Date of Conferral

10-22-2026

Date of Award

October 2026

Degree

Ph.D.

School

Management

Advisor

David Bouvin

Abstract

Despite increasingly sophisticated cyber threats, organizations continue to face challenges in achieving information security policy (ISP) compliance, particularly in developing countries such as Kenya. IT leaders need to understand the intrinsic factors influencing employees' intention to comply with ISPs to strengthen organizational cybersecurity. The purpose of this quantitative correlational study was to examine the relationship between intrinsic motivational factors of autonomy, competence, and relatedness and employees’ behavioral intentions to comply with ISPs in medium and large enterprises in Kenya. Self-determination theory grounded this study. The participants comprised 191 employees from medium and large enterprises in Kenya. They completed the Human Aspects of Information Security Questionnaire and the Compliance Intention Model. Pearson correlation analysis revealed significant positive relationships between autonomy and behavioral intention to comply with information security policy, r(189) = .718, p < .001; competence and behavioral intention, r(189) = .662, p < .001; and relatedness and behavioral intention, r(189) = .618, p < .001. The hierarchical multiple regression analyses identified autonomy as the strongest predictor of behavioral intention (R² = .516), whereas age, gender, job level, education level, and work experience did not significantly moderate these relationships. Findings indicate that autonomy is the strongest predictor of employees’ behavioral intention to comply with ISP. The implications for sustainable positive social impact include the potential for IT leaders to adopt autonomy-supportive security practices that foster ISP compliance, improve cybersecurity resilience, and reduce human-related security vulnerabilities.

Download

Share

 
COinS