A grave concern to an organization’s information security is employees’ behavior when they do not value information security policy compliance (ISPC). Most ISPC studies evaluate compliance and noncompliance behaviors separately. However, the literature lacks a comprehensive understanding of the factors that transform the employees’ behavior from noncompliance to compliance. Therefore, we conducted a systematic literature review (SLR), highlighting the studies done concerning information security behavior (ISB) towards ISPC in multiple settings: research frameworks, research designs, and research methodologies over the last decade. We found that ISPC research focused more on compliance behaviors than noncompliance behaviors. Value conflicts, security-related stress, and neutralization, among many other factors, provided significant evidence towards noncompliance. At the same time, internal/external and protection motivations proved positively significant towards compliance behaviors. Employees perceive internal and external motivations from their social circle, management behaviors, and organizational culture to adopt security-aware behaviors. Deterrence techniques, management behaviors, culture, and information security awareness play a vital role in transforming employees’ noncompliance into compliance behaviors. This SLR’s motivation is to synthesize the literature on ISPC and ISB, identifying the behavioral transformation process from noncompliance to compliance. This SLR contributes to information system security literature by providing a behavior transformation process model based on the existing ISPC literature.

The advancement of information communication technology in healthcare institutions has increased information security breaches. Scholars and industry practitioners have reported that most security breaches are due to negligence towards organizational information security policy compliance (ISPC) by healthcare employees such as nurses. There is, however, a lack of understanding of the factors that ensure ISPC among nurses, especially in developing countries such as Malaysia. This paper develops and examines a research framework that draws upon the factors of organizational climate of information security (OCIS) and social bond theory to enhance ISPC among nurses. A questionnaire was adopted in which responses were obtained from 241 nurses employed in 30 hospitals in Malaysia. The findings from the study demonstrated that the ISPC among nurses is enhanced through OCIS factors. The influence on ISPC was even more significant when examined by the mediating effect of the social bond. It implies that influential OCIS factors reinforce social bonds among nurses and eventually increase the ISPC. For information security practitioners, the study findings emphasize the prevalence of socio-active information security culture in healthcare organizations to enhance ISP compliance among nurses.

Limited research explores the private sector's role in achieving Sustainable Development Goals (SDGs), particularly regarding factors influencing disclosure practices in emerging economies. This study addresses this gap by investigating the voluntary disclosure of SDGs and the impact of the sustainability committee (SC) on such disclosure in Malaysia. Panel data from large publicly listed Malaysian companies spanning from 2016 to 2020 is employed. Manual content analysis extracts the SDGs‐related information from the annual reports. Data were analyzed using univariate and multivariate analytical models to examine the effect of the sustainability committee's existence on the SDGs disclosure. Findings reveal an increasing trend in Malaysian companies' commitment to SDGs, with a stronger emphasis on social goals compared to environmental ones. The results of the T‐test, fixed effects, and two‐stage least squares regressions demonstrate significantly higher and more detailed SDG disclosure in companies with SCs compared to those without SCs. These findings suggest that SCs facilitate the integration of SDGs into corporate strategies and business models. Sensitivity analyses have not altered our findings. This research provides useful insights for policymakers and practitioners regarding corporate SDGs disclosure practices and the role of sustainability committees in enhancing such practices.

Information and communication technologies (ICTs) are the cornerstone for sustainable development, but if they are not appropriately managed, they will impede progress towards the United Nations Global Sustainable Development Goals. Among undesirable impacts, emphasis must be put on the risk of information security (ISec) breaches, as they pose a potential threat to businesses there. Especially for publicly traded firms, they could create a long-lasting influence on their financial performance and, thus, stock investors’ confidence. Following the efficient market hypothesis’s footsteps, previous studies have examined only the short-run impact on investors’ confidence ensuing to ISec breach announcements. Therefore, this study investigates the long-run impact of ISec breach announcements on investors’ confidence. Based on a sample of 73 ISec breach announcements during 2011–2019, this paper examines the impact on investors’ confidence, as demonstrated by long-run abnormal returns and equity risk of those firms. Using a one-to-one matched sampling approach, each firm’s performance is analyzed with its control firm over eighteen months, starting six months before the announcement, through twelve months after the announcement. Firms experienced a significant negative abnormal return of 15% to 18% during the twelve months following the breach announcement. In comparison, equity risk increased by 11% within six months before and after an announcement. This study can help investors, managers, and researchers better understand a long-term relationship between ISec breaches and investor confidence in the context of efficient market hypothesis.

A breach in information security (infosec) can materially impact a firm’s long-term competitiveness. For publicly listed firms, an infosec breach can have a long-lasting effect on their competitive stock performance, including their equity risk. Despite its significance, past research has focused primarily on examining the short-term effect of infosec breaches while ignoring its long-term effect on the firm’s equity risk. Therefore, in this research, we examined the long-run effect of 276 infosec breaches at publicly traded firms on equity risk from 2009 to 2018. We analyzed each firm’s equity risk compared to its competitive control firms of similar sizes and performances for three years, from one year before to two years after the breach, using a one-to-one matching methodology. The univariate analysis of infosec breaches on equity risk indicated that breach firms have a 7% higher equity risk than competitive control firms. Additionally, the quantile regression analysis of the effect of infosec breach factors on long-run equity risk showed that the rise in equity risk is higher if the breach involves the compromise of confidential information and is a repeat breach for the same firm. The findings provide a valuable resource for investors, managers, and researchers interested in understanding the long-term relationship between infosec breaches and a firm’s stock competitiveness.