Second, while the extant literature has discussed the roles of rewards and sanctions, which drive the benefits of compliance and the costs of noncompliance in our model, this study is the first to investigate empirically the role of the cost of compliance in the context of an employee’s compliance with the information security policy. We show that the impact of the cost of compliance is as strong as the impacts of the benefit of compliance and the cost of noncompliance, thereby highlighting the importance of this construct in the context of information security.