Using coping theory as a foundation [38], we develop and empirically test a model of ISP violation intention which predicts that employees engage in emotion-focused coping in response to SRS. We explicate this emotion-focused coping in the form of Employee Responses to Stressful Information Security Requirements 287 cognitive rationalization processes drawn from moral disengagement theory [6]. In this manner of coping, employees respond to SRS by disengaging their internal self sanctions related to ISP violations, which in turn increases their ISP violation intention.
Consistent with the deterrence literature, we also posit that perceived sanctions
Influence both moral disengagement and ISP violation intention. We empirically test our model using data collected through a survey of 539 employee users from a diverse set of organizations. The results support our multidimensional view of SRS2—which consists of security-related overload, complexity, and uncertainty—as a set of workplace environment factors that foster noncompliant user behavior, while extending prior work on employee rationalizations of ISP violations and the role of sanctions in security compliance decisions.