End user nonmalicious, counterproductive computer security behaviors: concept, development, and validation of an instrument

Employees' engagement in nonmalicious, counterproductive computer security behaviors (CCSB) poses a threat to organizations' information systems (IS) resources and assets. In order to understand CCSB, there is a need to propose theoretical foundations to research the phenomenon and to offer useful tools to help organizations assess such behaviors in their particular contexts. Relevant instruments that systematically measure or assess workers' participation in CCSB remain underdeveloped. This study proposes an instrument to assess engagement in CCSB. Confirmatory factor analysis confirmed three subscales of CCSB, that is, “careless use of IS resources,” “procrastinating carrying out required IS actions,” and “improper use of IS resources.” The instrument's relevance to research and practice is discussed and directions for future research are outlined.