## 1 Introduction  
In today's hyperconnected world, businesses now use technology to collect, store and share essential information. There is a significant threat of that information being accessed, disrupted, modified, corrupted, or destroyed illegally by malicious and unauthorized actors. That is where information security comes in: these are the measures that companies put in place to stop the threats meted against their valued information. The extensive and variable risks businesses face upon falling victim to a data breach can damage business revenue and reputation [1, 2]. Research shows that about 70% of incidents happened due to human negligence (intentional or unintentional). A study on security professionals' behavior concluded that 43% of data breaches are due to employees' behavior [3, 4]. In 2014 IBM cybersecurity intelligence index reported almost 95% of information security incidents to involve employee negligence [5]. Attackers target employees' behavior to execute their malicious activities. A British study concluded that 58 percent of attacks in British organizations are due to insider threats. Thirty-three per cent of these attacks are due to noncompliance with an organization's information security policies (ISP's) and regulations [6]. To mitigate organizational information security threats, most organizations have adopted standard guidelines provided by the National Institute of Standard and Technology (NIST). The NIST framework emphasized ISP Compliance and described it as an essential measure of information security [7]. Multiple information security management standards are used by the organizations, such as; Control Objectives for Information and Related Technologies (COBIT), International Organization for Standardization (ISO), and International Electrotechnical Commission (IEC) (ISO/IEC 27001). For extenuating security risks, organizations consider establishing information security standards (ISO/IEC 27001 and ISO/IEC 27002) for best practices. These guidelines and policies provide the best direction for information security. A detailed policy document contains behavioral checks, recovery processes, and technical controls to deal with a successful security breach [8]. Researchers have suggested many ways to adopt these standards, but there are behavioral issues in adapting the standards. On the other hand, organizations do not focus on their internal problems while designing an information security policy [9]. Information security in organizations incorporates a complicated process that involves many factors, such as education, human factors, and technology, which it is necessary to manage under one security model [10]. Organizations need to monitor employees' behaviors and evaluate the factors which influence employees' work performance. Various studies suggested that stress, work impediment, and coworker behaviors influence employees' behaviors [11; 12]. Furthermore, positive management behaviors (behaviors adopted by the organization's management) and social behaviors (coworkers' and peers' behaviors) help enhance security-aware behaviors, which leads to good security culture in organizations. Information security policy compliance (ISPC) is a matter of human behavior. Numerous researchers tried to provide solutions with the help of psychological theories [13; 14; 15]. Many frameworks are provided by researchers using different external factors and theoretical constructs. ISPC research evaluates human behavior in two main dimensions--intention to comply and intention to violate. More specifically, researchers try to determine what motivates employees to comply and to violate the ISP. Many researchers, for instance, [3; 15; 16; 17], focused on behaviors related to compliance with ISP. In contrast, many studies such as [13; 18; 19; 20] explored violation behaviors.