## 4 Results and Analysis
### Analysis of Compliance Behavior
#### 4.1.6 Social Behaviors and Compliance
Information security controls (i.e., social and formal) were examined by [41] with two types of IS behaviors (extrarole and irole). Social controls were developed from social control theory, whereas formal controls consisted of rewards, evaluation, and specification. This study proved that formal control with social control has significant positive effects on security behaviors, improving ISP effectiveness; on the contrary, this was the first study that has examined controls with extrarole behaviors. Reference [84] established that ISP-related personal norms are essential predictors of information security compliant behavior. The study combined the principle of ethical climate constructs with personal norms (subjective, injective, and descriptive) to measure the ISB. In short, the results of the study have shown that the principle ethical climate affects the social norms of employees and that social norms effect personal norms (i.e., subjective, injective and descriptive) moreover ISP related awareness and ISP related ascription of personal responsibility was also having significant effects on Information security compliant behavior. Similarly, [85] analyzed involvement theory within the social bond theory. They have developed a framework with social bond theory (involvement, commitment, attachment, personal norms) and involvement theory (knowledge sharing, collaboration, intervention, and experience) and tested their framework on four different Malaysian organizations. The study determines that information security knowledge sharing and collaboration can increase awareness among employees. Experience or mastery of safeguarding information security assets is another significant factor that influences the attitudes of employees. It has been shown that all social bond factors except attachment have significant effects on information security compliance behavior. A research framework for reducing insider threats has been proposed by [86]. The framework was based on Situational Crime Prevention Theory (SCPT) and Social Bond Theory (SBT). The researchers proposed elements of SCPT (increase effort and risk to commit a crime, reduce rewards and provocations and remove excuses) and SBT (commitment, attachment, involvement with ISP and personal norms) to help positively to promote the negative attitude towards security misbehavior and intention. This study's results have clearly shown that the SCPT and SBT constructs significantly promote negative attitude towards misbehavior, whereas reducing provocation and attachment did not significantly reduce insiders' misbehavior and intention. Reference [87] highlighted that person-organization fits (i.e., interaction between organization and employee) effect extra role behaviors. These researchers argued that person-organization fits (perceived demand-ability, need-supply, and value) increase employees' commitment to security and decrease apathy effects. This study proved that employees with increased commitment and low apathy are more likely to engage in extra role security behaviors. For the first time, [88] examined the moderating role of social influence on individual and organizational level factors towards I SPC. The study results proved that social factors (i.e., rules-oriented ethical climate and susceptibility) could weaken the effect of the command and control and self-regulatory approaches of I SPC on an individual and organizational level. An empirical study [3] examined organizational governance and social bond factors' effects on I SPC. The study results proved that an organization with good organizational governance could enhance social bonding among employees, improving the I SPC in the organizational context. Social behaviors and compliance studies are thoroughly summarized in Table 9.