The Impact of Challenge Information Security Stress on Information Security Policy Compliance: The Mediating Roles of Emotions

Introduction

Organizations increasingly use information technology, which has become the key resource for an organization. An organization needs to ensure that information is not disclosed or inadvertently modified.^1,2 In addition to technical means, the most basic way to protect the information resources of an organization is to formulate an ISP to regulate the information security behaviors of employees. In the past 30 years, most information system researchers have focused on ISP violations.^3–5 Recently, an increasing number of researches have explored the influence mechanism of ISP compliance,^6–8 and with the continuous improvement of enterprise information security, the growing attention given to information security has brought stress to employees. In particular, when the security requirements of ISP exceed employees’ working ability, it will cause employees to feel information security stress.^9,10 According to challenge-hindrance stressor theory,^11,12 the positive components of information security stress are shown as challenge information security stress, which refers to the stress caused by work requirements that can bring individual growth opportunities or benefits to employees in the information security workflow. However, not much work has been done to explore the relationship between employees’ challenge information security stress and their ISP compliance. Thus, this study aims to explore how challenge information security stress influence ISP compliance.

Collectively, most prior studies are based on deterrence theory, protection motivation theory, rational choice theory, and theory of planned behavior to explore the influencing factors that lead to information security compliance and violation. However, limited research is available on its moderation effect and mediation effect.¹³ It would limit our understanding of the influence mechanism of employee compliance with ISP compliance. In addition, while past research has discussed employee compliance with ISP from the perspective of rationality, limited research has examined if and how emotion-related factors are associated with ISP compliance.¹⁴ This scarcity may be because of the complexity of the state of emotion itself. Studies have shown that emotions can be divided into two relatively independent basic dimensions: positive and negative emotions.^15,16 In this study, we explore the direct effect of positive and negative emotions on ISP compliance, and further study the multiple mediating effects of positive and negative emotions in the relationship between challenge information security stress and ISP compliance.

The goal of our research is to address the two theoretical gaps. First, the current study operates positive and negative emotions as employees’ information security-related variables in the research model drawing from prior studies.^15,16 We then examine the direct impact of positive and negative emotions on ISP compliance. In so doing, we can test and compare their respective effects on ISP compliance, thereby extending our understanding of ISP compliance related factors. Second, we explore the multiple mediating roles of positive and negative emotions on the relationship between challenge information security stress and ISP compliance by building a comprehensive research model. Based on the above literature insights on ISP compliance, emotion, and challenge-hindrance stressor theory, this study proposes the following questions: (1) Does positive and negative emotions have a direct effect on ISP compliance? (2) What is the role of positive and negative emotions in the relationship between challenge information security stress and ISP compliance?

This study contributes to the information security literature in the following three respects. First, we test the direct effect of positive and negative emotions on ISP compliance. The inclusion of such irrational factors into the ISP compliance research framework expands the application boundary of the theory deterrence theory and protection motivation theory. Second, we identify and investigate the mediating roles of positive and negative emotions in the relationship between challenge information security stress and ISP compliance. Given the positive effects of challenge stress found in many previous studies, this study has expanded from previous literature by focusing only on the challenge stress to test the different effect mechanism on ISP compliance in the context of information security management. Third, this study contributes to the HRM literature. Organizational performance can be improved focusing on employees’ information security pressure and emotion, because HRM has direct significant effects on organizational performance.^17,18

Theoretical Background and Hypothesis Development

Challenge-Hindrance Stressor Theory

Stress is an adaptive response of individuals to physical or psychological stressors. Selye divided stress into eustress and distress.¹⁹ The two-dimensional model was later proposed by Cavanaugh et al.¹² Stressors are distinguished into challenge and hindrance stress according to the source of stress.¹² Challenge stress is defined as job requirements that provide opportunities for personal growth or rewarding work experience, such as complexity and time constraints. Hindrance stress is defined as work requirements that hinder individual growth and goal achievement, such as role conflict and bureaucratic processes.

Challenge-hindrance stressor has become a significant theory in the field of organizational management and HRM.²⁰ Three well-known meta-analyses have provided support for the categorization of job stressors by Cavanaugh et al, but found that relationships between both stressors and work-related outcomes have opposite research results.^21–23 Earlier studies found that challenge stressors were positively related to performance. However, the findings of recent studies of the challenge–hindrance model have not supported the positive effects of challenge stressors, some studies have reported that challenge stressors were positively related to emotional exhaustion and negative health behaviors.^24,25 However, to the best of our knowledge, not many studies on the behavioral information security management domain have explored the relationship between challenge stressors and employees’ behaviors. At the same time, few studies have focused on the different effects of challenging stressors. Therefore, this study explores the direct effect of challenge stressors on employees’ ISP compliance and the multiple mediating roles of positive and negative emotions on the relationship between challenge information security stress and ISP compliance. Thus, the different effects of challenge stress should be tested.

Challenge stress is generally considered a type of positive pressure, because once individuals overcome challenge stress, they will achieve growth and gain benefits. In contrast, hindrance stress is a type of negative stress, because this type of stress hinders an individual from achieving work goals, and even if the stress is relieved, the individual will not gain any benefit. The distinction between these two types of stressors has been gradually recognized by researchers that focus on the workplace, and a large number of empirical studies have been conducted to verify their different influences on performance, job satisfaction, creativity, and turnover.²² In recent years, although research on information security stress has received extensive attention,¹⁰ few studies have clearly distinguished the different impact mechanisms of these two types of stressors.

Affective Events Theory

Affective events theory (AET) explains the relationship between employees and their emotional reaction to events that occur at work.²⁶ An affective event refers to “an incident that stimulates appraisal of and emotional reaction to a transitory or ongoing job-related agent, object, or occurrence”.²⁷ The theory takes stress as an emotional event that can arouse specific emotions and emotional reactions from individuals, and trigger different behavioral reactions among individuals.¹⁶ According to this theory, the same work event, individual cognitive differences or other factors will arouse positive and negative emotions and ultimately affect work performance.

AET is not only used to explain work-related emotions, but also has expanded to many areas of research in recent years, such as affect mediating the relationship between micro-daily events and well-being,²⁸ job satisfaction and job insecurity mediating the relationship between incivility and intrapreneurial behavior.²⁹ Hence, AET has become a significant theory in the field of organizational behavior and HRM, the motivation of researchers increased to test how employees’ behavior is affected by various events and emotions. Based on AET, in the context of information security management, information security stress, as an event, will affect employees’ emotions and information security behavior.

AET provides a framework for exploring work events and their emotional responses. Recently, AET has been applied to information security studies.^30,31 Accordingly, when an employee is in a situation in which they need to decide whether to comply with a security policy to complete work tasks, different characteristics of the organizational setting may result in experiencing positive and negative emotions, which may lead to changes in their behavior.³² AET posits that features of the work environment may affect work events which, in turn, may influence affective responses. In the context of our study, we consider challenge information security stress to be an aspect of the work environment. This study considers positive and negative emotions as possible affective responses that a security policy compliance employee may experience.

Hypothesis Development

Challenge Information Security Stress and ISP Compliance

Challenge information security stress comes from the study of stress. Stress is an enduring theme in the workplace, and information security stress refers to the individual cognitive and psychological experience arising from employees’ direct or indirect contact, learning, and use of information technology and information system to ensure that operational behaviors meet compliance and work requirements.³³ Information security stress can be divided into challenge information security stress and hindrance information security stress based on the two-dimensional model of challenge-hindrance stressor theory. This study defines challenge information security stress as the stress that brings growth opportunities or rewarding work demand for individuals in the information security work process. The job requirement includes improving set-up rules for the regulation elements of the information security system, strengthening the injunctive norm in norm elements, and strengthening the construction of information security culture in cultural elements.

ISP compliance refers to the compliance of employees with information security policies, procedures, or guidelines. The specific name of the policy and the number of normative documents may vary from organization to organization.⁴ Enterprise ISP is a type of system design. A perfect ISP should not only meet external compliance but also have the function of regulating and restricting the behavior of employees.³⁴ Recent research on information security behavior attempt to identify the factors that can encourage employees to comply with information security policies.^35,36 Effective research on these factors can help organizations manage employees to encourage them to comply with information security policies. Information security research has focused more on compliance than noncompliance behaviors and security-related stress provided significant evidence of noncompliance.³⁷ ISP compliance has been enhanced through the factors of organizational climate.³⁸ However, not many studies have distinguished the types of stressors and its effect on ISP compliance.

Many studies analyze the influence of certainty, severity, timeliness, fairness, and appropriateness of organizational punishment on employees’ ISP compliance by referring to deterrence theory in criminology research.^2,39 Furthermore, based on the theory of social norms, theory of planned behavior, and theory of normative activation, some studies have explored the influence of different normative forms, such as prescriptive, exemplary, subjective, and self-norms, and face orientation on employees’ compliance with information security policies.⁴⁰ The penalty regulations and all kinds of norms discussed in the above research involve challenging information security pressure. However, no further study has been conducted on it. However, some studies explore technical stress and the role of stress in the information security of the organization, which affect ISP compliance.⁹ According to the analysis of the two-dimensional model of challenge-hindrance stressor theory, technical stress and the role of stress, embodied in challenging information security stress, is a form of positive stress. Such positive stress will lead to growth opportunities and benefits for employees, which make them likely to comply with information security policies. Therefore, this study proposes the following hypothesis:

H1: Challenge information security stress has a significant positive effect on ISP compliance.

Challenge Information Security Stress and Emotions

Morrison and Robinson pointed out that understanding the psychological processes of employees within the organizational structure is important to reduce the abuse of computers by employees.⁴¹ Computer abuse behavior has a complex relationship with the psychological attributes of violators and the organizational environment.⁴² Most existing studies on violations are based on the control function of deterrence theory or the cognitive response of the cognitive model. However, ISP violations may involve emotional factors.^41,43 In addition, case studies have pointed out that emotion is a key psychological factor in computer abuse.⁴⁴ Therefore, the influence of emotions should be considered in the framework of information security behavior research.^45,46 Moreover, in the field of information security study, the theory of fear appeal and protection motivation theory involve the negative emotion of fear.

Based on AET, challenge information security stress, as an emotional event, can induce certain emotions in individuals and affect their behaviors. When talking of the positive emotion of concentration, Watson and Tellegen pointed out that in the workplace, the higher an individual employee’s concentration, the more fun he/she would feel, and the more interest and work commitment he/she would have.⁴⁷ In fact, challenge information security stress is a form of positive stress, and once employees in the workplace can control and deal with challenge information security stress, they will achieve personal growth, skill improvement, and good performance. Hence, an individual under challenge information security stress will produce positive emotions, such as higher levels of focus, excitement, self-assurance, and other positive emotions. Cavanaugh et al also found a positive effect on positive emotions in the study of managers’ challenge stress.¹² Based on the above analysis, this study proposes the following hypothesis:

H2: Challenge information security stress has a significant positive impact on positive emotions.

Challenge information security stress can induce positive and negative emotions. Emotions by themselves are characterized by concreteness and diversity if emotions are divided into positive and negative emotions in terms of the structure of emotions, which is a continuous whole. That is, emotions are aroused in an individual in the face of an induced event, and this arousal is not a single emotional state but a mixture of positive and negative emotions; hence, the term “mixed emotions.” This reason explains why research on emotions has always been complex and difficult to measure. Therefore, challenge information security stress, as a stressful event, will not only trigger positive emotions such as individual focus, excitement, and self-assurance, but also cause certain negative emotions, such as tension, anxiety, and even fear. This finding was also verified by Rodell and Judge, who determined that challenge stress has a significant effect on concentration and anxiety.⁴⁸

Moreover, studies have found that constant stress can lead to increased tension.⁴⁹ Positive stressors such as challenging information security stress also induce tension, anxiety, and other negative emotions. However, once an individual becomes conscious that this stress can be controlled or addressed, the individual can gain benefits, which will reduce the degree of tension and anxiety. Thus, employees’ negative emotions decrease as challenge information security stress increases, based on the above analysis, the following hypothesis is proposed:

H3: Challenge information security stress has a significant negative effect on negative emotions.

Emotions and ISP Compliance

Emotion is intrinsically action-oriented, that is, after emotional arousal; emotions will guide an individual’s subsequent behavioral response. At present, several relevant studies on emotions in the workplace have found that emotions can affect job performance and satisfaction, such as organizational citizenship behavior, organizational commitment, turnover intention, and workplace deviance.¹⁵ Furthermore, based on AET, challenge information security stress, as a work event, will further affect related work behavior performance after arousing the positive and negative emotions of individuals, that is, ISP compliance. Moreover, recent research has found a relationship between emotional reactions and coping responses of the IT security team.⁵⁰ Therefore, in the field of ISP research, emotions are an important variable, which can explain the information security behavior of employees.

Isen and Patrick found that if individuals are in a positive emotional state, they are more likely to avoid risks.⁵¹ Therefore, researchers have proposed the Mood Maintenance Hypothesis, which posits that if emotions are positive, we should maintain the positive state and not do things that will bring negative emotions. Hermans et al further verified this hypothesis.⁵² Therefore, based on the Mood Maintenance Hypothesis, if ISP violation is regarded as a risk behavior, in the context of challenge information security stress, once individuals are in a positive emotional state, they will do their best to avoid this risk and will do more behaviors that are considered ISP compliant. Specifically, if challenge information security stress evokes more positive emotions in individual employees, they experience more positive emotions, such as focus, fun, and self-assurance at their workplace. Moreover, they will avoid taking risks and will do their best to engage in ISP compliance, which is consistent with the orientation of positive psychology. Based on the above analysis, this study proposes the following hypothesis:

H4: Positive emotions have a significant positive effect on ISP compliance.

If individuals are in a negative emotional state, they are more likely to take risks according to the Mood Maintenance Hypothesis.⁵¹ This hypothesis is similar to the principles of “if unhappy, bet on the big one.” Based on the Mood Maintenance Hypothesis, if ISP violations become a form of risky behavior in the context of challenge information security stress, once an individual has aroused a negative emotional state, the individual will try to do such risks that are violations. Thus, ISP compliance becomes relatively lower. Under the challenging information security stress, if individual employees experience more negative emotions, such as tension, anxiety, and even fear, they will take more illegal risks. Correspondingly, information security compliance will be reduced. Conversely, ISP compliance increases if the level of their negative emotions decreases. Therefore, this study proposes the following hypothesis:

H5: Negative emotions have a significant negative effect on ISP compliance.

In summary, challenge information security stress positively affects ISP compliance. Specifically, challenge information security stress has a positive influence on ISP compliance by stimulating positive emotions. Moreover, challenge information security stress has a positive effect on ISP compliance by suppressing negative emotions. Based on this analysis, the following hypotheses are further proposed.

H6: Positive emotions play a mediating role in the relationship between challenge information security stress and ISP compliance.

H7: Negative emotions play a mediating role in the relationship between challenge information security stress and ISP compliance.

Figure 1 shows the overall research model of this study. This research model has two innovations as compared with the existing research. First, in the context of information security management, the two-dimensional model of challenge-hindrance stressor theory highlights that the key factor influencing employee ISP compliance is challenge information security stress. Second, the multiple mediating effects of positive and negative emotions are identified, which means the internal mechanism of challenge information security stress that affects ISP compliance needs to be explored. Moreover, a theoretical explanation is given from the perspective of emotions. These two innovations are of great significance for enterprises to reasonably utilize the positive dimension of stress in the process of information security management. These innovations are valuable for conducting emotion management and guidance from the perspective of employees to improve the information security management of enterprises. In addition, information security is more of a challenge stressor in the context of digital transformation.⁵³ Hence this research model can expand the theoretical understanding of challenge-hindrance stressor theory by focusing only on the challenge stressor, and at the same time extend the AET by focusing on both the positive emotions and the negative emotions.

Figure 1 Research model.

Methodology

Sample and Data Collection

In this study, the data were collected using the field quasi-experimental method through a two-stage questionnaire survey. The field quasi-experimental method was used in this study for two reasons. First, information security stress is a kind of stress related closely to the work scene.⁵⁴ Second, it is more effective to use an experimental method to arouse and measure employees’ emotions.⁵⁵ The researchers used simple random sampling to select three Chinese companies in Shanghai and Beijing that had passed certifications for information security management system (GB/t22080-2008/ISO/IEC 27001:2005) as research objects. Specific samples were for management and professional technicians involved in the information security work behavior of these three companies through systematic sampling. There are two reasons for sampling in this way. First, the quasi-experimental research method of samples from the same Chinese social background was used in this study, which controls the influence of social culture. Second, the sampling ensured that the professional background of the samples was reasonable. The purpose of data collection from three companies was to reduce common method bias. The sample size of 217 employees from the three companies was sufficient for data analysis.⁵⁶

This study considers the Chinese sample as an answer to calls for more research on information security behavior in China.⁵⁴ This study contributed to a greater understanding of the employees’ information security behavior in China, which has become a major user of advanced information technology in the context of today’s global economy digital transformation, and which have introduced many government policies in recent years. Before the formal study, specific research procedures were discussed, modified and demonstrated repeatedly by relevant experts and enterprise managers.⁵⁶ Finally the specific methods and procedures are determined as follows.

Procedures

The procedures of the field quasi-experimental method have two stages. In the first stage, the field quasi-experimental research method was used to carry out situational control of challenge information security stress based on the actual work of the companies.⁵⁶ The specific methods are as follows. Through the information security work meeting, further upgrade requirements were released for information security related to the company. Specific requirements in the information security system included improvements to the regulatory elements in the rule setting, reinforcement of the prescriptive norms in normative elements, and strengthening of the cultural elements in the information security cultural atmosphere construction. Thus, a challenge information security stress situation was created. In the meeting, after the completion of work requirements, the researchers distributed questionnaires on the challenge information security stress and emotions, and on-site recovery. This method is used because emotion is a strong affect, which directly points to someone or something, lasts a short time, and will be generalized into the state of mood over time.

An emotional response is a dynamic process with multiple and timeliness. After arousing emotions under corresponding situations, individuals are asked to report their emotional state in real-time. The self-report method is adapted to measure current emotions.⁵⁵ The total number of participants in the meeting was 298, and 296 questionnaires were collected, representing a recovery rate of 99.33%. A total of 263 questionnaires were valid, with an effective rate of 88.85%. Questionnaires were filled in anonymously and were returned according to the seat number. After the questionnaires were collected, the company’s manager assisted the researchers confirming the respondents of each questionnaire through on-site photos.

The second phase took place a week after the conference. All participants received an ISP compliance questionnaire via email. Participants were tasked to evaluate their ISP compliance in the past week and return completed questionnaires via email within three days. Using email addresses provided by participants, data matching was performed between the data in the first stage and second stage of the questionnaire to remove invalid or missing data in the second stage of the questionnaire. Finally, 217 valid questionnaires were obtained, and the overall questionnaire effective rate was 72.82%. Table 1 shows the descriptive statistics of employees who participated in the study.

Table 1 Descriptive Statistics of Samples (N = 217)

Measures

The variable measurement of this study is based on existing related domestic and foreign maturity scales. First, the researchers asked two experts and scholars in this field to translate the English scale into Chinese and back-translate it into English to ensure accurate translation. Second, according to the definition of this study, the researcher determined the literal expression of items in the scale through discussion to ensure the construct validity of the questionnaire survey. Table 2 shows the measurement of each construct and specific items.

Table 2 Survey Items of Variables

Challenge Information Security Stress

The situation was set on the current challenge information security stress with a total of six items based on the challenge stress scale of Cavanaugh et al¹² and referring to the information security stress scale of Ayyagari et al⁵⁷ and Lee et al.¹⁰ Employees were asked to evaluate the degree of stress caused by the content described in the item according to their current feelings. A seven-point Likert scale was adopted, with 1 meaning “no pressure” and 7 meaning “super pressure.” In this study, Cronbach’s α for the scale was 0.775.

ISP Compliance

This was measured according to the ISP compliance attitude scale of Ifinedo,⁶ and referring to the ISP compliance scale of Tyler and Blader⁵⁸ and Yazdanmehr and Wang.⁴⁰ Employees were asked to evaluate their performance in the past week. A seven-point Likert scale was adopted, with 1 representing “none at all,” and 7 representing “many.” The Cronbach’s α for the scale was 0.833.

Emotions

The scale is based on the positive and negative emotions scale of Watson et al⁵⁹ and refers to the emotions scale of Rodell and Judge,⁴⁸ which contains seven words related to positive emotions and eight words related to negative emotions. Employees rated their feelings based on the emotional vocabulary provided. A seven-point Likert scale was used, with 1 meaning “very slight or no,” and 7 meaning “very strong.” Cronbach’s α were 0.761 and 0.878 in the positive and negative emotions scale respectively of the present study.

Data Analyses and Results

Common Method Biases Analysis

The common method biases were avoided to some extent in terms of the research method design given that the survey designed in this study was collected in a two-stage method and a one-week interval. Nonetheless, the variable data come from the self-report survey samples. A common method bias test is still necessary to avoid the reduction of construct validity. The research adopts the Harman single factor test,⁶⁰ and the test results show that the first-factor variance explained 29.933%, which is less than 40%. Hence, common method bias does not exist.

Descriptive Statistics and Correlation Analysis

Table 3 shows the mean, standard deviation, and correlation coefficient of the four variables of challenge information security stress (X), positive emotions (M1), negative emotions (M2), and ISP compliance (Y). Challenge information security stress was significantly and positively correlated with positive emotions (r = 0.319, p < 0.01). Challenge information security stress was negatively correlated with negative emotions (r = − 0.613, p < 0.01). Positive and negative emotions were significantly and negatively correlated (r = − 0.146, p < 0.05). A significant positive correlation was found between challenge information security stress and ISP compliance (r = 0.398, p < 0.01). Positive emotions were significantly and positively correlated with ISP compliance (r = 0.704, p < 0.01). Negative emotions were significantly and negatively correlated with ISP compliance (r = −0.181, p < 0.01). The correlation coefficients of the four variables all reached the significance level, indicating that the data were suitable for the multi-mediation model test. Moreover, the correlation between the four variables was consistent with the theoretical expectation, which provided preliminary evidence for the subsequent test of the research hypothesis.

Table 3 Descriptive Statistics, Correlation, Reliability, and Validity of Variables (N = 217)

Reliability and Validity

In this study, combined reliability (CR) and Cronbach’s α reliability test were used. Discriminant validity was verified by determining whether the square root of the AVE of variables is greater than the correlation value between variables. Table 3 shows the indicators. Cronbach’s α reliability of the four variables of challenge information security stress, positive emotions, negative emotions, and ISP compliance are 0.775, 0.761, 0.878, and 0.833, respectively. The CR was 0.840, 0.838 0.906, and 0.897, respectively. Each reliability value is greater than 0.7, which is within the acceptable range, which indicates that the measurement reliability of the variable scale is high. Moreover, the square root of AVE ranges between 0.647 and 0.802 (see Table 3), which are greater than the correlation between the different variables (except for the correlation coefficient between positive emotions and ISP compliance [r = 0.704] is slightly greater than the AVE square root). Thus, variable measurement has good validity.

Hypotheses Testing

This study tested the multi-mediator model by using the bootstrapping method recommended by Preacher and Hayes.⁶¹ According to the research hypothesis, challenge information security stress is the independent variable, ISP compliance is the dependent variable, and the two mediators are positive and negative emotions. The sample size set is 5000, with a 95% confidence interval.⁶² This study used the Process 3.0 plug-in of SPSS 20.0 to check the following significance of the regression coefficients in the multi-mediator equation. c, a₁, a₂, b₁, b₂, and c’ are the regression coefficients of the equation. ε₁, ε₂, ε₃, and ε₄ are the residual error of each equation. Tables 4 and 5 show the specific results.

(1)

(2)

(3)

(4)

Table 4 Results of Regression Equation (N = 217)

Table 5 Bootstrapping Analysis Results of Multiple Mediating Effects (N = 217)

Table 4 shows that the regression coefficient in equation (1), c = 0.434 (p < 0.001), indicates that challenge information security stress significantly and positively influences ISP compliance. Hence, Hypothesis 1 is supported. This result is the basis for subsequent tests of multiple mediating effects.

The regression coefficients in equations (2) and (3), a₁ = 0.283 (p < 0.001), a_{2 =} − 0.561 (p < 0.001), indicate that challenge information security stress has a significant positive effect on positive emotions, and a significant negative effect on negative emotions. Thus, Hypothesis 2 and 3 are supported.

In equation (4), the regression coefficient c’ = 0.245 (p < 0.001), b₁ = 0.785 (p < 0.001), b₂ = 0.060 (p = 0.399 > 0.1) indicates that positive emotions have a significant positive effect on ISP compliance, whereas negative emotions do not have a significant effect on ISP compliance. Therefore, Hypothesis 4 is supported, but Hypothesis 5 is not.

In the inspection index of the overall model, R² = 0.531, which shows that the ISP compliance of 53.1% can be explained by the model, and the fitting of the model is good. F = 80.390, p = 0.000 shows that the effect of the independent variable challenge information security stress on ISP compliance is significant by the multi-mediating of positive emotions and negative emotions.

The bootstrapping method was used to test the multiple mediator model and not only the overall indirect effect but also the single mediator. The mediating effects were compared. The above effect can be made with the 95% confidence interval, that is, if the 95% confidence interval does not contain 0, then the mediating effect is significant.

Table 5 shows the overall indirect effect of challenge information security stress a₁*b₁ + a₂*b₂ = 0.190. In addition, 95% of the bootstrap confidence interval is {0.064, 0.313}. The completely standardized 95% of the bootstrap confidence interval is {0.061, 0.275}, and the confidence interval does not include 0. Therefore, the null hypothesis that the total indirect effect is zero is rejected, indicating that the total indirect effect is significant.

Table 5 also shows the mediating effect value is as follows. Through positive emotion: a₁*b₁ = 0.222, the 95% CI of the bootstrap is {0.134, 0.324}. The 95% CI of the completely standardized is {0.129, 0.280}, all of which do not include 0. Therefore, the mediating effect of positive emotions is significant, which supports Hypothesis 6. Through negative emotions: a₂*b₂ = − 0.034, the 95% CI of the bootstrap is {− 0.124, 0.050}. The 95% CI of completely standardized is {− 0.116, 0.045}, all including 0. Thus, the mediating effect of negative emotions is not significant and Hypothesis 7 has not been verified.

In addition, two mediating effects were compared. a₁*b₁ − a₂*b₂ = 0.256, 95% CI of the bootstrap is {0.131, 0.387}. The 95% CI of the completely standardized bootstrap is {0.124, 0.347}, all of which did not include 0. Therefore, the difference between the two mediating effects was significant, which also verified the above results. Thus, Hypothesis 6 is true, whereas Hypothesis 7 is not. Figure 2 shows the model results of this study.

Figure 2 Results of the model.

Discussion

This study adopted a two-stage survey with the field quasi-experimental method based on the two-dimensional model of challenge-hindrance stressor theory and AET. Employees of Chinese enterprises certified by the information security management system (GB/T22080-2008/ISO/IEC 27001:2005) were taken as research objects to explore the mechanism between challenge information security stress and ISP compliance. This study verified the positive effect of challenge stressors and the mediating effect of positive emotions using the different distinguishing effects of challenge stressors. Therefore, the challenge-hindrance stressor theory and AET is further developed in the field of information security behavior research.

Relationship Between Challenge Information Security Stress and ISP Compliance

The present study found that challenge information security stress has a significantly positive influence on ISP compliance, which indicates the positive significance of challenge information security stress. The higher the level of challenge information security stress, the more inclined employees are to follow information security policies. This finding is consistent with the conclusions of Hwang and Cha⁹ and Zhen et al.⁵⁴ The result also verifies the theory of challenge stressor in the two-dimensional model of stressors in the context of organizational information security.

The implications of the finding for enterprises in the practice of information security management are to emphasize challenge information security stress in organizations. For example, adopting new technologies or upgrading systems in the information security work process should be prioritized to provide individual employees with growth opportunities. In specific work requirements such as rule setting, norms and cultural elements, the benefits brought to employees through work experience are emphasized. Challenge information security stress encourages staff to comply with information security policies.

Different Effects of Challenge Information Security Stress on Emotions

The present study found that challenge information security stress has a significant positive effect on positive emotion and a significant negative effect on negative emotions. The conclusion further verifies the positive significance of information security stress from the perspective of the psychological process of employees. This finding is consistent with the conclusions of Farshadkhah et al.³² Moreover, the conclusion also responds to Siponen and Vance,⁴⁶ who proposed considering emotions in the framework of information security behavior research. The conclusion supports AET in the field of information security behavior research.

The implications of this finding for enterprises in the practice of information security management are as follows. Emotion management of information security work process should be given more attention. This study increases practitioner awareness of the importance of an organization’s challenge stress particularly in departments wherein employees deal with information security. However, the psychological state of employees should not be ignored. The content of information security work itself is complex, which has a high effect and demand on the psychological state of employees. Our findings highlight the importance of controlling and monitoring employee affect, which is a critical element in the protection of organizational information and assets.

Mediating Role of Positive Emotions

The present study found that positive emotions have a mediating effect on the relationship between challenge information security stress and ISP compliance. This finding reveals that challenge information security stress has a positive effect on ISP compliance only by inducing positive emotions, whereas negative emotions have no mediating effect. Thus, while challenge information security stress can be explained by the mediating mechanism of emotions, but only positive emotions play a role. The reduction of negative emotions does not lead to more ISP compliance. This research conclusion challenges Isen and Patrick’s Mood Maintenance Hypothesis.⁵¹ To some extent, this finding supports the Affective Generalization Hypothesis.⁶³ At the same time, this finding also provides empirical support for the application of positive psychology in the field of management.

This finding offers valuable insights to the organization, which suggests that changes in challenge information security stress factors might influence ISP compliance through positive emotion. In the process of emotion management, enterprises should not focus too much attention to negative emotions during stressful situations. Negative emotions are only a natural reaction under the challenge information security stress situation, which does not have a significant effect on ISP compliance. Instead, companies should focus on encouraging and guiding positive emotions in their employees. Ultimately, such human resource management will improve organizational performance.¹⁷

Limitations and Future Research

This study has three limitations that can guide future research. First, the evaluation of employee emotions is conducted using a self-reported survey, which ignores some objective state characteristics of emotional reactions. Hence, future research can examine the relationship between emotions and ISP compliance using physiological index measurement or behavioral observation method. Second, the factors affecting ISP compliance are relatively complex, which is consistent with the significant finding that 53.1% of ISP compliance can be explained by the model in the overall model test. Thus, future research can explore the influence of more independent and moderating variables by adding organization and group-level factors, such as organizational culture and leader-member exchange. It may also be interesting to investigate situations on employee ISP compliance, perhaps as a following behavior, when leaders are compliant with ISP. In these cases, the emotions and commitment may serve to promote compliance. Finally, because this study focuses on samples only in China, future research can examine the relationship between challenge information security stress, positive emotions, negative emotions, and ISP compliance through cross-cultural comparative studies. Multicultural research is required to understand how challenge information security stress influence ISP compliance in diverse contexts because the perception and expression of stressors and emotions are related to socio-culture.²⁵

Conclusion

Based on the challenge-hindrance stressor theory and AET, we developed and tested a theoretical model that linked challenge information security stress, positive emotions, negative emotions, and ISP compliance. The empirical results supported some research hypotheses, and the findings increase knowledge on studies in the field of behavioral information security management. First, challenge information security stress has a significantly positive influence on positive emotions and a significantly negative influence on negative emotions. In addition, challenge information security stress has a significantly positive influence on ISP compliance. Second, positive emotions have a significantly positive influence on ISP compliance. Third, positive emotions play mediating roles in the relationship between challenge information security stress and ISP compliance. The results are consistent with the difference in the effect of challenge stressors found in previous studies.^24,25 The findings of this study addressed the research gap on the limited number of studies that have focused on emotion-related factors that influence ISP compliance.