‘What a waste of time’: An examination of cybersecurity legitimacy

Managers who oversee cybersecurity policies commonly rely on managerial encouragement (e.g., rewards) and employee characteristics attitude) to drive compliant behaviour. However, whereas some initiatives are perceived as reasonable by employees, others viewed a ‘waste of time’. This research introduces judgements legitimacy new angle for understanding compliance with over time. Drawing theory from the organisational literature, we conduct three-wave survey 529 employees find that, each separate wave, negative mediate relationship between management support compliance, well inconvenience compliance. Our results provide an important influence initiatives. is significant because it highlights managers importance not simply expecting behaviour follow introduction initiatives, but that need be convinced fair reasonable. Interestingly, did sufficient our expectation increased likelihood incident will moderate legitimacy-policy relationship. result suggests perceptions unyielding differences in risk incidents facing organisations.