Employee Information Security Practices: A Framework and Research Agenda

Research Method

The identification and analysis of literature to be reviewed was based on the approach proposed by Webster et al. (2002). Specific keywords were used for identifying articles along with a set of inclusion / exclusion criteria to ensure the quality and relevance of selected papers. The review process was guided by the guidelines suggested by Kitchenham (Kitchenham, 2004, 2009) that include three phases: (1) planning (e.g., identifying the need for a literature search on organizational security risks, developing a procedure for conducting the study), (2) implementing (identifying previous research, selecting the main studies, undertaking quality assurance of the studies, collecting and monitoring the data, and synthesizing the data), and (3) reporting the results. The literature search was performed in Scopus and was confined to primary studies (not literature reviews) that include empirical data (not solely conceptual papers). The search strings used consist of combinations of the main theme (information security), together with synonyms and secondary search terms directly linked to the research questions (Table 1).