Kisekka Victoria, Goel Sanjay
Information Security and Digital Forensics, School of Business, Massry Center for Business (BB) 371, University at Albany, State University of New York, 1400 Washington Ave., Albany, NY 12222 USA.
Information Security and Digital Forensics, School of Business, Massry Center for Business (BB) 311, University at Albany, State University of New York, 1400 Washington Ave., Albany, NY 12222 USA.
Inf Syst Front. 2022 Jun 1:1-20. doi: 10.1007/s10796-022-10281-6.
Diligent compliance with Information security Policies (ISP) can effectively deter threats but can also adversely impact organizational productivity, impeding organizational task completion during extreme events. This paper examines employees' job performance during extreme events. We use the conservation of resources (COR) theory to examine how psychological resources (individual resilience, job meaningfulness, self-efficacy) and organizational resources (incident command leadership, information availability, and perceived effectiveness of security and privacy controls) influence ISP compliance decisions and job performance during extreme events. The results show that a one-size-fits-all approach to ISP is not ideal during extreme events; ISP can distract employees from critical job tasks. We also observed that under certain conditions, psychological resources, such as individual resilience, are reserved for job performance, while others, such as self-efficacy, are reserved for ISP compliance. A post hoc analysis of data from respondents who experienced strain during a real extreme event while at work was conducted. Our discussion provides recommendations on how security and privacy policies can be designed to reflect disaster conditions by relaxing some policy provisions.
严格遵守信息安全政策（ISP）可以有效威慑威胁，但也可能对组织生产力产生不利影响，在极端事件期间阻碍组织任务的完成。本文研究了极端事件期间员工的工作绩效。我们运用资源守恒（COR）理论来考察心理资源（个人复原力、工作意义、自我效能感）和组织资源（ incident command leadership、信息可用性以及安全和隐私控制的感知有效性）如何影响极端事件期间的ISP合规决策和工作绩效。结果表明，在极端事件期间，一刀切的ISP方法并不理想；ISP可能会使员工从关键工作任务中分心。我们还观察到，在某些情况下，心理资源，如个人复原力，被保留用于工作绩效，而其他资源，如自我效能感，则被保留用于ISP合规。对在实际极端事件期间工作时经历压力的受访者的数据进行了事后分析。我们的讨论就如何通过放宽一些政策条款来设计安全和隐私政策以反映灾难情况提供了建议。
