Predictors of employees’ cyber incident reporting intention: A vignette study on TPB, psychological safety, and organisational citizenship behaviour.
Description
The goals of this research were threefold: (1) to assess the influence of subjective norms and perceived behavioural control from the TPB on end users’ intention to report cyber incidents, (2) to evaluate the added value of organisational citizenship behaviour and psychological safety in explaining reporting intention beyond the main constructs of the TPB, and (3) to explore the relevance of distinguishing between formal and informal reporting channels in the context of cyber incident reporting. Hypotheses: H1: Individuals in the positive subjective norm condition reported a stronger intention to report cyber incidents than those in the negative subjective norm condition: Supported H2: Individuals in the high perceived behavioural control condition reported a stronger intention to report cyber incidents than those in the low perceived behavioural control condition: Partially supported H3: Individuals with higher reported levels of organisational citizenship behaviour reported a stronger intention to report cyber incidents: Supported H4: Individuals who perceived higher psychological safety reported a stronger intention to report cyber incidents: Supported In addition, explorative analysis was conducted on reporting channel preferences. With regard to reporting channels, higher perceived severity increased preferences for formal reporting channels, while lower perceived severity was associated with greater uncertainty and reduced reporting intentions across both formal and informal channels. Organisational citizenship behaviour was associated with greater preference for formal reporting channels, and psychological safety was associated with preferences for informal reporting channels.
Files
Steps to reproduce
A total of 1,446 participants were initially recruited for the study through an online panel. After applying eligibility criteria (employment in government or semi-government organisations) and excluding incomplete responses, 818 valid respondents remained. Irrelevant personal and randomisation columns were removed, and a new column was created to code conditions (1–4). Composite variables were then constructed for the organisational citizenship behaviour scale, psychological safety scale, and formal/informal reporting (per vignette and total).
Institutions
- Open University of the NetherlandsLimburg, Heerlen
- NHL Stenden University of Applied SciencesFriesland, Leeuwarden