A3 Refereed book chapter or chapter in a compilation book
Enacting Information Security Policies in Practice – Three Modes of Policy Compliance
Subtitle: Three Modes of Policy Compliance
Authors: Marko Niemimaa, Anna Elina Laaksonen
Editors: Francois-Xavier de Vaujany, Nathalie Mitev, Giovan Francesco Lanzara, Anouk Mukherjee
Publication year: 2015
Book title : Materiality, Rules and Regulation: New Trends in Management and Organization Studies
First page : 223
Last page: 249
Number of pages: 27
ISBN: 978-1-137-55262-4
eISBN: 978-1-137-55264-8
Web address : http://www.palgrave.com/page/detail/materiality,-rules-and-regulation-francoisxavier-de-vaujany/?sf1=barcode&st1=9781137552648
While information security policies are widely recognized as the core of organizational information security, their potential arises from employees' compliance with the policies. It is thus no wonder past information systems literature has devoted much time and effort in studying policy compliance. In particular, the past literature has focused on identifying (socio-)psychological factors that anticipate employees' policy compliance. As such, the research has overly emphasized res cogenta (the mental) over res extensa (the material) leading to a tendency to consider the policies as invisible in policy compliance. In this study, we explore the material grounds of policy compliance through sociomaterial theorizing. We build our research on agential realist assumptions and turn to concepts of reification and fetishization as templates to theorize the materialization of policies in conditions of ontological uncertainty. Following an abductive logic, we elaborate and illustrate our theorizing through a case study conducted at a large service provider, SecureISP (a pseudonym). We identify three modes of policy compliance relational to policy creation (reification) and celebration (fetishization) practices: (1) spirit; (2) consensus; and (3) objectual. We conclude by arguing policy compliance should not be viewed in isolation of the materialization of policies. That is, policy compliance becomes intelligible through the materialization of policies in the enactment of situated practices. Implications for policy compliance and sociomateriality are discussed.