資訊安全政策的組織正義知覺對員工職場行為意圖之影響：組織信任的中介效果

The Impact of Organizational Justice Perceptions about Information Security Policy on Employees' Intentions of Workplace Behaviors: Mediating Effects of Organizational Trust

10.6188/JEB.202112_23(2).0004

徐淑如(Shu-Lu Hsu)；戴基峯(Jeffrey C. F. Tai)；康晉維(Joshua Kang)

資訊安全政策 ； 組織正義知覺 ； 組織信任 ； 職場行為 ； Information security policy ； organizational justice perceptions ； organizational trust ； workplace behaviors

電子商務學報

23卷2期（2021 / 12 / 30）

179 - 226

繁體中文

目前有關資訊安全政策的組織面研究，多半著眼在員工的政策遵行或電腦濫用防治效果，鮮少針對資訊安全政策對員工的職場行為之影響進行探討。基於社會交換理論，本研究探索員工資訊安全政策的組織正義知覺對其組織信任和各項職場行為意圖之影響。本研究以問卷調查獲得362份有效樣本，並採SmartPLS進行研究假說檢定。分析結果顯示，員工對資訊安全政策的分配與程序正義知覺會正向地影響其組織信任，進而影響其留職、規範職務、資訊安全與組織公民等行為的意圖。本研究彰顯出資訊安全政策的發展與施行之組織正義知覺，不僅和員工是否遵循資安政策有關，其影響還擴及員工對組織的信任及各項攸關組織有效運作的職場行為。

The organizational research of Information Security Policy (ISP) primarily focused on studying its effects on policy conformance and computer abuse prevention, leaving the effects of ISP on employees' workplace behaviors under-investigated. Drawing on the social exchange theory, this study explores the impact of employees' justice perceptions about ISP on their organizational trust and intentions of workplace behaviors. We collected 362 effective samples through online survey and analyzed data with SmartPLS. Data analysis showed that distributive and procedural justice both positively influence employees' organizational trust, which in turn affect their intentions to remain in current jobs and to engage in ISP conformance, prescribed job and organizational citizenship behaviors. This study contributes to the literature by illuminating that justice perceptions about ISP can have profound impact on various workplace behaviors beyond ISP conformance.

1. Cohen-Charash, Y., & Mueller, J. S. (2007). Does perceived unfairness exacerbate or mitigate interpersonal counterproductive work behaviors related to envy? Journal of Applied Psychology, 92(3), 666-680.
   連結：
2. Cohen-Charash, Y., & Spector, P. E. (2001). The role of justice in organizations: A meta-analysis. Organizational Behavior and Human Decision Process, 86(2), 278-321.
   連結：
3. Colquitt, J. A., Conlon, D. E., Wesson, M. J., Porter, C., & Ng, K. Y. (2001). Justice at the millennium: A meta-analytic review of 25 years of organizational research. Journal of Applied Psychology, 86(3), 425-445.
   連結：
4. Colquitt, J. A., LePine, J. A., Piccolo, R. F., Zapata, C. P., & Rich, B. L. (2012). Explaining the justice-performance relationship: Trust as exchange deepener or trust as uncertainty reducer? Journal of Applied Psychology, 97(1), 1-15.
   連結：
5. Colquitt, J. A., Scott, B. A., & LePine, J. A. (2007). Trust, trustworthiness, and trust propensity: A meta-analytic test of their unique relationships with risk taking and job performance. Journal of Applied Psychology, 92(4), 909-927.
   連結：
6. Colquitt, J. A., Scott, B. A., Rodell, J. B., Long, D. M., Zapata, C. P., & Conlon, D. E. (2013). Justice at the millennium, a decade later: A meta-analytic test of social exchange and affect-based perspectives. Journal of Applied Psychology, 98(2), 199-236.
   連結：
7. Colquitt, J., & Rodell, J. B. (2011). Justice, trust, and trustworthiness: A longitudinal analysis integrating three theoretical perspectives. Academy of Management Journal, 54(6), 1183-1206.
   連結：
8. Colquitt, J., & Rodell, J. B. (2015). Measuring justice and fairness. In Cropanzano, R., & Ambrose, M. L. (Eds.), The Oxford handbook of justice in the workplace (187-202). Oxford: Oxford University Press.
   連結：
9. Colquitt, J., & Zipay, K. P. (2015). Justice, fairness, and employee reactions. Annual Review of Organizational Psychology and Organizational Behavior, 2(1), 75-99.
   連結：
10. Cram, W. A., Proudfoot, J. G., & D’Arcy, J. (2017). Organizational information security policies: A review and research framework. European Journal of Information Systems, 26(6), 605-641.
    連結：
11. Cropanzano, R., & Mitchell, M. S. (2005). Social exchange theory: An interdisciplinary review. Journal of Management, 31(6), 874-900.
    連結：
12. Cropanzano, R., Anthony, E. L., Daniels, S. R., & Hall, A. V. (2017). Social exchange theory: A critical review with theoretical remedies. Academy of Management Annuals, 11(1), 479-516.
    連結：
13. Cropanzano, R., Byrne, Z. S., Bobocel, D. R., & Rupp, D. E. (2001). Moral virtues, fairness heuristics, social entities, and other denizens of organizational justice. Journal of Vocational Behavior, 58(2), 164-209.
    連結：
14. D’Arcy, J., & Greene, G. (2014). Security culture and the employment relationship as drivers of employees’ security compliance. Information Management and Computer Security, 22(5), 474-489.
    連結：
15. D’Arcy, J., & Herath, T. (2011). A review and analysis of deterrence theory in the IS security literature: Making sense of the disparate findings. European Journal of Information Systems, 20(6), 643-658.
    連結：
16. D’Arcy, J., & Lowry, P. B. (2019). Cognitive-affective drivers of employees’ daily compliance with information security policies: A multilevel, longitudinal study. Information Systems Journal, 29(1), 43-69.
    連結：
17. D’Arcy, J., Herath, T., & Shoss, M. K. (2014). Understanding employee responses to stressful information security requirements: A coping perspective. Journal of Management Information Systems, 31(2), 285-318.
    連結：
18. D’Arcy, J., Hovav, A., & Galletta, D. (2009). User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach. Information Systems Research, 20(1), 79-98.
    連結：
19. Dansereau, F., Graen, G., & Haga, W. (1975). A vertical dyad linkage approach to leadership within formal organizations: A longitudinal investigation of the role making process. Organizational Behavior and Human Performance, 13(1), 46-78.
    連結：
20. Dirks, K. T., & Ferrin, D. L. (2001). The role of trust in organizational settings. Organization Science, 12(4), 450-467.
    連結：
21. Doherty, N. F., Anastasakis, L., & Fulford, H. (2011). Reinforcing the security of corporate information resources: A critical review of the role of the acceptable use policy. International Journal of Information Management, 31(3), 201-209.
    連結：
22. El Akremi, A., Vandenberghe, C., & Camerman, J. (2010). The role of justice and social exchange relationships in workplace deviance: Test of a mediated model. Human Relations, 63(11), 1687-1717.
    連結：
23. Emerson, R. M. (1976). Social exchange theory. Annual Review of Sociology, 2(1), 335-362.
    連結：
24. Fassina, N., Jones, D. A., & Uggerslev, K. (2008). Meta-analytic tests of relationships between organizational justice and citizenship behavior: Testing agent-system and shared variance models. Journal of Organizational Behavior, 29(6), 805-828.
    連結：
25. Foa, E. B., & Foa, U. G. (1980). Resource theory: Interpersonal behavior as exchange. In Gergen, K. J., Greenberg, M. S., & Willis, R. H. (Eds.), Social exchange: Advances in theory and research (77-94). New York: Plenum Press.
    連結：
26. Fornell, C., & Larcker, D. F. (1981). Evaluating structural equation models with unobservable variables and measurement error. Journal of Marketing Research, 18(1), 39-50.
    連結：
27. Frazier, M. L., Johnson, P. D., Gavin, M., Gooty, J., & Snow, D. B. (2010). Organizational justice, trustworthiness, and trust: A multifoci examination. Group & Organization Management, 35(1), 39-76.
    連結：
28. Goel, S., & Chengalur-Smith, I. N. (2010). Metrics for characterizing the form of security policies. Journal of Strategic Information Systems, 19(4), 281-295.
    連結：
29. Gouldner, A. W. (1960). The norm of reciprocity: A preliminary statement. American Sociological Review, 25(2), 161-178.
    連結：
30. Guo, K. H. (2013). Security-related behavior in using information systems in the workplace: A review and synthesis. Computers and Security, 32, 242-251.
    連結：
31. Henle, C. A., Kohut, G., & Booth, R. (2009). Designing electronic use policies to enhance employee perceptions of fairness and to reduce cyberloafing: An empirical test of justice theory. Computers in Human Behavior, 25(4), 902-910.
    連結：
32. Herath, T., & Rao, H. R. (2009a). Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness. Decision Support Systems, 47(2), 154-165.
    連結：
33. Herath, T., & Rao, H. R. (2009b). Protection motivation and deterrence: A framework for security policy compliance in organizations. European Journal of Information Systems, 18(2), 106-125.
    連結：
34. Holtom, B. C., & Darabi, T. (2018). Job embeddedness theory as a tool for improving employee retention. In Coetzee, M., Potgieter, I., & Ferreira, N. (Eds.), Psychology of retention (95-117). Switzerland: Springer.
    連結：
35. Holtom, B. C., Mitchell, T. R., Lee, T. W., & Eberly, M. B. (2008). Turnover and retention research: A glance at the past, a closer review of the present, and a venture into the future. Academy of Management Annual, 2(1), 231-274.
    連結：
36. Hsu, J. S.-C., Shih, S.-P., Hung, Y. W., & Lowry, P. B. (2015). The role of extra-role behaviors and social controls in information security policy effectiveness. Information Systems Research, 26(2), 282-300.
    連結：
37. Hubbell, A. P., & Chory-Assad, R. M. (2005). Motivating factors: Perceptions of justice and their relationship with managerial and organizational trust. Communication Studies, 56(1), 47-70.
    連結：
38. Jiang, Z., Gollan, P. J., & Brooks, G. (2017). Relationships between organizational justice, organizational trust and organizational commitment: A cross-cultural study of China, South Korea and Australia. The International Journal of Human Resource Management, 28(7), 973-1004.
    連結：
39. Johnston, A. C., Warkentin, M., & Siponen, M. (2015). An enhanced fear appeal rhetorical framework: Leveraging threats to the human asset through sanctioning rhetoric. MIS Quarterly, 39(1), 113-134.
    連結：
40. Jones, D. (2009). Getting even with one’s supervisor and one’s organization: Relationships among types of injustice, desires for revenge, and counterproductive work behaviors. Journal of Organizational Behavior, 30(4), 525-542.
    連結：
41. Katz, D. (1964). The motivation basis of organization behavior. Behavior Science, 9(2), 131-146.
    連結：
42. Khansa, L., Barkhi, R., Ray, S., & Davis, Z. (2018). Cyberloafing in the workplace: Mitigating tactics and their impact on individuals’ behavior. Information Technology Management, 19(4), 197-215.
    連結：
43. Kiel, J. M., Ciamacco, F. A., & Steines, B. T. (2016). Privacy and data security: HIPAA and HITECH. In Weaver, C. A., Ball, M. J., Kim, G. R., & Kiel, J. M. (Eds.), Health information management systems (437-449). Cham, Switzerland: Springer International.
    連結：
44. Konovsky, M. A., & Pugh, S. D. (1994). Citizenship behavior and social exchange. Academy of Management Journal, 37(3), 656-669.
    連結：
45. Koops, B. J. (2014). The trouble with European data protection law. International Data Privacy Law, 4(4), 250-261.
    連結：
46. Lavelle, J. J., Rupp, D. E., & Brockner, J. (2007). Taking a multifoci approach to the study of justice, social exchange, and citizenship behavior: The target similarity model. Journal of Management, 33(6), 841-866.
    連結：
47. Lebek, B., Uffen, J., Neumann, M., Hohler, B., & Breitner, M. H. (2014). Information security awareness and behavior: A theory-based literature review. Management Research Review, 37(12), 1049-1092.
    連結：
48. Lee, C., Lee, C. C., & Kim, S. (2016). Understanding information security stress: Focusing on the type of information security compliance activity. Computers and Security, 59, 60-70.
    連結：
49. Leventhal, G. S. (1976). The distribution of rewards and resources in groups and organizations. In Berkowitz, L., & Walster, W. (Eds.), Advances in experimental social psychology (91-131). New York: Academic Press.
    連結：
50. Leventhal, G. S. (1980). What should be done with equity theory? New approaches to the study of fairness in social relationships. In Gergen, K., Greenberg, M., & Willis, R. (Eds.), Social exchange: Advances in theory and research (27-55). New York: Plenum.
    連結：
51. Lewis, J. D., & Weigert, A. (1985). Trust as social reality. Social Forces, 63(4), 967-985.
    連結：
52. Li, H., Sarathy, R., Zhang, L., & Luo, X. (2014). Exploring the effects of organizational justice, personal ethics and sanction on Internet use policy compliance. Information Systems Journal, 24(6), 479-502.
    連結：
53. Lim, V. K. (2002). The IT way of loafing on the job: Cyberloafing, neutralizing and organizational justice. Journal of Organizational Behavior, 23(5), 675-694.
    連結：
54. Lowry, P. B., & Moody, G. D. (2015). Proposing the control-reactance compliance model (CRCM) to explain opposing motivations to comply with organizational information security policies. Information Systems Journal, 25(5), 433-463.
    連結：
55. Lowry, P. B., Posey, C., Bennett, R. B. J., & Roberts, T. L. (2015). Leveraging fairness and reactance theories to deter reactive computer abuse following enhanced organisational information security policies: An empirical study of the influence of counterfactual reasoning and organisational trust. Information Systems Journal, 25(3), 193-273.
    連結：
56. Lowry, P. B., Posey, C., Roberts, T. L., & Bennett, R. J. (2014). Is your banker leaking your personal information? The roles of ethics and individual-level cultural characteristics in predicting organizational computer abuse. Journal of Business Ethics, 121(3), 385-401.
    連結：
57. Luo, J. D. (2005). Particularistic trust and general trust: A network analysis in Chinese organizations. Management and Organization Review, 1(3), 437-458.
    連結：
58. Mallol, C., Holtom, B. C., & Lee, T. W. (2007). Job embeddedness in a culturally diverse environment. Journal of Business & Psychology, 22(1), 35-44.
    連結：
59. Martinko, M. J., Gundlach, M. J., & Douglas, S. C. (2002). Toward an integrative theory of counterproductive workplace behavior: A causal reasoning perspective. International Journal of Selection and Assessment, 10(1/2), 36-50.
    連結：
60. Masterson, S. S., Lewis, K., Goldman, B. M., & Taylor, M. S. (2000). Integrating justice and social exchange: The differing effects of fair procedures and treatment on work relationships. Academy of Management Journal, 43(4), 738-748.
    連結：
61. Mattila, A., & Enz, C. (2002). The role of emotions in service encounters. Journal of Service Research, 4(4), 268-277.
    連結：
62. Mayer, R. C., Davis, J. H., & Schoorman, F. D. (1995). An integration model of organizational trust. Academy of Management Review, 20(3), 709-734.
    連結：
63. McAllister, D. J. (1995). Affect- and cognition-based trust as foundations for interpersonal cooperation in organizations. Academy of Management Journal, 38(1), 24-59.
    連結：
64. McEvily, B., Perrone, V., & Zaheer, A. (2003). Trust as an organizing principle. Organization Science, 14(1), 91-103.
    連結：
65. Mitchell, T. R., Holtom, B. C., Lee, T. W., Sablynski, C. J., & Erez, M. (2001). Why people stay: Using organizational embeddedness to predict voluntary turnover. Academy of Management Journal, 44(6), 1102-1121.
    連結：
66. Moorman, R. H. (1991). Relationship between organizational justice and organizational citizenship behaviors: Do fairness perceptions influence employee citizenship? Journal of Applied Psychology, 76(6), 845-855.
    連結：
67. Ng, T. W. H., & Feldman, D. C. (2013). Changes in perceived supervisor embeddedness: Effects on employees’ embeddedness, organizational trust, and voice behavior. Personnel Psychology, 66(3), 645-685.
    連結：
68. Niemimaa, E., & Niemimaa, M. (2017). Information systems security policy implementation in practice: From best practices to situated practices. European Journal of Information Systems, 26(1), 1-20.
    連結：
69. Nyhan, R. C. (1999). Increasing affective organizational commitment in public organizations. Review of Public Personnel Administration, 19(3), 58-70.
    連結：
70. Pfeffer, J., & Langton, N. (1993). The effects of wage dispersion on satisfaction, productivity, and working collaboratively: Evidence from college and university faculty. Administrative Science Quarterly, 38(3), 382-407.
    連結：
71. Podsakoff, P. M., MacKenzie, S. B., Lee, J. Y., & Podsakoff, N. P. (2003). Common method biases in behavioral research: A critical review of the literature and recommended remedies. Journal of Applied Psychology, 88(5), 879-903.
    連結：
72. Podsakoff, P. M., MacKenzie, S. B., Moorman, R. H., & Fetter, R. (1990). Transformational leader behaviors and their effects on followers’ trust in leader, satisfaction, and organizational citizenship behaviors. Leadership Quarterly, 1(2), 107-142.
    連結：
73. Posey, C., Bennett, R. J., & Roberts, T. L. (2011a). Understanding the mindset of the abusive insider: An examination of insiders’ causal reasoning following internal security changes. Computers & Security, 30(6/7), 486-497.
    連結：
74. Proudfoot, D., & Lind, E. A. (2015). Fairness heuristic theory, the uncertainty management model, and fairness at work. In Cropanzano, R., & Ambrose, M. L. (Eds.), The Oxford handbook of justice in the workplace (371-385). New York: Oxford University Press.
    連結：
75. Rigdon, E. E. (2012). Rethinking partial least squares path modeling: In praise of simple methods. Long Range Planning, 45(5/6), 341-358
    連結：
76. Riggle, R. J., Edmonson, D. R., & Hansen, J. D. (2009). A meta-analysis of the relationship between perceived organizational support and job outcomes: 20 years of research. Journal of Business Research, 62(10), 1027-1030.
    連結：
77. Robinson, S. L., & Morrison, E. W. (1995). Psychological contracts and OCB: The effect of unfulfilled obligations on civil virtue behavior. Journal of Organizational Behavior, 16(3), 289-298.
    連結：
78. Rupp, D. E., & Cropanzano, R. (2002). The mediating effects of social exchange relationships on predicting workplace outcomes from multifoci organizational justice. Organizational Behavior and Human Decision Processes, 89(1), 925-946.
    連結：
79. Rusbult, C. E., Farrell, D., Rogers, G., & Mainus, A. G. (1988). Impact of exchange variables on exit, voice, loyalty, and neglect: An integrative model of responses to declining job satisfaction. Academy of Management Journal, 31(3), 599-627.
    連結：
80. Schoorman, F. D., Mayer, R. C., & Davis, J. H. (2007). An integrative model of organizational trust: Past, present, and future. Academy of Management Review, 32(2), 344-354.
    連結：
81. Settoon, R. P., Bennett, N., & Liden, R. C. (1996). Social exchange in organizations: Perceived organizational support, leader-member exchange, and employee reciprocity. Journal of Applied Psychology, 81(3), 219-227.
    連結：
82. Sindhav, B., Holland, J., Rodie, A. R., Adidam, P. T., & Pol, L. G. (2006). The impact of perceived fairness on satisfaction: Are airport security measures fair? Does it matter? Journal of Marketing Theory and Practice, 14(4), 323-335.
    連結：
83. Singh, U., & Srivastava, K. B. L. (2016). Organizational trust and organizational citizenship behavior. Global Business Review, 17(3), 594-609.
    連結：
84. Siponen, M., & Iivari, J. (2006). Six design theories for IS security policies and guidelines. Journal of the Association for Information Systems, 7(7), 445-472.
    連結：
85. Siponen, M., Mahmood, M. A., & Pahnila, S. (2014). Employees’ adherence to information security policies: An exploratory field study. Information & Management, 51(2), 217-224.
    連結：
86. Smith, C. A., Organ, D. W., & Near, J. P. (1983). Organizational citizenship behavior: Its nature and antecedents. Journal of Applied Psychology, 68(4), 653-663.
    連結：
87. Sobel, M. E. (1982). Asymptotic confidence intervals for indirect effects in structural equation models. In Leinhart, S. (Ed.), Sociological methodology (290-312). San Francisco: Jossey-Bass.
    連結：
88. Son, J. Y. (2011). Out of fear or desire? Toward a better understanding of employees’ motivation to follow IS security policies. Information & Management, 48(7), 296-302.
    連結：
89. Soomro, Z. A., Shah, M. H., & Ahmed, J. (2016). Information security management needs more holistic approach: A literature review. International Journal of Information Management, 36(2), 215-225.
    連結：
90. Straub, D. W. (1990). Effective IS security: An empirical study. Information & Management, 1(3), 255-276.
    連結：
91. Sweeney, P. D., & McFarlin, D. B. (1993). Workers’ evaluations of the “ends” and the “means”: An examination of four models of distributive and procedural justice. Organizational Behavior and Human Decision Processes, 55(1), 23-40.
    連結：
92. Teh, P. L., Ahmed, P. K., & D’Arcy, J. (2015). What drives information security policy violations among banking employees? Insights from neutralization and social exchange theory. Journal of Global Information Management, 23(1), 44-64.
    連結：
93. Tyler, T. R., & Lind, E. A. (1992). A relational model of authority in groups. In Zanna, M. (Ed.), Advances in experimental social psychology (115-192). New York: Academic Press.
    連結：
94. Warkentin, M., & Willison, R. (2009). Behavioral and policy issues in information systems security: The insider threat. European Journal of Information Systems, 18(2), 101-105.
    連結：
95. Williams, L. J., & Anderson, S. E. (1991). Job satisfaction and organizational commitment as predictors of organizational citizenship and in-role behaviors. Journal of Management, 17(3), 601-617.
    連結：
96. Willison, R., & Warkentin, M. (2013). Beyond deterrence: An expanded view of employee computer abuse. MIS Quarterly, 37(1), 1-20.
    連結：
97. Willison, R., Warkentin, M., & Johnston, A. C. (2018). Examining employee computer abuse intentions: Insights from justice, deterrence and neutralization perspectives. Information Systems Journal, 28(2), 266-293.
    連結：
98. Wong, Y.-T., Ngo, H.-Y., & Wong, C.-S. (2003). Antecedents and outcomes of employees’ trust in Chinese joint ventures. Asia Pacific Journal of Management, 20(4), 481-499.
    連結：
99. Yang, J., & Mossholder, K. W. (2010). Examining the effects of trust in leaders: A bases-and-foci approach. The Leadership Quarterly, 21(1), 50-63.
    連結：
100. Yoon, M. H., & Suh, J. (2003). Organizational citizenship behaviors and service quality as external effectiveness of contact employees. Journal of Business Research, 56(8), 597-611.
     連結：
101. Zafar, H., & Clark, J. G. (2009). Current state of information security research in IS. Communications of the Association for Information Systems, 24(1), 34.
     連結：
102. Zhao, X., Lynch, J. G., & Chen, Q. (2010). Reconsidering Baron and Kenny: Myths and truths about mediation analysis. Journal of Consumer Research, 37(2), 197-206.
     連結：
103. Cropanzano, R., & Byrne, Z. S. (2000). Workplace justice and the dilemma of organizational citizenship. In VanVugt, M., Tyler, T., & Biel, A. (Eds.), Collective problems in modern society: Dilemmas and solutions (142-161). London: Routledge.
104. Cropanzano, R., & Rupp, D. E. (2008). Social exchange theory and organizational justice: Job performance, citizenship behaviors, multiple foci, and a historical integration of two literatures. In Gilliland, S. W., Skarlicki, D. P., & Steiner, D. D. (Eds.), Research in social issues in management: Justice, morality, and social responsibility (63-99). Greenwich, CT: Information Age Publishing.
105. Greenberg, J. (1993). The social side of fairness: Interpersonal and informational classes of organizational justice. In Cropanzano, R. (Ed.), Justice in the workplace: Approaching fairness in human resource management (79-103). Hillsdale, NJ: Erlbaum.
106. Hair, J. F., Hult, G. T. M., Ringle, C. M., & Sarstedt, M. (2017). A primer on partial least squares structural equation modeling (PLS-SEM). Thousand Oaks, CA: Sage.
107. Holtom, B. C., & Inderrieden, E. (2006). Integrating the unfolding model and job embeddedness to better understand voluntary turnover. Journal of Managerial Issues, 18(4), 435-452.
108. ISO/IEC (2013a). Information technology‒Security techniques‒Information security management systems‒Requirements (ISO/IEC 27001). Geneva, Switzerland: ISO.
109. ISO/IEC (2013b). Information technology‒Security techniques‒Code of practice for information security controls (ISO/IEC 27002). Geneva, Switzerland: ISO.
110. Katz, D., & Kahn, R. L. (1978). The social psychology of organizations. New York: Wiley.
111. Kinnunen, H., & Siponen, M. (2018). Developing organization-specific information security policies by using critical thinking. Proceedings of the 22nd Pacific Asia Conference on Information Systems, Yokohama, Japan.
112. Lind, E. A., & Tyler, T. R. (1988). The social psychology of procedural justice. New York: Plenum.
113. Niemimaa, E. (2016). Crafting an information security policy: Insights from an ethnographic study. Proceedings of the 37th International Conference on Information Systems, Dublin, Ireland.
114. Nunnally, J. C. (1978). Psychometric theory. New York: McGraw-Hill.
115. Organ, D. W. (1988). Organizational citizenship behavior: The good soldier syndrome. Lexington, MA: Lexington Books.
116. Organ, D. W. (1990). The motivational basis of organizational citizenship behavior. In Cumming, L. L., & Staw, B. M. (Eds.), Research in organizational behavior (43-72). Greenwich, CT: JAI Press.
117. Posey, C., Bennett, R. J., Roberts, T., & Lowry, P. B. (2011b). When computer monitoring backfires: Invasion of privacy and organizational injustice as precursors to computer abuse. Journal of Information Systems Security, 7(1), 24-47.
118. Rousseau, D. M., & Parks, J. M. (1993). The contracts of individuals and organizations. In Staw, B. M., & Cummings, L. L. (Eds.), Research in organizational behavior (1-43). Greenwich, CT: JAI Press.
119. Tan, H. H., & Tan, C. S. F. (2000). Toward the differentiation of trust in supervisor and trust in organization. Genetic, Social, and General Psychology Monographs, 126(2), 241-260.
120. Thibaut, J., & Walker, L. (1975). Procedural justice: A psychological analysis. Hillsdale, NJ: Lawrence Ealbaum Associates.
121. Thiele, K. O., Sarstedt, M., & Ringle, C. M. (2015). A comparative evaluation of new and established methods for structural equation modeling. Proceedings of the Academy of Marketing Science Annual Conference (AMSC 2015), Denver, Colorado, USA.
122. Van den Bos, K. (2001). Fairness heuristic theory: Assessing the information to which people are reacting has a pivotal role in understanding organizational justice. In Gilliland, S., Steiner, D., & Skarlicki, D. (Eds.), Theoretical and cultural perspectives on organizational justice (63-84). Greenwich, CT: Information Age.
123. Wu, S. (2016). Review of the methods for the development of information security policies at organizations. Unpublished master’s thesis, University of Jyväskylä, Finland.