The Role of Employees’ Threat Appraisal in Security Certification Compliance: Insights from a Protection Motivation Approach

Abstract

The rising number of cybersecurity threats poses significant risks to organizations. Security and data protection certifications, such as ISO/IEC 27001, offer a promising approach to improving cybersecurity defenses and gaining market legitimacy. However, the effectiveness of these certifications depends on their substantive internalization within organizations. This study explores the factors driving employees’ certification internalization using Protection Motivation Theory. We conducted an online experiment with 437 participants, manipulating their perception of threats resulting from certification noncompliance. Our findings show that perceived security threats, compliance costs, and fear shape employees' certification compliance intention, while compliance efficacy does not. The perceived threat of customer loss reduced certification compliance intention. Our study contributes to certification research by taking an employee perspective and explaining how employees’ threat and coping appraisals impact their internalization intention.