<![CDATA[In the digital era, organizations are increasingly vulnerable to insider threats and non-compliance with information security policies. This study presents a systematic literature review aimed at conceptually distinguishing between absolute and restrictive deterrence within the context of employee compliance with organizational information security policies. The review draws upon academic databases such as MIS, Springer, JSTOR, ScienceDirect, AISeL, and EBSCO using keywords including deterrence theory, compliance, and information security behavior. The findings reveal that while absolute deterrence focuses on formal, law-enforced sanctions to prevent insider criminal acts, restrictive deterrence seeks to reduce the frequency of policy violations by imposing informal or less severe formal controls. This review highlights inconsistencies in how deterrence constructs are operationalized across studies—some blending severity, certainty, and swiftness into a single variable, others substituting deterrence indicators with proxies like awareness and education. Despite these differences, the review underscores that research on deterrence in information security remains in its developmental stage. It suggests a need for further empirical studies that compare the impact of deterrence mechanisms with positive motivational strategies to encourage compliance. Additionally, this review calls for future research to address different types of criminal decision-making processes and contextual organizational factors that influence behavior. These insights are valuable for designing more effective information security governance frameworks tailored to human behavior in the workplace.]]>
Copyrights © 2025
