Organizational governance, social bonds and information security policy compliance: a perspective towards oil and gas employees

• Main Authors: Ali, R.F., Dominic, P.D.D., Ali, K.
• Format: Article
• Published: MDPI 2020
• Online Access: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85092897986&doi=10.3390%2fsu12208576&partnerID=40&md5=bac10b9c3e264074b051f7842863af9e; http://eprints.utp.edu.my/29904/

Information security attacks on oil and gas (O&G) organizations have increased since the last decade. From 2015 to 2019, almost 70 percent of O&G organizations faced at least one significant security breach worldwide. Research has shown that 43 percent of security attacks on O&G organizations occur due to the non-compliant behavior of O&G employees towards information security policy. The existing literature provides multiple solutions for technical security controls of O&G organizations. However, there are very few studies available that address behavioral security controls, specifically for O&G organizations of developing countries. The purpose of this study is to provide a comprehensive framework for information security policy compliance (ISPC) for the O&G sector. A mixed-method approach is used to develop the research framework. Semi-structured interviews from O&G specialists refined the developed framework. Based on qualitative study a survey questionnaire was developed. To evaluate the research framework, structural equation modeling was applied to a sample of 254 managers/executives from 150 Malaysian O&G organizations. The obtained test results confirmed the proposed research model, according to which good social bonding among employees plays a critical role in improving ISPC. However, there was less support for the notion that all organizational governance factors significantly improve the social bonding of Malaysian O&G organizations employees. This paper contributes to the current information system (IS) literature by exploring the interrelationships among organizational governance, social bonding, and information security policy compliance (ISPC) in Malaysian O&G organizations. © 2020 by the authors. Licensee MDPI, Basel, Switzerland.