## 3 Methodology  
The grounded theory approach has been used for this systematic literature review. The authors followed the theory proposed by [57]. This theory helps researchers to review step by step and explore more depth and breadth on the topic. The acquired approach consisted of five main phases (define, search, select, analyze, and present) illustrated in Figure 1.  
First, a review plan has been designed, and research questions are formulated to extend the investigation [58]. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Authors** & **Sample Size** & **Category** & **Findings** & \multicolumn{1}{c}{**Limitations**} \\ \hline
[25] & 43 articles & Component-based SLR & Information security management can enhance ISPC in higher education institutions & 1. & Only one component of behavioral information security discussed. \\ \hline
[56] & 39 articles & Component-based SLR & Management role should be considered to cultivate good ISPC in organizations & 1. & Review was only targeted towards one component of the behavioral information security domain (information security management) \\ \hline
[13] & 60 articles & Theory-based SLR & Methodological and additional substantive issues are the reason for the inconsistent results of deterrence theory. & 1. & The systematic literature review (SLR) was only related to deterrence theory \\ \hline
[34] & 35 articles & Theory-based SLR & Deterrence theory (except sanction celerity) affects ISP compliance behavior, and deterrence effects vary with different cultures & 1. & The review only discusses the problems and inconsistencies related to deterrence theory \\ \hline
[32] & 30 articles & Theory-based SLR & Protection motivation behaviors are critical for enhancing ISPC & 1. & SLR was only based on protection motivation behaviors \\ \hline
[28] & 29 articles & Variable based SLR & There were no clear winners of the most influencing variable or the theory for compliance or incompliance & 1. & Small dataset Variable based analysis \\ \hline \hline \end{tabular}
\end{table} 
Table 1: \(Cont.\)  
Figure 1: Literature review methodology. What are the behavioral factors concluded in studies as a significant determinant of information security policy compliance? What are the behavioral factors concluded in studies as a significant determinant of information security policy noncompliance? What are the best possible transformation steps of behavior as analyzed in studies from noncompliance to compliance? Second, the search scope is defined and restricted to computer science, social science, information systems, and information security (behavioral aspect). This study focused on automated and manual search processes to gain as many research articles as possible to fulfill the defined objectives. Queries and keywords were developed according to research objectives to search databases enlisted in Table 2. As discussed earlier, a manual search process has also been performed through search engines and reference lists of related articles. Article was published in a journal between 2010 and 2020. Articles were rejected for review if:  
1. The article is related to information security behavior but not information security policy compliance or vice versa. 2. Articles are related to other than organizational security policy compliance. For example, home users. 3. Articles with just management/awareness/culture without any behavioral aspect. 4. Articles related to cybersecurity not information security. 5. Articles without any methodological evidence. 6. A book, magazine, thesis, or a report. After applying the selection criteria to 514 downloaded articles, 41 articles were excluded due to duplication, 215 articles were rejected after reading the abstract, and two experts reviewed the remaining 258 papers. One hundred and eighty papers were rejected after a full read of articles by two experts with reasons. Finally, two papers were added from references. Hence, 80 studies (qualitative, quantitative, and literature review) in total were selected for this review.