## 5 Discussion
### Theoretical Implications  
Law abidance is a practice that varies from region to region and country to country. National culture is tested in the ISVC domain, and researchers found it significant toward compliance [43; 44]. Some researchers considered national culture as a dimension of organizational culture and suggested national culture can be rationalized with the organizational culture [55]. Significantly, security awareness is the primary factor contributing to good security culture. Effective SETA programs make it possible to provide awareness with ease. Security aware behaviors such as knowledge of information security policy, conscious care behaviors towards ISP, early conformance of updated ISP, and employees' competency levels about ISP have significant effects on ISVC [17; 90], while top management also plays a vital role in compliance with security policies. Many studies analyzed and discussed management behaviors that determine the direction of security policy compliance. An organization's information security depends on the management's actions and adopted behaviors, such as declaring ISP mandatory to follow, management support, controllability, and correct use of rank or status [110]--see also [PERSON] et al., 2015 [72].  
Motivations play a critical role in compliance behaviors. Motivations are categorized into two classes--(1) intrinsic motivations and (2) extrinsic motivations--by ISPC researchers. Intrinsic motivations are self-motivations, i.e., performing an activity for its own sake or for personal rewards, while extrinsic motivation can be defined as performing an activity to avoid punishment [8].  
Employees' motivations towards protection show a significant effect on ISPC. The literature supports the claim that if an employee is motivated to protect assets or have protection motivation behavior, they will have substantial chances to comply with ISP. Researchers tested protection motivation behaviors with protection motivation theory (PMT) in the ISPC domain. PMT proposes that people perform two types of actions in a threatening situation. They first evaluate how significant the threat is (threat appraisal) and how to deal with it (coping appraisal). The researchers determined that PMT is the most commonly used theory in ISPC studies (compliance and noncompliance). Several studies tested the strength of threat appraisal and coping appraisal among employees towards ISPC. The literature supports that employees who perceived information security threats severity and perceived coping strategies with the threat have more compliant behaviors [24; 37]. Employees perceive extrinsic motivations from their social circle or their peers. Social behaviors influence compliance towards ISP. The researchers outlined many social factors, such as social bonding and social cognition, social pressures, and norms that significantly affect compliance behaviors [82].  
The literature about noncompliance behavior suggests that employees' noncompliance with ISP can be intentional or unintentional. Employees indulge in various value conflicts. For instance, a job task's value is perceived to be more critical than information security or the importance of conflict. Security-related stress is a crucial factor for employees' noncompliance [39]. Complex security-related requirements cause negligence and deliberate volitional behavior. Employees who violate the ISP neutralize their actions with the seven techniques defined by [PERSON] in 1964 [94]. Employees' noncompliance behavior can be deterred by additional sanctions (formal and informal) and punishments. Several studies used deterrence theory in noncompliance behavior and determined that deterrence negatively affected noncompliance [13].