What is Information Systems Security Policies (ISSPs)

There is a long-held belief that deterrence mechanisms are more useful in developing countries. Evidence on this belief is anecdotal rather than empirical. In this chapter, individual compliance to information system security policy (ISSP) is examined through the lenses of deterrence theory. The effects of certainty of detection and severity of punishment on attitude towards compliance and also ISSP compliance behaviour are investigated. A survey questionnaire was distributed to gather responses from 432 individuals who are staff of a public university in Ghana. The data was analysed using partial least square structural equation modelling (PLS-SEM). The results indicate that severity of punishment has a positive effect on attitude towards compliance and ISSP compliance behaviour. However, certainty of detection neither affected attitude towards compliance nor ISSP compliance behaviour. It is recommended that organizations enhance the severity of sanctions imposed on those who violate ISSPs. Future studies should explore how users apply neutralization techniques to evade sanctions.