Received: 21 February 2008 Revised: 15 August 2008 2nd Revision: 31 January 2009 Accepted: 23 February 2009 Abstract Enterprises establish computer security policies to ensure the security of information resources; however, if employees and end-users of organisational information systems (IS) are not keen or are unwilling to follow security policies, then these efforts are in vain. Our study is...