## 4 Results and Analysis
### Analysis of Compliance Behavior
#### 4.1.4 Security Culture, Awareness Behaviors and Compliance
Similarly, [49] emphasized a top management role to cultivate good security culture and behavior in organizations. These researchers presented a framework and tested it on 148 alumni of a public sector university. Their study findings showed that organizations' top management influence employees' perceived security culture and their beliefs towards ISPC. Reference [46] presented a framework based on security culture and organizational behavior constructs. The research highlighted the behavioral effects of security culture and organizational behavior (job satisfaction and perceived organizational support) towards ISPC. Their research findings showed that security culture and job satisfaction influence behavioral compliance towards ISP, whereas perceived organizational support has no significance on employees' behavior. Reference [68] argued that different levels of knowledge about ISP influence behavioral compliance; they developed a framework to test their hypothesis and divided the participants into two groups--(1) high knowledge group (2) low knowledge group--with the help of interviews and questionnaire. Their results showed significant differences between both groups and inconsistency in the results due to different ISP knowledge levels. However, 80 percent of the respondents of both groups showed their intention to comply with ISP. Reference [47] examined the factors influencing conscious care information security behavior; security awareness and organizational security policy showed positive effects on the subjective norms and attitude towards employees' conscious care security behaviors. Threat appraisal and self-efficacy proved to be significant factors towards the formation of the conscious behaviors of employees. Furthermore, they discussed how the conscious care behavior of employees significantly reduces the risk of information security breaches. Reference [17] focused on early conformance with updated ISP. They argued that early conformance with ISP is much beneficial for organizations than late conformance or nonconformance. Employees' intentions and attitudes were tested for determining early conformance with ISP; a TPB-based research model was developed and tested on 535 employees. The results showed that awareness has a positive effect on the attitude, and attitude shapes the early intentions to conform, which later on become early conformance behavior towards ISP. Reference [33] conducted a systematic literature review and identified competencies (knowledge and skills) related to ISP compliance; these researchers argued that employees must be competent enough to comply with ISP. In this review, the researchers reviewed a total of 32 articles and eight internationally published professional competence frameworks. Three significant dimensions (attitude, knowledge, skills) and 11 factors regarding ISP competency were identified. In this study, an ISP compliance competence model was presented and analyzed with professional competency frameworks. This study identified the gap between the literature and the professional frameworks. The findings revealed that most behavioral theories imply that compliance with ISP needs specific competencies, but professional frameworks lack the ability to present those competencies. In Table 7, a detailed analysis of the selected studies provided information about culture and security-aware behaviors' effects towards compliance.