To Örebro University

This thesis examines research on employees’ behavior toward information security policies (ISPs), commonly studied under the concept of non-/compliance. While extensive research has expanded knowledge in this field, recent reviews highlight inconsistent and contradictory research findings. These inconsistencies are often attributed to contextual moderators, but this explanation is only partial. This thesis offers a complementary perspective by focusing on definitions and measurements of variables commonly used in research.

Using a sequential multi-method approach, including a traditional survey, a literature review, interviews, and a survey experiments, this thesis demonstrates that non-/compliance research suffers from widespread inconsistencies/unclarities in defining and measuring key variables, both within and across studies. The thesis also finds that these inconsistencies/unclarities may contribute to differences in research results.

These identified inconsistencies in variable definitions and measurements are not only of theoretical concern (in terms of theoretical specificity) but may also have significant empirical consequences insofar as they may influence research findings. Based on this, this thesis contributes to the extant literature by suggesting a research agenda specifying 12 considerations for research design that future researchers should consider in order to improve theoretical development in the field, minimize the impact of inconsistent variable definitions and measurements on research results, and, most importantly, enhance our understanding of ISP non-/compliance phenomena.