# Factors Affecting Corporate Security Policy Effectiveness in Telecommuting

Authors: Chulwon Lee; Kyungho Lee
Journal: Security and Communication Networks
 (2021)

---

## Abstract

COVID-19 has prompted a rise in telecommuting practices in most companies worldwide. Meanwhile, companies are struggling to cope with the new and evolving security threats in telecommuting using old control methods. Specifically, there is an increased danger of hacking attacks in telecommuting environments. Furthermore, corporate concerns regarding telecommuting security have led to a questioning of existing control methods that no longer seem adequate. Significant research has been conducted on the factors that improve the effectiveness of corporate security policies, such as formal control, informal control, and extrarole behaviors. However, these studies did not consider telecommuting environments, which surged after the COVID-19 outbreak. Telecommuting loosens the physical control over employees and eliminates the collegial environment in which employees encourage each other to protect system information. This study determined how the factors that influence the effectiveness of existing information security policies behave in a telecommuting environment. Our study shows that specification and mandatoriness are the most important factors for an effective telecommuting security policy. We conclude that this sudden change in the working environment has rendered existing security controls obsolete, and specification and mandatoriness are likely to receive increasingly more attention in the growing field of telecommuting security policy.


---

## Body

## 1. Introduction

### 1.1. The Increase of Telecommuting and Cyber Risk due to COVID-19

There has been a significant increase in teleworking practices in most companies worldwide after the COVID-19 pandemic. Only 29% of the waged and salaried employees in the United States could work from home in 2017 and 2018, that is, before the COVID-19 pandemic [1]. However, a Gartner survey of 317 CFOs on March 30, 2020, revealed that three-quarters of respondents plan to turn over at least 5% of their staff into teleworking permanently post-COVID-19 [2]. Baker [3] also said in July 2020 that 82% of CEOs also would map out a plan of relocating their staff to remote work.Meanwhile, there was a 21% year-on-year increase in cyberattacks in the first quarter of 2020 itself [4]. In addition, according to the KISA (Korea Internet and Security Agency) survey report of May 2020, 51.57% of the 1623 respondents said that they had experienced hacking attempts and malicious code infections while telecommuting [4]. Also, the threat such as spear phishing employing malicious URLs is on the rise [5]. All systems of corporations connected to the Internet are vulnerable to cyberattacks (especially DDoS), and high value systems are more likely to be attacked owing to economic benefits [6]. Rubinstein [7] said that corporations need to take technical measures as well as expand their job training programs, to prevent potential hazards associated with telecommuting environments.


### 1.2. The Need for Research on New Environment

Several corporations have adopted relentless efforts to develop security policies and assorted control systems, as well as invested considerable time and money to secure their primary assets from both external and internal threats. However, there are limited studies that help improve the effectiveness of information security policies in a well-controlled office space based on the theories of formal and informal control. It seems that the security controls according to these existing studies do not work exactly against the cyber threats that emerged in the COVID-19 pandemic.According to D’Arcy et al. [8], an information security policy is the same as social rules. Therefore, just as social rules change according to the environment, the same is true for information security policies. Moreover, telecommuting security policies must be distinguished from existing security policies because the cyber threats during COVID-19 have not been previously observed in secure and well-controlled office spaces. That is why a new environment requires new controls.To counter the unpredictable risks that have emerged during the volatile COVID-19 crisis, in this work, we propose a model based on social control theory, formal control, and general deterrence theory. We collected data from 207 experienced employees working in different telecommuting environments. The survey data confirmed the importance of specification and mandatoriness of policies in developing an effective information security policy for corporations: specification is to describe clearly and definitely security polices and mandatoriness is the degree to which individuals comply with security policies. As it was important to specify well security policy in mandatoriness in previous research, we also tried to find out the relation with specification and mandatoriness in telecommuting.


## 1.1. The Increase of Telecommuting and Cyber Risk due to COVID-19

There has been a significant increase in teleworking practices in most companies worldwide after the COVID-19 pandemic. Only 29% of the waged and salaried employees in the United States could work from home in 2017 and 2018, that is, before the COVID-19 pandemic [1]. However, a Gartner survey of 317 CFOs on March 30, 2020, revealed that three-quarters of respondents plan to turn over at least 5% of their staff into teleworking permanently post-COVID-19 [2]. Baker [3] also said in July 2020 that 82% of CEOs also would map out a plan of relocating their staff to remote work.Meanwhile, there was a 21% year-on-year increase in cyberattacks in the first quarter of 2020 itself [4]. In addition, according to the KISA (Korea Internet and Security Agency) survey report of May 2020, 51.57% of the 1623 respondents said that they had experienced hacking attempts and malicious code infections while telecommuting [4]. Also, the threat such as spear phishing employing malicious URLs is on the rise [5]. All systems of corporations connected to the Internet are vulnerable to cyberattacks (especially DDoS), and high value systems are more likely to be attacked owing to economic benefits [6]. Rubinstein [7] said that corporations need to take technical measures as well as expand their job training programs, to prevent potential hazards associated with telecommuting environments.


## 1.2. The Need for Research on New Environment

Several corporations have adopted relentless efforts to develop security policies and assorted control systems, as well as invested considerable time and money to secure their primary assets from both external and internal threats. However, there are limited studies that help improve the effectiveness of information security policies in a well-controlled office space based on the theories of formal and informal control. It seems that the security controls according to these existing studies do not work exactly against the cyber threats that emerged in the COVID-19 pandemic.According to D’Arcy et al. [8], an information security policy is the same as social rules. Therefore, just as social rules change according to the environment, the same is true for information security policies. Moreover, telecommuting security policies must be distinguished from existing security policies because the cyber threats during COVID-19 have not been previously observed in secure and well-controlled office spaces. That is why a new environment requires new controls.To counter the unpredictable risks that have emerged during the volatile COVID-19 crisis, in this work, we propose a model based on social control theory, formal control, and general deterrence theory. We collected data from 207 experienced employees working in different telecommuting environments. The survey data confirmed the importance of specification and mandatoriness of policies in developing an effective information security policy for corporations: specification is to describe clearly and definitely security polices and mandatoriness is the degree to which individuals comply with security policies. As it was important to specify well security policy in mandatoriness in previous research, we also tried to find out the relation with specification and mandatoriness in telecommuting.


## 2. Materials and Methods

### 2.1. Literature Review

Numerous studies have been conducted on the factors affecting the effectiveness or implementation of security policies. We have taken a careful note of these studies, which utilized social control theory, formal control, and general deterrence theory, and built upon them to upgrade the security level and prevent information security breach from unknown cyber threats such as hacking and cyberterrorism within an organization.Social control theory proposes that the effectiveness of a security policy is influenced by the following four factors: attachment, involvement, belief, and commitment [9]. Attachment is the close relationship with others at work. Involvement is the time and energy that employees invest in company activities. Belief is the degree to which workers think that taking certain behaviors is morally correct. Commitment is the employee’s recognition of and devotion to one’s role in company. According to formal control and general deterrence, a fear of punishment induces criminal deterrence, which can serve as an important strategy in cybersecurity [10]. In general, it has been shown that strict security control and a fear of punishment encourage employees to abide by security policies. In particular, D’Arcy and Devaraj [11] suggest that employee awareness plays a critical role in security control.Lemay et al. [12] said that recent research studies about information security were concentrating on stimulating protective behaviors in users of information technology. According to Hsu et al. [9], extrarole behaviors and social control (i.e., social bonds) are mandatory to optimize the security policies of an organization. Moreover, it is necessary to encourage employees to follow security policies [9, 13–16]. Given that there are numerous examples of conflicts among members of an organization concerning in-role behaviors in the lack of organizational extrarole behaviors, we agree in part that Hsu et al. [9] emphasize the necessity of extrarole behaviors and social control for an effective information security policy.Social controls that induce the fear of punishment play a decisive role in reducing the chances of information leakage according to general deterrence theory [8]. Moreover, user awareness regarding security policies, security education, training, and awareness (SETA) programs, and computer monitoring is likely to decrease the misuse of information systems, and the severity of sanctions outweighs the certainty of sanctions [8]. In addition, security education programs that provide employees with more information on security have been shown to have a positive impact on the effectiveness of security policies [10]. The best policy for users is to be aware and take the necessary precautions to maximize the effectiveness of a security policy [17].However, one of the studies found that formal control did not affect the effectiveness of security policies. For example, the survey conducted by Wiant [18] on 140 information system managers revealed that the strategic application of a security policy is independent of the volume of security incidents or the reduction in accident severity. Moreover, Lee et al. [10] found that security policies and security systems do not have any influence on computer misuse.As shown in Table1, the aforementioned studies mainly focused on the security concerns arising in a limited office environment with the aim of preventing illegal behaviors and implementing security policies. However, our study takes a different approach to determine how the COVID-19 pandemic changes the implementation of security policies under exceptional circumstances, such as telecommuting environments.Table 1
Factors’ comparison.
FactorsHsu et al. [9]Social control and extrarole behaviorsD’Arcy and Devaraj [11]Certainty and severity of sanctionsD’Arcy et al. [8]Severity of sanctions, SETA, and computer monitoringLee et al. [10]Induction control intention, involvement, and belief


### 2.2. Research Model

As shown in Figure1, the aim of our research model was to study the effects of both mandatoriness and extrarole behaviors on the effectiveness of telecommuting security policies. In addition, mandatoriness and extrarole behaviors were hypothesized to be influenced by formal control, formal sanction, and informal sanction.Figure 1
Research model.In the following sections, we discuss the model constructs and the underlying hypotheses in detail.


#### 2.2.1. Effect of Formal Control on Telecommuting Security Policies

Corporations tend to reinforce the desired security behaviors in their employees to achieve their security goals [13, 19, 20] by sending signals that make their employees feel obliged to implement the necessary controls. It has been shown that specifying the desired behaviors and corresponding outcomes is crucial for the implementation of controls [13, 19–21]. A security policy is a proposition regarding how the employees of an organization should conduct themselves and what are the consequences of their behaviors. A well-designed security policy is the first step toward outlining the core employee behaviors necessary to achieve the desired outcomes and a clear direction to enforce these behaviors [13]. Therefore, we hypothesize the following:H1a: security policy specification affects positively the perceived mandatoriness in telecommuting environmentsH1b: security policy specification affects positively extrarole behaviors (e.g., helping and voice) in telecommuting environmentsRecalling the old saying in business, “Measurement leads to improvement,” simply establishing policies and posting on office bulletin boards are not sufficient to effectively enforce the desired behaviors in employees [13, 22, 23]. Monitoring is a useful method that confirms the observance of security policies and is a way for the management to make their presence felt [13, 24]. It also provides a means to surveil the employee system logs. Moreover, if there is no compliance monitoring, then the employees tend to overlook the security policies. Therefore, monitoring has a positive ripple effect on employee awareness and it conveys the importance of security policy compliance as well. On this basis, we hypothesized the following:H2a: monitoring security policy compliance affects positively the perceived mandatoriness in telecommuting environmentsH2b: monitoring security policy compliance affects positively extrarole behaviors in telecommuting environmentsIt is natural that employees expect a reward for observing corporate security policies [13, 25]. Rewards, along with policy specification and compliance monitoring, encourage employees to conform to the security policies as well as to reinforce their behaviors [13, 26]. In short, when there is no reward for complying with the regulations, there is no motivation for the employees to continue to do so. Therefore, we hypothesized the following:H3a: rewards for security policy compliance affect positively the perceived mandatoriness in telecommuting environmentsH3b: rewards for security policy compliance affect positively extrarole behaviors (e.g., helping and voice) in telecommuting environments


#### 2.2.2. Effect of Formal Sanctions on Telecommuting Security Policies

The underlying concept of deterrence theory is that the threat of punishment will deter corporate members from engaging in illegal behavior. In an organization, punishment and disciplinary action against employees are the main tools to keep the corporate ship afloat [11, 27]. Several studies on perceived-deterrence theory have shown that the severity and gravity of the imposed sanctions increase the effectivity of security policies [11, 27, 28]. Our study examined the levels of association in the effects of sanctions and security policies under telecommuting environments. Based on the preceding discussion, we hypothesized the following:H4a: severity of formal sanctions affects positively the perceived mandatoriness in telecommuting environmentsH4b: severity of formal sanctions affects positively extrarole behaviors in telecommuting environmentsH5a: certainty of formal sanctions affects positively the perceived mandatoriness in telecommuting environmentsH5b: certainty of formal sanctions affects positively extrarole behaviors in telecommuting environments


#### 2.2.3. Effect of Informal Sanctions on Telecommuting Security Policies

Deterrence studies have shown that perceived criticism from friends, family, or work colleagues influences the decision-making behavior of employees [11, 28, 29]. From a deterrence perspective, informal sanctions have an effect similar to formal sanctions regarding the costs to be paid by the violator [11, 29]. Thus, we propose the following hypotheses:H6a: moral beliefs affect positively the perceived mandatoriness in telecommuting environmentsH6b: moral beliefs affect positively extrarole behaviors (e.g., helping and voice) in telecommuting environments


#### 2.2.4. Effect of Mandatoriness and Extrarole Behaviors on Telecommuting Security Policies

The objective of security policies is to improve corporate security protocols. However, there is a gap between the individual understanding of security policies and the level of observance depending on the type of method used [13, 30]. One of the studies showed that only 60% of the employees in an organization adopted the Internet usage policy at face value and there exists a reasonable suspicion among employees regarding the significance of security policies [13, 22]. The most compelling force that encourages employees to comply with corporate security policies is management expectations [13, 31]. Hence, management expectations play a critical role in enhancing security policies in telecommuting. Therefore, we propose the following hypothesis:H7: perceived mandatoriness affects positively the effectiveness of telecommuting security policiesAlthough most employees follow corporate security policies, it is likely that some would fail to comply with a specific set of security requirements owing to their poor security awareness, incompetence, irresponsibility, or low self-efficacy. Thus, it is important that employees help each other abide by corporate security policies; otherwise, the weak links in the organization could undermine the overall security policy [9]. Without the cooperation of employees, corporate security policies are far from reality [9, 15]. Moreover, chances are that the lack of engagement with extrarole behaviors could weaken the effectivity of security policies in telecommuting. It has been proposed that employees should be engaged in a positive manner to prevent each other from doing something wrong to enhance the effectivity of security policies. Therefore, we propose the following hypothesis:H8: extrarole behaviors affect positively the effectiveness of telecommuting security policies


### 2.3. Research Methods

#### 2.3.1. Study Design and Data Collection

Given the unprecedented global situation owing to the COVID-19 pandemic, distinct datasets from various organizations in Korea who encouraged their employees to telecommute were used to test our model. We conducted a survey with 207 employees who telecommuted during the pandemic. Table2 provides the detailed demographic information of the respondents.Table 2
Demographic information of respondents.
Survey participants (N = 207)n%GenderMale16680.2Female4019.3Missing10.5Age26–302713.031–353215.536–405024.241 and over9746.9Missing10.5Tenure (years)1–33516.94–62210.57–102813.510 and over12158.5Missing10.5PositionManagerial31.4Technical14771.0Professional staff2512.1Administrative3115.0Missing10.5DepartmentSecurity6631.9Others14166.2Missing41.9Industry typeManufacturing10.5IT8239.6Finance10550.7Others188.7Missing10.5Company sizeLess than 100146.8100–4996430.9500–99962.91000–50006732.45000–999962.9More than 99993516.9Missing21.0


#### 2.3.2. Constructs and Measurement

The effectiveness of telecommuting security policies during the COVID-19 pandemic was evaluated using five items adapted from Hsu et al. [9] and Knapp [32]. Mandatoriness was assessed using four items adapted from Boss et al. [13], while extrarole behaviors were assessed using six items adapted from Hsu et al. [9]. Security policy specification was evaluated to measure how specifically the policies were defined using nine items adapted from Hsu et al. [9], Boss et al. [13], and D’Arcy et al. [8]. Reward was assessed to measure the degree of compensation allotted to the employees for complying with security policies using four items adapted from Hsu et al. [9] and Boss et al. [13]. The severity and certainty of the sanctions were evaluated using five and six items, respectively, adapted from D’Arcy and Devaraj [11]. Moral belief was assessed using five items adapted from D’Arcy and Devaraj [11] (Table 3).Table 3
Survey scale items adapted to telecommuting.
Measurement variablesItemItems on effectiveness of telecommuting security policies adapted from Hsu et al. [9] and Knapp [32]Policy effectiveness 01In general, information in the organization is sufficiently protected while telecommuting.Policy effectiveness 02Overall, the telecommuting information security policy is effective.Policy effectiveness 03The telecommuting information security policy achieves most of its goals.Policy effectiveness 04The telecommuting information security policy accomplishes its most important objectives.Policy effectiveness 05The telecommuting information security policy has kept security losses to a minimum.Items on mandatoriness adapted from Boss et al. [13]Mandatoriness 01I am required to secure my system according to the organization’s documented policies and procedures while telecommuting.Mandatoriness 02It is expected that I will take an active role in securing my computer from cyberattacks (e.g., hacking, virus infection, and data corruption) while telecommuting.Mandatoriness 03There is an understanding that I will comply with the organizational security policies and procedures regarding telecommuting.Mandatoriness 04Regulatory compliance requirements (e.g., FERPA, HIPAA, and Sarbanes–Oxley) motivate me to follow the organization’s IT security policies, procedures, and guidelines regarding telecommuting to the best of my ability.Items on specification adapted from Hsu et al. [9], Boss et al. [13], and D’Arcy et al. [8]Specification 01There are written rules on the security policies and procedures followed by the organization regarding telecommuting.Specification 02I am familiar with the organization’s IT security policies, procedures, and guidelines for telecommuting.Specification 03The organization’s existing policies and guidelines cover how to protect my computer system while telecommuting.Specification 04I am required to know many written procedures and general practices to secure my computer system while telecommuting.Specification 05My organization has specific guidelines regarding the acceptable use of e-mail while telecommuting.Specification 06My organization has established rules regarding the use of computer resources while telecommuting.Specification 07My organization has a formal policy that forbids employees from accessing computer systems that they are not authorized to use while telecommuting.Specification 08My organization has specific guidelines regarding the acceptable use of computer passwords while telecommuting.Specification 09My organization has specific guidelines that outline what employees can do with their computers while telecommuting.Items on monitoring adapted from D’Arcy et al. [8]Monitoring 01I believe that my organization monitors any modification or alteration of computerized data while telecommuting.Monitoring 02I believe that the computing activities of telecommuting employees are monitored by my organization.Monitoring 03I believe that my organization monitors computing activities to ensure that employees perform only explicitly authorized tasks while telecommuting.Monitoring 04I believe that my organization regularly reviews the system logs of telecommuting employees.Monitoring 05I believe that my organization conducts periodic audits to detect the use of unauthorized software on its computers.Monitoring 06I believe that my organization actively monitors the content of e-mail messages exchanged by telecommuting employees.Items on reward adapted from Hsu et al. [9] and Boss et al. [13]Reward 01I will receive a personal mention in oral or written reports if I comply with the security policies and procedures at this organization while telecommuting.Reward 02I will be given monetary or nonmonetary rewards for following security policies and procedures while telecommuting.Reward 03Tangible rewards depend on whether I follow the organization’s IT security policies, procedures, and guidelines while telecommuting.Reward 04My pay raise and/or promotion depend on whether I follow the documented security policies and procedures while telecommuting.Items on extrarole behavior adapted from Hsu et al. [9]Extrarole 01Employees of this department volunteer to engage in security policy-related behaviors while telecommuting.Extrarole 02Employees of this department help each other to learn about the telecommuting security policies.Extrarole 03Employees of this department help orient new employees to the telecommuting security policies.Extrarole 04Employees of this department develop and make recommendations concerning telecommuting information security policies that affect the entire organization.Extrarole 05Employees of this department speak up and encourage others in the organization to become more involved in telecommuting information security policies that affect the entire organization.Extrarole 06Employees of this department voice their opinion about new strategies or changes made to the telecommuting information security policies.Items on perceived severity adapted from D’Arcy and Devaraj [11]Perceived severity 01Severe responsibilities should be taken for accessing personnel systems using administrator passwords while telecommuting.Perceived severity 02Accessing unauthorized systems while telecommuting will result in disciplinary action.Perceived severity 03Severe responsibilities should be taken for revising personal overtime records using administrator passwords while telecommuting.Perceived severity 04Severe responsibilities should be taken for installing unauthorized software on corporate computers while telecommuting.Perceived severity 05Severe responsibilities should be taken for sending inappropriate emails to colleagues from the corporate email account while telecommuting.Items on perceived certainty adapted from D’Arcy and Devaraj [11]Perceived certainty 01Accessing personnel systems using administrator passwords while telecommuting will be discovered.Perceived certainty 02It is likely that companies will detect the employees who access unauthorized systems while telecommuting.Perceived certainty 03Revising personal overtime records using administrator passwords while telecommuting will be discovered.Perceived certainty 04Installing unauthorized software on corporate computers while telecommuting will be discovered.Perceived certainty 05It is likely that companies will detect the employees who install unauthorized software on corporate computers while telecommuting.Perceived certainty 06Sending inappropriate emails to colleagues from the corporate email account while telecommuting will be discovered.Items on moral belief adapted from D’Arcy and Devaraj [11]Moral belief 01If the password to a system that contains the payroll information of all employees is known, then it is morally permissible to access the system while telecommuting.Moral belief 02It is morally permissible to revise personal overtime records using administrator passwords while telecommuting.Moral belief 03It is morally permissible to install unauthorized software on corporate computers while telecommuting.Moral belief 04It is morally permissible to send inappropriate emails to colleagues from the corporate email account while telecommuting.


#### 2.3.3. Validity and Reliability

As shown in Table4, a confirmatory factor analysis was conducted to test the unidimensionality of the measurements. A set of measured values, such as CMIN (Minimum Chi-square), DF (Degree of Freedom), p, RMR (Root-Mean-Square Residual), GFI (Goodness-of-Fit Index), AGFI (Adjusted Goodness-of-Fit Index), CFI (Comparative Fit Index), NFI (Normed Fit Index), and RMSEA (Root Mean Square Error of Approximation), was used to assess the fit of the model to the data. To get the optimal value of reliability, problematic items with squared multiple correlation (SMC) values less than 0.4 in the initial question were dropped, and the process was repeated until the desired result was achieved.Table 4
Measurement validity and reliability.
ConstructsAttemptsNumbersCMINDFpRMRGFIAGFICFINFIRMSEAEffectivenessFirst527.6675p≤0.0010.0230.9530.8580.9820.9780.148Final44.05020.1320.0080.9900.9520.9980.9960.071MandatorinessFirst45.76920.0560.0210.9860.9320.9930.9890.096Final45.76920.0560.0210.9860.9320.9930.9890.096SpecificationFirst9155.65527p≤0.0010.0860.8560.7610.9230.9090.152Final510.91250.0530.0230.9800.9410.9930.9880.076MonitoringFirst639.0079p≤0.0010.0730.9380.8550.9720.9650.127Final510.84850.0540.0420.9810.9420.9930.9870.075RewardFirst422.9792p≤0.0010.0930.9440.7220.9740.9720.226Final422.9792p≤0.0010.0930.9440.7220.9740.9720.226Perceived severityFirst559.9165p≤0.0010.1180.9010.7040.9370.9320.231Final42.37620.3050.0240.9940.9710.9990.9960.030Perceived certaintyFirst6135.8609p≤0.0010.0910.8120.5610.8870.8800.262Final45.65520.0590.0300.9870.9360.9940.9910.094Moral beliefFirst446.9142p≤0.0010.0430.9190.5960.9580.9570.330Final446.9142p≤0.0010.0430.9190.5960.9580.9570.330ExtraroleFirst6101.5149p≤0.0010.1200.8460.6400.9270.9210.223Final40.10220.9500.0031.0000.9991.0001.0000.000Our measurement model was analyzed based on the aforementioned confirmatory factor analysis, and the results are presented in Table5. After optimizing the adequacy of the survey questions based on the SMC values, our data yielded the following results: CMIN = 141.727, DF = 99, p=0.003, GFI = 0.934, AGFI = 0.886, CFI = 0.987, RMR = 0.046, NFI = 0.959, IFI = 0.987, and RMESA = 0.046. The value of p was found to be negative. However, the fit can be considered to be acceptable because the values of GFI, AGFI, CFI, NFI, and IFI were greater than 0.9 (note that AGFI was larger than 0.85), the value of RMR was less than 0.05, and the value of RMSEA was less than 0.1. As seen from Table 5, Cronbach’s alpha was greater than 0.7 (i.e., between 0.883 and 0.949), which indicates that the items have high internal consistency.Table 5
Analysis of the measurement model.
ConstructsM.V.aR.W.bS.R.W.cS.E.dC.R.eM.E.fSMCgC.A.hEffectivenesspe11.0000.8860.2990.7850.904pe41.0040.9320.05418.6930.1650.869Mandatorinessma21.0000.6790.6850.4610.809ma41.1820.8280.09612.3190.3760.685Specificationsp41.0000.9180.2530.8420.883sp61.0290.8680.05718.1650.4660.754Monitoringmo21.0000.8820.5940.7770.912mo31.1260.9510.07415.2800.2750.905Rewardre31.0000.9540.3550.9100.930re40.9380.9100.05218.1360.6590.828Perceived severityps21.0000.9570.1480.9170.935ps30.9350.9170.04719.7542690.841Perceived certaintypc11.0000.8870.3360.7870.907pc31.0880.9360.06117.7190.2100.875Moral beliefmb11.0000.9830.0990.9660.949mb20.8720.9220.06812.7510.3740.849Extraroleex41.0000.9330.3970.8710.943ex50.9950.9560.04621.7290.2500.914aMeasured variables; bregression weight; cstandard regression weight; dstandard error; ecritical ratio; fmeasurement errors; gsquared multiple correlations; and hCronbach’s alpha.As shown in Table6, a reliability analysis was performed using two tests: convergent validity and discriminant validity. Construct reliability was used to assess the convergent validity [33], and the average variance extracted (AVE) was used to assess the discriminant validity [34]. The construct reliability values obtained were greater than 0.7, which establishes convergent validity. Moreover, the AVE of all constructs was found to be greater than the square root of the largest correlation coefficient (which is 0.621 in this case), which establishes discriminant validity according to the criterion of Fornell and Larcker [34].Table 6
Validation of the measurement model.
Constructs123456789(1) Effectiveness1.00(2) Mandatoriness0.7081.00(3) Specification0.7880.7161.00(4) Monitoring0.4940.4720.5161.00(5) Perceived severity0.4450.5530.5360.4801.00(6) Moral belief–0.055–0.1–0.012–0.008–0.1221.00(7) Perceived certainty0.5450.5960.6460.4590.663–0.1031.00(8) Reward0.2750.2010.3020.3430.2690.3220.2101.00(9) Extrarole0.4690.4090.5370.4870.4160.0840.3800.5921.00Construct reliability0.9230.9550.8140.7980.8940.8850.8590.7750.847AVEa0.7810.6430.9360.6630.8080.7930.7520.6340.734aAverage variance extracted.


## 2.1. Literature Review

Numerous studies have been conducted on the factors affecting the effectiveness or implementation of security policies. We have taken a careful note of these studies, which utilized social control theory, formal control, and general deterrence theory, and built upon them to upgrade the security level and prevent information security breach from unknown cyber threats such as hacking and cyberterrorism within an organization.Social control theory proposes that the effectiveness of a security policy is influenced by the following four factors: attachment, involvement, belief, and commitment [9]. Attachment is the close relationship with others at work. Involvement is the time and energy that employees invest in company activities. Belief is the degree to which workers think that taking certain behaviors is morally correct. Commitment is the employee’s recognition of and devotion to one’s role in company. According to formal control and general deterrence, a fear of punishment induces criminal deterrence, which can serve as an important strategy in cybersecurity [10]. In general, it has been shown that strict security control and a fear of punishment encourage employees to abide by security policies. In particular, D’Arcy and Devaraj [11] suggest that employee awareness plays a critical role in security control.Lemay et al. [12] said that recent research studies about information security were concentrating on stimulating protective behaviors in users of information technology. According to Hsu et al. [9], extrarole behaviors and social control (i.e., social bonds) are mandatory to optimize the security policies of an organization. Moreover, it is necessary to encourage employees to follow security policies [9, 13–16]. Given that there are numerous examples of conflicts among members of an organization concerning in-role behaviors in the lack of organizational extrarole behaviors, we agree in part that Hsu et al. [9] emphasize the necessity of extrarole behaviors and social control for an effective information security policy.Social controls that induce the fear of punishment play a decisive role in reducing the chances of information leakage according to general deterrence theory [8]. Moreover, user awareness regarding security policies, security education, training, and awareness (SETA) programs, and computer monitoring is likely to decrease the misuse of information systems, and the severity of sanctions outweighs the certainty of sanctions [8]. In addition, security education programs that provide employees with more information on security have been shown to have a positive impact on the effectiveness of security policies [10]. The best policy for users is to be aware and take the necessary precautions to maximize the effectiveness of a security policy [17].However, one of the studies found that formal control did not affect the effectiveness of security policies. For example, the survey conducted by Wiant [18] on 140 information system managers revealed that the strategic application of a security policy is independent of the volume of security incidents or the reduction in accident severity. Moreover, Lee et al. [10] found that security policies and security systems do not have any influence on computer misuse.As shown in Table1, the aforementioned studies mainly focused on the security concerns arising in a limited office environment with the aim of preventing illegal behaviors and implementing security policies. However, our study takes a different approach to determine how the COVID-19 pandemic changes the implementation of security policies under exceptional circumstances, such as telecommuting environments.Table 1
Factors’ comparison.
FactorsHsu et al. [9]Social control and extrarole behaviorsD’Arcy and Devaraj [11]Certainty and severity of sanctionsD’Arcy et al. [8]Severity of sanctions, SETA, and computer monitoringLee et al. [10]Induction control intention, involvement, and belief


## 2.2. Research Model

As shown in Figure1, the aim of our research model was to study the effects of both mandatoriness and extrarole behaviors on the effectiveness of telecommuting security policies. In addition, mandatoriness and extrarole behaviors were hypothesized to be influenced by formal control, formal sanction, and informal sanction.Figure 1
Research model.In the following sections, we discuss the model constructs and the underlying hypotheses in detail.


### 2.2.1. Effect of Formal Control on Telecommuting Security Policies

Corporations tend to reinforce the desired security behaviors in their employees to achieve their security goals [13, 19, 20] by sending signals that make their employees feel obliged to implement the necessary controls. It has been shown that specifying the desired behaviors and corresponding outcomes is crucial for the implementation of controls [13, 19–21]. A security policy is a proposition regarding how the employees of an organization should conduct themselves and what are the consequences of their behaviors. A well-designed security policy is the first step toward outlining the core employee behaviors necessary to achieve the desired outcomes and a clear direction to enforce these behaviors [13]. Therefore, we hypothesize the following:H1a: security policy specification affects positively the perceived mandatoriness in telecommuting environmentsH1b: security policy specification affects positively extrarole behaviors (e.g., helping and voice) in telecommuting environmentsRecalling the old saying in business, “Measurement leads to improvement,” simply establishing policies and posting on office bulletin boards are not sufficient to effectively enforce the desired behaviors in employees [13, 22, 23]. Monitoring is a useful method that confirms the observance of security policies and is a way for the management to make their presence felt [13, 24]. It also provides a means to surveil the employee system logs. Moreover, if there is no compliance monitoring, then the employees tend to overlook the security policies. Therefore, monitoring has a positive ripple effect on employee awareness and it conveys the importance of security policy compliance as well. On this basis, we hypothesized the following:H2a: monitoring security policy compliance affects positively the perceived mandatoriness in telecommuting environmentsH2b: monitoring security policy compliance affects positively extrarole behaviors in telecommuting environmentsIt is natural that employees expect a reward for observing corporate security policies [13, 25]. Rewards, along with policy specification and compliance monitoring, encourage employees to conform to the security policies as well as to reinforce their behaviors [13, 26]. In short, when there is no reward for complying with the regulations, there is no motivation for the employees to continue to do so. Therefore, we hypothesized the following:H3a: rewards for security policy compliance affect positively the perceived mandatoriness in telecommuting environmentsH3b: rewards for security policy compliance affect positively extrarole behaviors (e.g., helping and voice) in telecommuting environments


### 2.2.2. Effect of Formal Sanctions on Telecommuting Security Policies

The underlying concept of deterrence theory is that the threat of punishment will deter corporate members from engaging in illegal behavior. In an organization, punishment and disciplinary action against employees are the main tools to keep the corporate ship afloat [11, 27]. Several studies on perceived-deterrence theory have shown that the severity and gravity of the imposed sanctions increase the effectivity of security policies [11, 27, 28]. Our study examined the levels of association in the effects of sanctions and security policies under telecommuting environments. Based on the preceding discussion, we hypothesized the following:H4a: severity of formal sanctions affects positively the perceived mandatoriness in telecommuting environmentsH4b: severity of formal sanctions affects positively extrarole behaviors in telecommuting environmentsH5a: certainty of formal sanctions affects positively the perceived mandatoriness in telecommuting environmentsH5b: certainty of formal sanctions affects positively extrarole behaviors in telecommuting environments


### 2.2.3. Effect of Informal Sanctions on Telecommuting Security Policies

Deterrence studies have shown that perceived criticism from friends, family, or work colleagues influences the decision-making behavior of employees [11, 28, 29]. From a deterrence perspective, informal sanctions have an effect similar to formal sanctions regarding the costs to be paid by the violator [11, 29]. Thus, we propose the following hypotheses:H6a: moral beliefs affect positively the perceived mandatoriness in telecommuting environmentsH6b: moral beliefs affect positively extrarole behaviors (e.g., helping and voice) in telecommuting environments


### 2.2.4. Effect of Mandatoriness and Extrarole Behaviors on Telecommuting Security Policies

The objective of security policies is to improve corporate security protocols. However, there is a gap between the individual understanding of security policies and the level of observance depending on the type of method used [13, 30]. One of the studies showed that only 60% of the employees in an organization adopted the Internet usage policy at face value and there exists a reasonable suspicion among employees regarding the significance of security policies [13, 22]. The most compelling force that encourages employees to comply with corporate security policies is management expectations [13, 31]. Hence, management expectations play a critical role in enhancing security policies in telecommuting. Therefore, we propose the following hypothesis:H7: perceived mandatoriness affects positively the effectiveness of telecommuting security policiesAlthough most employees follow corporate security policies, it is likely that some would fail to comply with a specific set of security requirements owing to their poor security awareness, incompetence, irresponsibility, or low self-efficacy. Thus, it is important that employees help each other abide by corporate security policies; otherwise, the weak links in the organization could undermine the overall security policy [9]. Without the cooperation of employees, corporate security policies are far from reality [9, 15]. Moreover, chances are that the lack of engagement with extrarole behaviors could weaken the effectivity of security policies in telecommuting. It has been proposed that employees should be engaged in a positive manner to prevent each other from doing something wrong to enhance the effectivity of security policies. Therefore, we propose the following hypothesis:H8: extrarole behaviors affect positively the effectiveness of telecommuting security policies


## 2.2.1. Effect of Formal Control on Telecommuting Security Policies

Corporations tend to reinforce the desired security behaviors in their employees to achieve their security goals [13, 19, 20] by sending signals that make their employees feel obliged to implement the necessary controls. It has been shown that specifying the desired behaviors and corresponding outcomes is crucial for the implementation of controls [13, 19–21]. A security policy is a proposition regarding how the employees of an organization should conduct themselves and what are the consequences of their behaviors. A well-designed security policy is the first step toward outlining the core employee behaviors necessary to achieve the desired outcomes and a clear direction to enforce these behaviors [13]. Therefore, we hypothesize the following:H1a: security policy specification affects positively the perceived mandatoriness in telecommuting environmentsH1b: security policy specification affects positively extrarole behaviors (e.g., helping and voice) in telecommuting environmentsRecalling the old saying in business, “Measurement leads to improvement,” simply establishing policies and posting on office bulletin boards are not sufficient to effectively enforce the desired behaviors in employees [13, 22, 23]. Monitoring is a useful method that confirms the observance of security policies and is a way for the management to make their presence felt [13, 24]. It also provides a means to surveil the employee system logs. Moreover, if there is no compliance monitoring, then the employees tend to overlook the security policies. Therefore, monitoring has a positive ripple effect on employee awareness and it conveys the importance of security policy compliance as well. On this basis, we hypothesized the following:H2a: monitoring security policy compliance affects positively the perceived mandatoriness in telecommuting environmentsH2b: monitoring security policy compliance affects positively extrarole behaviors in telecommuting environmentsIt is natural that employees expect a reward for observing corporate security policies [13, 25]. Rewards, along with policy specification and compliance monitoring, encourage employees to conform to the security policies as well as to reinforce their behaviors [13, 26]. In short, when there is no reward for complying with the regulations, there is no motivation for the employees to continue to do so. Therefore, we hypothesized the following:H3a: rewards for security policy compliance affect positively the perceived mandatoriness in telecommuting environmentsH3b: rewards for security policy compliance affect positively extrarole behaviors (e.g., helping and voice) in telecommuting environments


## 2.2.2. Effect of Formal Sanctions on Telecommuting Security Policies

The underlying concept of deterrence theory is that the threat of punishment will deter corporate members from engaging in illegal behavior. In an organization, punishment and disciplinary action against employees are the main tools to keep the corporate ship afloat [11, 27]. Several studies on perceived-deterrence theory have shown that the severity and gravity of the imposed sanctions increase the effectivity of security policies [11, 27, 28]. Our study examined the levels of association in the effects of sanctions and security policies under telecommuting environments. Based on the preceding discussion, we hypothesized the following:H4a: severity of formal sanctions affects positively the perceived mandatoriness in telecommuting environmentsH4b: severity of formal sanctions affects positively extrarole behaviors in telecommuting environmentsH5a: certainty of formal sanctions affects positively the perceived mandatoriness in telecommuting environmentsH5b: certainty of formal sanctions affects positively extrarole behaviors in telecommuting environments


## 2.2.3. Effect of Informal Sanctions on Telecommuting Security Policies

Deterrence studies have shown that perceived criticism from friends, family, or work colleagues influences the decision-making behavior of employees [11, 28, 29]. From a deterrence perspective, informal sanctions have an effect similar to formal sanctions regarding the costs to be paid by the violator [11, 29]. Thus, we propose the following hypotheses:H6a: moral beliefs affect positively the perceived mandatoriness in telecommuting environmentsH6b: moral beliefs affect positively extrarole behaviors (e.g., helping and voice) in telecommuting environments


## 2.2.4. Effect of Mandatoriness and Extrarole Behaviors on Telecommuting Security Policies

The objective of security policies is to improve corporate security protocols. However, there is a gap between the individual understanding of security policies and the level of observance depending on the type of method used [13, 30]. One of the studies showed that only 60% of the employees in an organization adopted the Internet usage policy at face value and there exists a reasonable suspicion among employees regarding the significance of security policies [13, 22]. The most compelling force that encourages employees to comply with corporate security policies is management expectations [13, 31]. Hence, management expectations play a critical role in enhancing security policies in telecommuting. Therefore, we propose the following hypothesis:H7: perceived mandatoriness affects positively the effectiveness of telecommuting security policiesAlthough most employees follow corporate security policies, it is likely that some would fail to comply with a specific set of security requirements owing to their poor security awareness, incompetence, irresponsibility, or low self-efficacy. Thus, it is important that employees help each other abide by corporate security policies; otherwise, the weak links in the organization could undermine the overall security policy [9]. Without the cooperation of employees, corporate security policies are far from reality [9, 15]. Moreover, chances are that the lack of engagement with extrarole behaviors could weaken the effectivity of security policies in telecommuting. It has been proposed that employees should be engaged in a positive manner to prevent each other from doing something wrong to enhance the effectivity of security policies. Therefore, we propose the following hypothesis:H8: extrarole behaviors affect positively the effectiveness of telecommuting security policies


## 2.3. Research Methods

### 2.3.1. Study Design and Data Collection

Given the unprecedented global situation owing to the COVID-19 pandemic, distinct datasets from various organizations in Korea who encouraged their employees to telecommute were used to test our model. We conducted a survey with 207 employees who telecommuted during the pandemic. Table2 provides the detailed demographic information of the respondents.Table 2
Demographic information of respondents.
Survey participants (N = 207)n%GenderMale16680.2Female4019.3Missing10.5Age26–302713.031–353215.536–405024.241 and over9746.9Missing10.5Tenure (years)1–33516.94–62210.57–102813.510 and over12158.5Missing10.5PositionManagerial31.4Technical14771.0Professional staff2512.1Administrative3115.0Missing10.5DepartmentSecurity6631.9Others14166.2Missing41.9Industry typeManufacturing10.5IT8239.6Finance10550.7Others188.7Missing10.5Company sizeLess than 100146.8100–4996430.9500–99962.91000–50006732.45000–999962.9More than 99993516.9Missing21.0


### 2.3.2. Constructs and Measurement

The effectiveness of telecommuting security policies during the COVID-19 pandemic was evaluated using five items adapted from Hsu et al. [9] and Knapp [32]. Mandatoriness was assessed using four items adapted from Boss et al. [13], while extrarole behaviors were assessed using six items adapted from Hsu et al. [9]. Security policy specification was evaluated to measure how specifically the policies were defined using nine items adapted from Hsu et al. [9], Boss et al. [13], and D’Arcy et al. [8]. Reward was assessed to measure the degree of compensation allotted to the employees for complying with security policies using four items adapted from Hsu et al. [9] and Boss et al. [13]. The severity and certainty of the sanctions were evaluated using five and six items, respectively, adapted from D’Arcy and Devaraj [11]. Moral belief was assessed using five items adapted from D’Arcy and Devaraj [11] (Table 3).Table 3
Survey scale items adapted to telecommuting.
Measurement variablesItemItems on effectiveness of telecommuting security policies adapted from Hsu et al. [9] and Knapp [32]Policy effectiveness 01In general, information in the organization is sufficiently protected while telecommuting.Policy effectiveness 02Overall, the telecommuting information security policy is effective.Policy effectiveness 03The telecommuting information security policy achieves most of its goals.Policy effectiveness 04The telecommuting information security policy accomplishes its most important objectives.Policy effectiveness 05The telecommuting information security policy has kept security losses to a minimum.Items on mandatoriness adapted from Boss et al. [13]Mandatoriness 01I am required to secure my system according to the organization’s documented policies and procedures while telecommuting.Mandatoriness 02It is expected that I will take an active role in securing my computer from cyberattacks (e.g., hacking, virus infection, and data corruption) while telecommuting.Mandatoriness 03There is an understanding that I will comply with the organizational security policies and procedures regarding telecommuting.Mandatoriness 04Regulatory compliance requirements (e.g., FERPA, HIPAA, and Sarbanes–Oxley) motivate me to follow the organization’s IT security policies, procedures, and guidelines regarding telecommuting to the best of my ability.Items on specification adapted from Hsu et al. [9], Boss et al. [13], and D’Arcy et al. [8]Specification 01There are written rules on the security policies and procedures followed by the organization regarding telecommuting.Specification 02I am familiar with the organization’s IT security policies, procedures, and guidelines for telecommuting.Specification 03The organization’s existing policies and guidelines cover how to protect my computer system while telecommuting.Specification 04I am required to know many written procedures and general practices to secure my computer system while telecommuting.Specification 05My organization has specific guidelines regarding the acceptable use of e-mail while telecommuting.Specification 06My organization has established rules regarding the use of computer resources while telecommuting.Specification 07My organization has a formal policy that forbids employees from accessing computer systems that they are not authorized to use while telecommuting.Specification 08My organization has specific guidelines regarding the acceptable use of computer passwords while telecommuting.Specification 09My organization has specific guidelines that outline what employees can do with their computers while telecommuting.Items on monitoring adapted from D’Arcy et al. [8]Monitoring 01I believe that my organization monitors any modification or alteration of computerized data while telecommuting.Monitoring 02I believe that the computing activities of telecommuting employees are monitored by my organization.Monitoring 03I believe that my organization monitors computing activities to ensure that employees perform only explicitly authorized tasks while telecommuting.Monitoring 04I believe that my organization regularly reviews the system logs of telecommuting employees.Monitoring 05I believe that my organization conducts periodic audits to detect the use of unauthorized software on its computers.Monitoring 06I believe that my organization actively monitors the content of e-mail messages exchanged by telecommuting employees.Items on reward adapted from Hsu et al. [9] and Boss et al. [13]Reward 01I will receive a personal mention in oral or written reports if I comply with the security policies and procedures at this organization while telecommuting.Reward 02I will be given monetary or nonmonetary rewards for following security policies and procedures while telecommuting.Reward 03Tangible rewards depend on whether I follow the organization’s IT security policies, procedures, and guidelines while telecommuting.Reward 04My pay raise and/or promotion depend on whether I follow the documented security policies and procedures while telecommuting.Items on extrarole behavior adapted from Hsu et al. [9]Extrarole 01Employees of this department volunteer to engage in security policy-related behaviors while telecommuting.Extrarole 02Employees of this department help each other to learn about the telecommuting security policies.Extrarole 03Employees of this department help orient new employees to the telecommuting security policies.Extrarole 04Employees of this department develop and make recommendations concerning telecommuting information security policies that affect the entire organization.Extrarole 05Employees of this department speak up and encourage others in the organization to become more involved in telecommuting information security policies that affect the entire organization.Extrarole 06Employees of this department voice their opinion about new strategies or changes made to the telecommuting information security policies.Items on perceived severity adapted from D’Arcy and Devaraj [11]Perceived severity 01Severe responsibilities should be taken for accessing personnel systems using administrator passwords while telecommuting.Perceived severity 02Accessing unauthorized systems while telecommuting will result in disciplinary action.Perceived severity 03Severe responsibilities should be taken for revising personal overtime records using administrator passwords while telecommuting.Perceived severity 04Severe responsibilities should be taken for installing unauthorized software on corporate computers while telecommuting.Perceived severity 05Severe responsibilities should be taken for sending inappropriate emails to colleagues from the corporate email account while telecommuting.Items on perceived certainty adapted from D’Arcy and Devaraj [11]Perceived certainty 01Accessing personnel systems using administrator passwords while telecommuting will be discovered.Perceived certainty 02It is likely that companies will detect the employees who access unauthorized systems while telecommuting.Perceived certainty 03Revising personal overtime records using administrator passwords while telecommuting will be discovered.Perceived certainty 04Installing unauthorized software on corporate computers while telecommuting will be discovered.Perceived certainty 05It is likely that companies will detect the employees who install unauthorized software on corporate computers while telecommuting.Perceived certainty 06Sending inappropriate emails to colleagues from the corporate email account while telecommuting will be discovered.Items on moral belief adapted from D’Arcy and Devaraj [11]Moral belief 01If the password to a system that contains the payroll information of all employees is known, then it is morally permissible to access the system while telecommuting.Moral belief 02It is morally permissible to revise personal overtime records using administrator passwords while telecommuting.Moral belief 03It is morally permissible to install unauthorized software on corporate computers while telecommuting.Moral belief 04It is morally permissible to send inappropriate emails to colleagues from the corporate email account while telecommuting.


### 2.3.3. Validity and Reliability

As shown in Table4, a confirmatory factor analysis was conducted to test the unidimensionality of the measurements. A set of measured values, such as CMIN (Minimum Chi-square), DF (Degree of Freedom), p, RMR (Root-Mean-Square Residual), GFI (Goodness-of-Fit Index), AGFI (Adjusted Goodness-of-Fit Index), CFI (Comparative Fit Index), NFI (Normed Fit Index), and RMSEA (Root Mean Square Error of Approximation), was used to assess the fit of the model to the data. To get the optimal value of reliability, problematic items with squared multiple correlation (SMC) values less than 0.4 in the initial question were dropped, and the process was repeated until the desired result was achieved.Table 4
Measurement validity and reliability.
ConstructsAttemptsNumbersCMINDFpRMRGFIAGFICFINFIRMSEAEffectivenessFirst527.6675p≤0.0010.0230.9530.8580.9820.9780.148Final44.05020.1320.0080.9900.9520.9980.9960.071MandatorinessFirst45.76920.0560.0210.9860.9320.9930.9890.096Final45.76920.0560.0210.9860.9320.9930.9890.096SpecificationFirst9155.65527p≤0.0010.0860.8560.7610.9230.9090.152Final510.91250.0530.0230.9800.9410.9930.9880.076MonitoringFirst639.0079p≤0.0010.0730.9380.8550.9720.9650.127Final510.84850.0540.0420.9810.9420.9930.9870.075RewardFirst422.9792p≤0.0010.0930.9440.7220.9740.9720.226Final422.9792p≤0.0010.0930.9440.7220.9740.9720.226Perceived severityFirst559.9165p≤0.0010.1180.9010.7040.9370.9320.231Final42.37620.3050.0240.9940.9710.9990.9960.030Perceived certaintyFirst6135.8609p≤0.0010.0910.8120.5610.8870.8800.262Final45.65520.0590.0300.9870.9360.9940.9910.094Moral beliefFirst446.9142p≤0.0010.0430.9190.5960.9580.9570.330Final446.9142p≤0.0010.0430.9190.5960.9580.9570.330ExtraroleFirst6101.5149p≤0.0010.1200.8460.6400.9270.9210.223Final40.10220.9500.0031.0000.9991.0001.0000.000Our measurement model was analyzed based on the aforementioned confirmatory factor analysis, and the results are presented in Table5. After optimizing the adequacy of the survey questions based on the SMC values, our data yielded the following results: CMIN = 141.727, DF = 99, p=0.003, GFI = 0.934, AGFI = 0.886, CFI = 0.987, RMR = 0.046, NFI = 0.959, IFI = 0.987, and RMESA = 0.046. The value of p was found to be negative. However, the fit can be considered to be acceptable because the values of GFI, AGFI, CFI, NFI, and IFI were greater than 0.9 (note that AGFI was larger than 0.85), the value of RMR was less than 0.05, and the value of RMSEA was less than 0.1. As seen from Table 5, Cronbach’s alpha was greater than 0.7 (i.e., between 0.883 and 0.949), which indicates that the items have high internal consistency.Table 5
Analysis of the measurement model.
ConstructsM.V.aR.W.bS.R.W.cS.E.dC.R.eM.E.fSMCgC.A.hEffectivenesspe11.0000.8860.2990.7850.904pe41.0040.9320.05418.6930.1650.869Mandatorinessma21.0000.6790.6850.4610.809ma41.1820.8280.09612.3190.3760.685Specificationsp41.0000.9180.2530.8420.883sp61.0290.8680.05718.1650.4660.754Monitoringmo21.0000.8820.5940.7770.912mo31.1260.9510.07415.2800.2750.905Rewardre31.0000.9540.3550.9100.930re40.9380.9100.05218.1360.6590.828Perceived severityps21.0000.9570.1480.9170.935ps30.9350.9170.04719.7542690.841Perceived certaintypc11.0000.8870.3360.7870.907pc31.0880.9360.06117.7190.2100.875Moral beliefmb11.0000.9830.0990.9660.949mb20.8720.9220.06812.7510.3740.849Extraroleex41.0000.9330.3970.8710.943ex50.9950.9560.04621.7290.2500.914aMeasured variables; bregression weight; cstandard regression weight; dstandard error; ecritical ratio; fmeasurement errors; gsquared multiple correlations; and hCronbach’s alpha.As shown in Table6, a reliability analysis was performed using two tests: convergent validity and discriminant validity. Construct reliability was used to assess the convergent validity [33], and the average variance extracted (AVE) was used to assess the discriminant validity [34]. The construct reliability values obtained were greater than 0.7, which establishes convergent validity. Moreover, the AVE of all constructs was found to be greater than the square root of the largest correlation coefficient (which is 0.621 in this case), which establishes discriminant validity according to the criterion of Fornell and Larcker [34].Table 6
Validation of the measurement model.
Constructs123456789(1) Effectiveness1.00(2) Mandatoriness0.7081.00(3) Specification0.7880.7161.00(4) Monitoring0.4940.4720.5161.00(5) Perceived severity0.4450.5530.5360.4801.00(6) Moral belief–0.055–0.1–0.012–0.008–0.1221.00(7) Perceived certainty0.5450.5960.6460.4590.663–0.1031.00(8) Reward0.2750.2010.3020.3430.2690.3220.2101.00(9) Extrarole0.4690.4090.5370.4870.4160.0840.3800.5921.00Construct reliability0.9230.9550.8140.7980.8940.8850.8590.7750.847AVEa0.7810.6430.9360.6630.8080.7930.7520.6340.734aAverage variance extracted.


## 2.3.1. Study Design and Data Collection

Given the unprecedented global situation owing to the COVID-19 pandemic, distinct datasets from various organizations in Korea who encouraged their employees to telecommute were used to test our model. We conducted a survey with 207 employees who telecommuted during the pandemic. Table2 provides the detailed demographic information of the respondents.Table 2
Demographic information of respondents.
Survey participants (N = 207)n%GenderMale16680.2Female4019.3Missing10.5Age26–302713.031–353215.536–405024.241 and over9746.9Missing10.5Tenure (years)1–33516.94–62210.57–102813.510 and over12158.5Missing10.5PositionManagerial31.4Technical14771.0Professional staff2512.1Administrative3115.0Missing10.5DepartmentSecurity6631.9Others14166.2Missing41.9Industry typeManufacturing10.5IT8239.6Finance10550.7Others188.7Missing10.5Company sizeLess than 100146.8100–4996430.9500–99962.91000–50006732.45000–999962.9More than 99993516.9Missing21.0


## 2.3.2. Constructs and Measurement

The effectiveness of telecommuting security policies during the COVID-19 pandemic was evaluated using five items adapted from Hsu et al. [9] and Knapp [32]. Mandatoriness was assessed using four items adapted from Boss et al. [13], while extrarole behaviors were assessed using six items adapted from Hsu et al. [9]. Security policy specification was evaluated to measure how specifically the policies were defined using nine items adapted from Hsu et al. [9], Boss et al. [13], and D’Arcy et al. [8]. Reward was assessed to measure the degree of compensation allotted to the employees for complying with security policies using four items adapted from Hsu et al. [9] and Boss et al. [13]. The severity and certainty of the sanctions were evaluated using five and six items, respectively, adapted from D’Arcy and Devaraj [11]. Moral belief was assessed using five items adapted from D’Arcy and Devaraj [11] (Table 3).Table 3
Survey scale items adapted to telecommuting.
Measurement variablesItemItems on effectiveness of telecommuting security policies adapted from Hsu et al. [9] and Knapp [32]Policy effectiveness 01In general, information in the organization is sufficiently protected while telecommuting.Policy effectiveness 02Overall, the telecommuting information security policy is effective.Policy effectiveness 03The telecommuting information security policy achieves most of its goals.Policy effectiveness 04The telecommuting information security policy accomplishes its most important objectives.Policy effectiveness 05The telecommuting information security policy has kept security losses to a minimum.Items on mandatoriness adapted from Boss et al. [13]Mandatoriness 01I am required to secure my system according to the organization’s documented policies and procedures while telecommuting.Mandatoriness 02It is expected that I will take an active role in securing my computer from cyberattacks (e.g., hacking, virus infection, and data corruption) while telecommuting.Mandatoriness 03There is an understanding that I will comply with the organizational security policies and procedures regarding telecommuting.Mandatoriness 04Regulatory compliance requirements (e.g., FERPA, HIPAA, and Sarbanes–Oxley) motivate me to follow the organization’s IT security policies, procedures, and guidelines regarding telecommuting to the best of my ability.Items on specification adapted from Hsu et al. [9], Boss et al. [13], and D’Arcy et al. [8]Specification 01There are written rules on the security policies and procedures followed by the organization regarding telecommuting.Specification 02I am familiar with the organization’s IT security policies, procedures, and guidelines for telecommuting.Specification 03The organization’s existing policies and guidelines cover how to protect my computer system while telecommuting.Specification 04I am required to know many written procedures and general practices to secure my computer system while telecommuting.Specification 05My organization has specific guidelines regarding the acceptable use of e-mail while telecommuting.Specification 06My organization has established rules regarding the use of computer resources while telecommuting.Specification 07My organization has a formal policy that forbids employees from accessing computer systems that they are not authorized to use while telecommuting.Specification 08My organization has specific guidelines regarding the acceptable use of computer passwords while telecommuting.Specification 09My organization has specific guidelines that outline what employees can do with their computers while telecommuting.Items on monitoring adapted from D’Arcy et al. [8]Monitoring 01I believe that my organization monitors any modification or alteration of computerized data while telecommuting.Monitoring 02I believe that the computing activities of telecommuting employees are monitored by my organization.Monitoring 03I believe that my organization monitors computing activities to ensure that employees perform only explicitly authorized tasks while telecommuting.Monitoring 04I believe that my organization regularly reviews the system logs of telecommuting employees.Monitoring 05I believe that my organization conducts periodic audits to detect the use of unauthorized software on its computers.Monitoring 06I believe that my organization actively monitors the content of e-mail messages exchanged by telecommuting employees.Items on reward adapted from Hsu et al. [9] and Boss et al. [13]Reward 01I will receive a personal mention in oral or written reports if I comply with the security policies and procedures at this organization while telecommuting.Reward 02I will be given monetary or nonmonetary rewards for following security policies and procedures while telecommuting.Reward 03Tangible rewards depend on whether I follow the organization’s IT security policies, procedures, and guidelines while telecommuting.Reward 04My pay raise and/or promotion depend on whether I follow the documented security policies and procedures while telecommuting.Items on extrarole behavior adapted from Hsu et al. [9]Extrarole 01Employees of this department volunteer to engage in security policy-related behaviors while telecommuting.Extrarole 02Employees of this department help each other to learn about the telecommuting security policies.Extrarole 03Employees of this department help orient new employees to the telecommuting security policies.Extrarole 04Employees of this department develop and make recommendations concerning telecommuting information security policies that affect the entire organization.Extrarole 05Employees of this department speak up and encourage others in the organization to become more involved in telecommuting information security policies that affect the entire organization.Extrarole 06Employees of this department voice their opinion about new strategies or changes made to the telecommuting information security policies.Items on perceived severity adapted from D’Arcy and Devaraj [11]Perceived severity 01Severe responsibilities should be taken for accessing personnel systems using administrator passwords while telecommuting.Perceived severity 02Accessing unauthorized systems while telecommuting will result in disciplinary action.Perceived severity 03Severe responsibilities should be taken for revising personal overtime records using administrator passwords while telecommuting.Perceived severity 04Severe responsibilities should be taken for installing unauthorized software on corporate computers while telecommuting.Perceived severity 05Severe responsibilities should be taken for sending inappropriate emails to colleagues from the corporate email account while telecommuting.Items on perceived certainty adapted from D’Arcy and Devaraj [11]Perceived certainty 01Accessing personnel systems using administrator passwords while telecommuting will be discovered.Perceived certainty 02It is likely that companies will detect the employees who access unauthorized systems while telecommuting.Perceived certainty 03Revising personal overtime records using administrator passwords while telecommuting will be discovered.Perceived certainty 04Installing unauthorized software on corporate computers while telecommuting will be discovered.Perceived certainty 05It is likely that companies will detect the employees who install unauthorized software on corporate computers while telecommuting.Perceived certainty 06Sending inappropriate emails to colleagues from the corporate email account while telecommuting will be discovered.Items on moral belief adapted from D’Arcy and Devaraj [11]Moral belief 01If the password to a system that contains the payroll information of all employees is known, then it is morally permissible to access the system while telecommuting.Moral belief 02It is morally permissible to revise personal overtime records using administrator passwords while telecommuting.Moral belief 03It is morally permissible to install unauthorized software on corporate computers while telecommuting.Moral belief 04It is morally permissible to send inappropriate emails to colleagues from the corporate email account while telecommuting.


## 2.3.3. Validity and Reliability

As shown in Table4, a confirmatory factor analysis was conducted to test the unidimensionality of the measurements. A set of measured values, such as CMIN (Minimum Chi-square), DF (Degree of Freedom), p, RMR (Root-Mean-Square Residual), GFI (Goodness-of-Fit Index), AGFI (Adjusted Goodness-of-Fit Index), CFI (Comparative Fit Index), NFI (Normed Fit Index), and RMSEA (Root Mean Square Error of Approximation), was used to assess the fit of the model to the data. To get the optimal value of reliability, problematic items with squared multiple correlation (SMC) values less than 0.4 in the initial question were dropped, and the process was repeated until the desired result was achieved.Table 4
Measurement validity and reliability.
ConstructsAttemptsNumbersCMINDFpRMRGFIAGFICFINFIRMSEAEffectivenessFirst527.6675p≤0.0010.0230.9530.8580.9820.9780.148Final44.05020.1320.0080.9900.9520.9980.9960.071MandatorinessFirst45.76920.0560.0210.9860.9320.9930.9890.096Final45.76920.0560.0210.9860.9320.9930.9890.096SpecificationFirst9155.65527p≤0.0010.0860.8560.7610.9230.9090.152Final510.91250.0530.0230.9800.9410.9930.9880.076MonitoringFirst639.0079p≤0.0010.0730.9380.8550.9720.9650.127Final510.84850.0540.0420.9810.9420.9930.9870.075RewardFirst422.9792p≤0.0010.0930.9440.7220.9740.9720.226Final422.9792p≤0.0010.0930.9440.7220.9740.9720.226Perceived severityFirst559.9165p≤0.0010.1180.9010.7040.9370.9320.231Final42.37620.3050.0240.9940.9710.9990.9960.030Perceived certaintyFirst6135.8609p≤0.0010.0910.8120.5610.8870.8800.262Final45.65520.0590.0300.9870.9360.9940.9910.094Moral beliefFirst446.9142p≤0.0010.0430.9190.5960.9580.9570.330Final446.9142p≤0.0010.0430.9190.5960.9580.9570.330ExtraroleFirst6101.5149p≤0.0010.1200.8460.6400.9270.9210.223Final40.10220.9500.0031.0000.9991.0001.0000.000Our measurement model was analyzed based on the aforementioned confirmatory factor analysis, and the results are presented in Table5. After optimizing the adequacy of the survey questions based on the SMC values, our data yielded the following results: CMIN = 141.727, DF = 99, p=0.003, GFI = 0.934, AGFI = 0.886, CFI = 0.987, RMR = 0.046, NFI = 0.959, IFI = 0.987, and RMESA = 0.046. The value of p was found to be negative. However, the fit can be considered to be acceptable because the values of GFI, AGFI, CFI, NFI, and IFI were greater than 0.9 (note that AGFI was larger than 0.85), the value of RMR was less than 0.05, and the value of RMSEA was less than 0.1. As seen from Table 5, Cronbach’s alpha was greater than 0.7 (i.e., between 0.883 and 0.949), which indicates that the items have high internal consistency.Table 5
Analysis of the measurement model.
ConstructsM.V.aR.W.bS.R.W.cS.E.dC.R.eM.E.fSMCgC.A.hEffectivenesspe11.0000.8860.2990.7850.904pe41.0040.9320.05418.6930.1650.869Mandatorinessma21.0000.6790.6850.4610.809ma41.1820.8280.09612.3190.3760.685Specificationsp41.0000.9180.2530.8420.883sp61.0290.8680.05718.1650.4660.754Monitoringmo21.0000.8820.5940.7770.912mo31.1260.9510.07415.2800.2750.905Rewardre31.0000.9540.3550.9100.930re40.9380.9100.05218.1360.6590.828Perceived severityps21.0000.9570.1480.9170.935ps30.9350.9170.04719.7542690.841Perceived certaintypc11.0000.8870.3360.7870.907pc31.0880.9360.06117.7190.2100.875Moral beliefmb11.0000.9830.0990.9660.949mb20.8720.9220.06812.7510.3740.849Extraroleex41.0000.9330.3970.8710.943ex50.9950.9560.04621.7290.2500.914aMeasured variables; bregression weight; cstandard regression weight; dstandard error; ecritical ratio; fmeasurement errors; gsquared multiple correlations; and hCronbach’s alpha.As shown in Table6, a reliability analysis was performed using two tests: convergent validity and discriminant validity. Construct reliability was used to assess the convergent validity [33], and the average variance extracted (AVE) was used to assess the discriminant validity [34]. The construct reliability values obtained were greater than 0.7, which establishes convergent validity. Moreover, the AVE of all constructs was found to be greater than the square root of the largest correlation coefficient (which is 0.621 in this case), which establishes discriminant validity according to the criterion of Fornell and Larcker [34].Table 6
Validation of the measurement model.
Constructs123456789(1) Effectiveness1.00(2) Mandatoriness0.7081.00(3) Specification0.7880.7161.00(4) Monitoring0.4940.4720.5161.00(5) Perceived severity0.4450.5530.5360.4801.00(6) Moral belief–0.055–0.1–0.012–0.008–0.1221.00(7) Perceived certainty0.5450.5960.6460.4590.663–0.1031.00(8) Reward0.2750.2010.3020.3430.2690.3220.2101.00(9) Extrarole0.4690.4090.5370.4870.4160.0840.3800.5921.00Construct reliability0.9230.9550.8140.7980.8940.8850.8590.7750.847AVEa0.7810.6430.9360.6630.8080.7930.7520.6340.734aAverage variance extracted.


## 3. Results

This model was created with the assumption that the parameters shown to have the most influence in the existing research models in literature review would indicate different influences in telecommuting. Initially, we considered SETA (security education, training, and awareness) program and social desirability pressure which put pressure on doing what society wants as main parameters. However, in the model construction process, they were removed for model optimization. In addition, we tried to analyze more diverse hypothesis paths, but the paths that did not fit the model were removed. Therefore, this model has limitations in not being able to verify all parameters and all hypothesis paths.The proposed hypotheses were tested using structural equation modeling, which was performed using Analysis of Moment Structures (AMOS), a widely used statistical software package, along with LISREL: LISREL is a representative program for a long time, but it is difficult to use than AMOS. AMOS was selected for its convenient graphical user interface (GUI) compared to LISREL, in which users are required to create separate data files for each model. Also, AMOS is free for data compatibility with SPSS and Excel. As shown in Table7, our proposed model shows how the impact of control factors under normal circumstances differs in a different working environment, namely, telecommuting. As seen from Figure 2 and Table 8, the estimates from the structural equation modeling are within tolerable levels for the proposed model, such that CMIN=142.987, CMIN/DF=1.388, p=0.006, GFI=0.933, AGFI=0.889, CFI=0.988, RMR=0.051, RMSEA=0.043, NFI=0.959, and IFI=0.988. The values of chi-square were found to be negative. However, the model-fit can be considered to be acceptable with comparison to Table 9 because the values of GFI, AGFI, CFI, NFI, and IFI were greater than 0.9 (note that AGFI was larger than 0.85) and the values of RMR and RMSEA were less than 0.1.Table 7
Normal circumstance vs. telecommuting circumstance.
Normal circumstanceTelecommuting circumstanceFactorsExtrarole behaviors, perceived sanctions, moral beliefs, and social desirability pressureMandatoriness and specificationFigure 2
Results of the model. All path coefficients are standardized estimates corresponding top<0.05 and C.R. >± 1.96. Note that the C.R. values are within parentheses. Grayed-out arrows mean that hypotheses are not supported.Table 8
Results of the model.
Path (hypothesis)Direct effectIndirect effectEstimateC.R.apbEstimatepbSpecification ⟶ mandatoriness0.5908.150∗∗∗Specification ⟶ extrarole0.5083.885∗∗∗Monitoring ⟶ mandatoriness0.0200.6150.539Monitoring ⟶ extrarole0.1271.5390.124Reward ⟶ mandatoriness–0.012–0.5140.608Reward ⟶ extrarole0.4297.397∗∗∗Perceived severity ⟶ mandatoriness0.0150.3570.721Perceived severity ⟶ extrarole0.1191.1190.263Perceived certainty ⟶ mandatoriness0.0330.5490.583Perceived certainty ⟶ extrarole–0.138–0.9430.346Moral belief ⟶ mandatoriness–0.026–1.1630.245Moral belief ⟶ extrarole–0.083–1.4920.136Mandatoriness ⟶ effectiveness1.1809.201∗∗∗Extrarole ⟶ effectiveness0.0340.8820.378Specification ⟶ effectiveness0.7940.007Monitoring ⟶ effectiveness0.0390.426Reward ⟶ effectiveness0.0010.952Perceived severity ⟶ effectiveness0.0260.592Perceived certainty ⟶ effectiveness0.0360.644Moral belief ⟶ effectiveness–0.0530.124Model-fitcCMIN = 142.987, CMIN/DF = 1.388,p=0.006, GFI = 0.933, AGFI = 0.889, CFI = 0.988, RMR = 0.051, RMSEA = 0.043, NFI = 0.959, IFI = 0.988aC.R. > 1.96; bp<0.05; cModel-Fit Reference Value: CMIN/DF (<2), p>0.05, GFI (≥0.9), AGFI (≥0.85), CFI (≥0.9), NFI (≥0.9), RMR (≤0.1), and RMSEA (≤0.1).Table 9
Model-fit and reference (threshold) value.
CMIN/DFChi-squareGFIAGFICFINFIRMRRMSEA<2p>0.05≥0.9≥0.85≥0.9≥0.9≤0.1≤0.1Our test results show that the proposed hypotheses H1a (0.590, critical ratio (C.R.) = 8.150), H1b (0.508, C.R. = 3.885), H3b (0.429, C.R. = 7.397), and H7 (1.180, C.R. = 9.021) are supported within a 95% confidence interval, withp<0.05 and C.R. >± 1.96.However, the proposed hypotheses H2a (0.020, C.R. = 0.615), H2b (0.127, C.R. = 1.539), H3a (–0.012, C.R. = –0.514), H4a (0.015, C.R. = 0.357), H4b (0.119, C.R. = 1.119), H5a (0.033, C.R. = 0.549), H5b (–0.138, C.R. = –0.943), H6a (−0.026, C.R. = –1.163), H6b (–0.083, C.R. = –1.492), and H8 (0.34, C.R. = 0.882) are not supported.We observe that specification indirectly affects telecommuting security policies via mandatoriness, which corresponds to ap value of 0.007.As seen from Table10, we also investigated the moderating effect of the department (i.e., information security and other departments) on our hypotheses. Note that the difference in the number of degrees of freedom (DF) between the constrained and unconstrained models was 14 and the reduced chi-squared value (36.492) was greater than the corresponding reference value (23.68). Moderating effects were found to be significant (with p=0.001). In particular, specification had a stronger effect on mandatoriness in the information security department compared to other departments.Table 10
Results of moderating effects.
PathSecurity dept.OthersC.R.apbC.R.apbSpecification ⟶ mandatoriness3.586∗∗∗6.26∗∗∗Specification ⟶ extrarole2.5430.0114.227∗∗∗Monitoring ⟶ mandatoriness0.7490.4540.4240.672Monitoring ⟶ extrarole–1.9190.0551.960.05Reward ⟶ mandatoriness1.0390.299–1.3120.19Reward ⟶ extrarole6.191∗∗∗4.988∗∗∗Perceived severity ⟶ mandatoriness–0.0290.9770.4050.685Perceived severity ⟶ extrarole–2.8220.0052.2010.028Perceived certainty ⟶ mandatoriness1.0170.3090.1280.898Perceived certainty ⟶ extrarole2.5270.011–2.5260.012Moral belief ⟶ mandatoriness0.4040.686–1.5760.115Moral belief ⟶ extrarole0.3850.7–1.7890.074Mandatoriness ⟶ effectiveness5.5∗∗∗7.054∗∗∗Extrarole ⟶ effectiveness–0.7150.4751.4910.136aC.R. > 1.96; bp<0.05; ∗∗∗ = 0.000.Regarding the effect of sanctions on extrarole behaviors, the certainty of sanctions was more important in the information security department, whereas the severity of sanctions was more effective in other departments. In addition, specification affected more positively extrarole behaviors in the information security department than in other departments. Furthermore, reward affected intensely extrarole behaviors in the information security department than in other departments. Finally, mandatoriness was more effective in departments other than the information security department.Specification of telecommuting security policies was found to directly affect mandatoriness and extrarole behaviors (H1a and H1b). Mandatoriness improved the effectiveness of telecommuting security policies (H7), and reward was found to directly influence extrarole behaviors (H3b). However, extrarole behaviors did not improve the effectiveness of telecommuting security policies (H8). Finally, specification had an indirect influence on the effectiveness of telecommuting security policies.


## 4. Discussion

In this study, we examined how the security control factors in a well-organized office environment are affected in a telecommuting environment, which has become extremely common during the COVID-19 pandemic. Our analysis revealed that mandatoriness is a significant determinant of the effectiveness of telecommuting security policies compared to extrarole behaviors, which were considered to be more important by Hsu et al. [9]. It appears that working in an isolated space, separated from other employees, has a relatively variable effect. Our results confirmed that given the importance of mandatoriness in telecommuting environments, compulsory measures involving security technologies (e.g., virtual private network, one-time password, and virtual desktop infrastructure) should be implemented urgently. Moreover, it is recommended that organizations give more importance to their security control policies, such as prohibiting the use of screen capture tools and the data being stored into personal computers while teleworking.


### 4.1. Research Contributions

Our study mainly focused on the effects of various control factors on corporate security policies in uncharted working environment caused by the COVID-19 pandemic. The employees of an organization serve an important role by driving one another to keep the office environment well organized and under control. However, they do not play a crucial role in telecommuting environments because they cannot serve the same purpose being isolated from social pressure. Therefore, mandatoriness was found to affect intensely telecommuting security policies than extrarole behaviors. Furthermore, specification was found to play a crucial role in affecting mandatoriness compared to other control factors.In addition, our findings show that telecommuting tends to cause moral hazard as well as awareness among employees to avoid sanctions and monitoring by organizations. Interestingly, we found that reward has a critical impact on extrarole behaviors, which agrees with the Korean culture of “saving face.”Our study also found that different departments, including information security department and other departments, had different moderating effects. As shown in Table10, factors such as specification, sanctions, reward, and mandatoriness differed depending on the department duties. Our study contributes to the current research on security policy-making processes and shows that security policymakers need to consider developing new policies beyond conventional security programs.


### 4.2. Limitations and Future Research

Our study has a few limitations, which we discuss here. First, the use of a subjective assessment from respondents who telecommuted during the COVID-19 pandemic could lead to common method bias. This is because there is always a possibility that some respondents could have replied differently regarding the security controls in teleworking being better than those in conventional office environments. Thus, it would be better for future studies to examine the effects of control factors based on a variety of datasets that result from actual security policy violations.Second, we conducted the present study by measuring how each control item applies specifically to the teleworking environment. Therefore, it remains unclear whether our measurement items would be applicable to a completely different environment.Finally, the research data for this work were collected from organizations in Korea, especially from financial companies, where security controls are well organized compared to other companies. However, telecommuting was not popular in Korea before the COVID-19 pandemic owing to the restrictions of network segmentation. Thus, employees were not familiar with the concept of teleworking. Moreover, security controls were newly applied to teleworking because of the pandemic, and most employees have still not adapted themselves to the new work environment. Consequently, particular care must be taken before generalizing our findings to new office or telecommuting environments.After the experience of telecommuting, we need to revalidate our model 1 or 2 years thereafter, and we also encourage research in environment where workers have already been telecommuting for a long time to compare our models.


## 4.1. Research Contributions

Our study mainly focused on the effects of various control factors on corporate security policies in uncharted working environment caused by the COVID-19 pandemic. The employees of an organization serve an important role by driving one another to keep the office environment well organized and under control. However, they do not play a crucial role in telecommuting environments because they cannot serve the same purpose being isolated from social pressure. Therefore, mandatoriness was found to affect intensely telecommuting security policies than extrarole behaviors. Furthermore, specification was found to play a crucial role in affecting mandatoriness compared to other control factors.In addition, our findings show that telecommuting tends to cause moral hazard as well as awareness among employees to avoid sanctions and monitoring by organizations. Interestingly, we found that reward has a critical impact on extrarole behaviors, which agrees with the Korean culture of “saving face.”Our study also found that different departments, including information security department and other departments, had different moderating effects. As shown in Table10, factors such as specification, sanctions, reward, and mandatoriness differed depending on the department duties. Our study contributes to the current research on security policy-making processes and shows that security policymakers need to consider developing new policies beyond conventional security programs.


## 4.2. Limitations and Future Research

Our study has a few limitations, which we discuss here. First, the use of a subjective assessment from respondents who telecommuted during the COVID-19 pandemic could lead to common method bias. This is because there is always a possibility that some respondents could have replied differently regarding the security controls in teleworking being better than those in conventional office environments. Thus, it would be better for future studies to examine the effects of control factors based on a variety of datasets that result from actual security policy violations.Second, we conducted the present study by measuring how each control item applies specifically to the teleworking environment. Therefore, it remains unclear whether our measurement items would be applicable to a completely different environment.Finally, the research data for this work were collected from organizations in Korea, especially from financial companies, where security controls are well organized compared to other companies. However, telecommuting was not popular in Korea before the COVID-19 pandemic owing to the restrictions of network segmentation. Thus, employees were not familiar with the concept of teleworking. Moreover, security controls were newly applied to teleworking because of the pandemic, and most employees have still not adapted themselves to the new work environment. Consequently, particular care must be taken before generalizing our findings to new office or telecommuting environments.After the experience of telecommuting, we need to revalidate our model 1 or 2 years thereafter, and we also encourage research in environment where workers have already been telecommuting for a long time to compare our models.


## 5. Conclusions

In this study, we examined the factors affecting corporate security policies in the new telecommuting environment created by the COVID-19 pandemic. Cybersecurity threats are increasing exponentially with the sudden increase in teleworking. Despite existing security controls, more compelling cybersecurity risks keep threatening telecommuters. Thus, we need to continue searching for the critical determinants of security control factors in telecommuting environments. The data collected from 207 telecommuting employees through Google surveys in this work indicate that specification and mandatoriness play a decisive role in making telecommuting security policies more effective. Therefore, we suggest that corporations should take administrative and technical measures to guard against unexpected dangers and reinforce their security policies associated with the teleworking environment.



---

*Source: 2634817-2021-09-08.xml*