Psychological drivers of compliance intention - The roles of professionals’ motivational profiles and personality traits in following information systems security policies at work

Cybersecurity is becoming increasingly important in organizations. Many data breaches and successful cyberattacks occur when employees ignore, bypass, or apply security rules incon-sistently. While existing research has focused on personality traits to explain compliance with information system security policies (ISSP), it has largely neglected domain-specific motivational regulation. Yet, sustaining effortful and sometimes inconvenient security prac-tices depends on how employees regulate their behaviors in this domain. The present study addresses this gap by using the five-factor model of personality and self-determination theo-ry (SDT) to examine how stable traits and distinct qualities of motivation relate to ISSP compliance intention. In a cross-sectional online survey, 218 office employees from small and medium-sized enterprises reported their personality traits, security-related work motiva-tion, and ISSP compliance intention. We tested the multidimensional structure of the adapted motivation measure using confirmatory factor analysis and identified qualitatively distinct motivational profiles through latent profile analysis. To examine the incremental contribu-tions of structural characteristics, personality traits, and motivational profiles to ISSP com-pliance intention, we conducted hierarchical multiple regression analyses. The results sup-port a multidimensional structure of motivational regulation and yield three profiles that differ in their extent of self-regulated behavior in pursuit of internalized goals. Structural characteristics (company size) and personality traits (agreeableness, conscientiousness) were significantly associated with ISSP compliance intention (R² = .257). Motivational profiles accounted for additional variance (ΔR² = .08; final R² = .333), with autonomous profiles re-porting higher ISSP compliance intention than the amotivated profile. Based on these find-ings, the study outlines how SDT-based interventions can support employees’ psychological needs for autonomy, competence, and relatedness, thereby fostering more internalized and enduring ISSP compliance.