## 1 Introduction
Studies evaluating compliance behaviors concluded that effective security management, proper security awareness, a good security culture, and other behavioral factors enhance employee ISP compliance, while studies focused on noncompliance stated that employees' noncompliance with ISP could be intentional or unintentional, psychological or external. The assessment of human behavior is a complicated phenomenon, and several psychological theories have been proposed to cover different aspects of human behavior. Likewise, assessing individual's intention towards information security is a complicated subject [21]. In this regard, multiple IS researchers proposed various research models and theories to assess individuals' behaviors towards information security policies [12; 22; 23]. To some extent, researchers have successfully incorporated behavioral theories in the IS context, but still, many gaps remain open. For instance, [13] described that deterrence theory has multiple behavioral outcomes and inconsistent results. Similarly, the authors in [24] provided a taxonomy for the theory of protection motivation and described the reasons for inconsistent outcomes for protection motivation theory in IS research. Moreover, they stated that researchers must use core and full constructs of protection motivation theories in a correct manner for measuring protection motivation behaviors. Likewise, there are similar outcomes for each behavioral theory used in the IS research. Multiple frameworks are available to assess human intentions towards information security policies, but none of the frameworks can be used as a standard behavioral process model. All the frameworks defined in the extant literature are either specific to a sector (for example, finance, higher education) [25; 26] or specific to various theories [18; 24; 27]. None of the previous studies has made an effort to develop a consolidated information security behavior process which can exhibit the transformation process from noncompliance to compliance. There is a dire need to identify a behavioral transformation process incorporating major behavioral theories and components affecting information security behavior. This paper aims to determine employees' noncompliance behavior's transformation steps to compliance behavior to develop a process model. For this purpose, the authors have systematically reviewed studies that have addressed the nexus of information security behavior and ISPEC. We have analyzed the results, sample sizes, methodologies, and frameworks published in studies published in the last decade (i.e., 2010 to 2020). Moreover, the current paper has reviewed and analyzed the available literature systematically to acquire insight into the behavioral theories and factors that contribute significantly to ISPEC. Our systematic literature review (SLR) followed the review protocol from [25; 28]. A standard modeling language and platform are used in the current study to generate a formal process model for information security behavior transformation. In order to develop a process model, process management is deemed as the next crucial step. Typically, process management is explained as an effective way to present all the objective and subjective business goals in graphical format [29]. A process is a pictorial illustration of a specific goal, while Business Process Management is the art of skillfully presenting the said goal [30; 31]. There are many modeling languages available for process modeling, such as Business Process Modeling Notation (BPMN), Event-Driven Process Chains (EPC), Yet Another Workflow Language (YAWL), and Petri nets. In this paper, the authors follow the standard language BPMN. The process for behavior transformation has been drawn using SIGNAVIO, an online tool available for process development. The developed process model can help information security managers to understand the behaviors related to security policy compliance/noncompliance.