Against this backdrop, we offer a new avenue for understanding employees’ ISP
violations—namely, workplace stress due to security requirements and its coping
response. The topic of stress has a long history in the organizational and psychology
literatures and empirical results have shown that negative work stressors1 predict a
variety of undesirable employee behaviors (e.g., [25, 57]). Within the IS literature,
research indicates that employee stress–related to the use information technology
(IT) (i.e., technostress) influences a number of IT and non-IT-related cognitions
and behaviors [56, 67]. In the present study, we extend the technostress concept to
the domain of IS security and explain three conditions—overload, complexity, and
uncertainty—in which security requirements can create stress in employees. We
theorize that this form of employee stress, termed security-related stress (SRS), is a
contributor to ISP violations.