Finally, given some of the prior findings related to the mediation role of attitude and the prescriptions made in the
literature about the non-inclusion of attitude in adoption models (e.g., in the widely applied TAM), we thought it important to investigate the role of attitude in the information security policy compliance context. We conclude that attitude plays a key role in explaining the relationships between assessment beliefs and intention as well as between information security awareness and intention; hence, we recommend that it be included in the theoretical model of information security policy compliance as a mediator.