Employees’ BYOD Security Policy Compliance in the Public Sector

ABSTRACT

The proliferation of the Bring Your Own Device (BYOD) policy has instigated a widespread change across organizations. However, employees’ compliance toward BYOD security policy remains a challenge. Building on the organizational control, security culture, and social cognitive theory, a research framework for analyzing BYOD security policy compliance factors was developed in this study. To validate the framework, 346 responses were obtained from three Critical National Information Infrastructure (CNII) agencies. Using Partial Least Square-Sequential Equation Modelling (PLS-SEM), the study confirmed that perceived mandatoriness, self-efficacy, and psychological ownership are influential in predicting BYOD security policy compliance. Specification of policy is associated with perceived mandatoriness. Self-efficacy is associated with both BYOD IT support and SETA. Further, security culture was found to have no significant relationship with BYOD security policy compliance.

KEYWORDS:

• Security policy compliance
• BYOD security policy
• organizational control theory
• social cognitive theory
• security culture
• public sector security policy
• security training and awareness

Acknowledgments

The authors would like to extend their heartfelt gratitude and appreciation to the Ministry of Education (MOE), Malaysia, for funding this project with the Fundamental Research Grant Scheme (FRGS) (FP056-2019A). Ref. no.: FRGS/1/2019/ICT04/UM/02/1.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Additional information

Funding

The work was supported by the Ministry of Education, Malaysia [FRGS/1/2019/ICT04/UM/02/1].