Abstract
External pressures could be a compelling force that drives higher education institutions to attain information security. Drawing on the neo-institutional theory, this study examined how the three external expectations: regulative, normative, and cognitive expectations drive the higher education of the United States to attain information security. The research findings suggest that, through regulatory and social normative pressure, cognitive expectation indirectly promotes information security in higher education. That is, cognitive expectation or stakeholder’s perception of higher education determines information security in higher education by harnessing the coercive force of regulatory pressure and leveraging the pressure of meeting social normative expectation.