study conducted at a large service provider, SecureISP (a pseudonym). We identify three modes of policy compliance relational to policy creation (reification) and celebration (fetishization) practices: (1) spirit; (2) consensus; and (3) objectual. We conclude by arguing policy compliance should not be viewed in isolation of the materialization of policies. That is, policy compliance becomes intelligible through the materialization of policies in the enactment of situated practices. Implications for policy compliance and sociomateriality are discussed.



Last updated on 2024-26-11 at 12:08