![](bg9.png)
conducted among the Board, Chief Security Officer, department managers, project
managers, employees, and the policy makers. The interviewees will widely cover the
topics of enacting, implementing and deployment ISP and compliance behaviour in
the company and relative national government departments. Comparing to previous
quantitative survey investigations, our qualitative case study provide valuable
comprehensive data highlighting the social, cultural and organisational issues directly
from people.
References
1. Axelrod, R., 1984. The Evolution of Cooperation. Basic Books, New York.
2. Bjorck, F., 2004. Institutional Theory: A New Perspective for Research into IS/IT Security
in Organisations. In Proceedings of the HICSS 04 Working Conference on Information
Systems Security Management, 186-190.
3. Blackstock, K. L., Ingram, J., Burton, R., Brown, K. M. and Slee, B., 2010. Understanding
and Influencing Behaviour Change by Farmers to Improve Water Quality. Science of the
Total Environment, 408 (23), 5631-5638.
4. Boss, S. R., Kirsch, L. J., Angermeier, I., Shingler, R. A., and Boss, R. W., 2009. If
Someone Is Watching, I’ll Do What I’m Asked: Mandatories, Control, and Information
Security. European Journal of Information Systems, 18 (2), 151-164.
5. Bulgurcu, B., Cavusoglu, H. and Benbasat, I., 2010. Information Security Policy
Compliance: An Empirical Study of Rationality-Based Beliefs and Information Security
Awareness. MIS Quarterly, 34 (3), 523-548.
6. Butler, T., 2003. An Institutional Perspective on Developing and Implement Intranet - and
Internet -Based Information Systems. Information Systems Journal, 13 (3), 209-231.
7. Chiasson, M. W. and Davidson, E., 2005. Taking Industry Seriously in Information System
Research. MIS Quarterly, 29 (4), 591-605.
8. Da Veiga, A. and Eloff, J. H. P., 2007. An Information Security Governance Framework.
Information Systems Management, 24 (4), 361-372.
9. Da Veiga, A. and Eloff, J. H. P., 2010. A Framework and Assessment Instrument for
Information Security Culture. Computer & Security, 29 (1), 196-207.
10. Dhillon, G. and Backhouse, J., 2001. Current Directions in Information Security Research:
Toward Socio-Organisational Perspectives. Information Systems Journal, 11 (2), 127-153.
11. DiMaggio, P. J. and Powell, W., 1983. The Iron Cage Revisited: Institutional Isomorphism
and Collective Rationality in Organisational Fields. American Sociological Review, 48 (3),
147-160.
12. Gordon, L. A., 2006. Economics Aspects of Information Security: An Emerging Field of
Research. Information Systems Frontier, 8 (5), 335-337.
13. Hechter, M., Opp, K. D. and Wippler, R., 1990. Social Institutions: Their Emergence,
Maintenance and Effects. eds. Aldine de Gruyter, New York and Berlin.
14. Herath, T. and Rao, H. R., 2009a. Protection Motivation and Deterrence: A Framework for
Security Policy Compliance in Organisations. European Journal of Information Systems, 18
(2), 106-125.
15. Herath, T. and Rao, H. R., 2009b. Encouraging Information Security Behaviours in
Organisations: Role of Penalties, Pressures and Perceived Effectiveness. Decision Support
Systems, 47 (2), 154-165.
16. Hu, Q., Hart, P. and Cooke, D., 2007. The Role of External and Internal Influences on
Information System Security- A Neo-Institutional Perspective. Journal of Strategic
Information System, 16 (2), 153-172.
17. Johnston, A. C. and Warkentin, M., 2010. Fear Appeals and Information Security
140