## 1 Introduction  
Information security plays an increasingly important role for organizations' operation and development. The car industry, the context in which this study takes place, is no exception. Development of connected cars, autonomous driving, and cooperative intelligent transport systems are but some recent examples of technologies whose operation rely on continuous information sharing, and security from theft and wrongful manipulation [1]. Information security management is the practice of providing confidentiality, integrity, and availability (or the CIA triad) to information and information systems in a systematic way by identifying, selecting, and introducing security controls [2, 3]. These security controls can be \"any process, policy, procedure, guideline, practice or organizational structure, which can be administrative, technical, management, or legal in nature which modify information security risk\" ([4], p. 2). Security controls are typically identified and selected as a result of a risk assessment, often requiring a broad set of skills and know how [5, 6, 7], as it aims to maximize resource allocation as well as benefit the security controls offered in assisting (rather than burdening) organizational operation and development [8]. However, adoption of new security controls often means changes to the organization'senvironment, which is not always perceived as useful, depending on the organization's change-readiness [9]. While perceived usefulness and adoption of security controls have been addressed in numerous studies (e.g., [8, 10, 11, 12]) and have been described as a fertile ground for additional research [13], the focus has mainly been on the change recipients. That is to say, the end-user of the security controls, such as employees within the organization who are affected by the controls in their day-to-day work. Considering that many incidents, malicious or otherwise, have been reported to be directly (or indirectly) the result of end-users' avoidance or ignorance of security controls [8], it has made sense to study factors affecting change-readiness among recipients, to better cope with advances in security controls. However, less attention has been paid to the affective factors among the change agents. That is to say, those responsible for selecting and implementing the security controls in the first place [14]. Especially when considering new, or innovative, types of security controls based on technology that is not (yet) considered common practice. This presents a gap in the literature on information security management, and to an extent, risk management. In addressing this gap, this study draws on Technology Readiness Levels [15] and an Innovation-Decision Model [16] to study the cognitive and affective factors when considering new security controls in relation to the controls' technological maturity. While security controls may refer to a wide array of proactive and reactive initiatives, in this study, the focus is on cryptography--and in particular, public-key-based cryptography. The reason for picking such a relatively narrow type of security control is twofold. First, cryptography is a mature and widely applied security control with well-defined best practices and standards [17]. One such example is Public-Key Infrastructure (PKI), which is a common framework to govern and issue cryptographic keys as digital certificates. Second, cryptography is, at the same time, under constant development with new innovations to be considered. One such example is the development of certificateless public key cryptography--as an alternative to PKI--which has shown to be advantageous in some instances, such as privacy and latency [18]. Because of this duality, public-key-based cryptography serves as a good candidate to study attitudes and interventions regarding adoption of new (cryptographic) security controls.