SME executives' perceptions and the information security preparedness model

Purpose - Information security has increasingly been in the headlines as data breaches continue to occur at alarming rates. This paper aims to propose an Information Security Preparedness Model that was developed to examine how SME executives' perceptions of security importance, implementation challenges and external influences impact their awareness and commitment to security preparedness. Design/methodology/approach - Funded by the Department of Justice, a national survey of SME executive' perceptions of information security preparedness was conducted. Using PLS-SEM, the survey responses were used to test the proposed Information Security Preparedness Model. Findings - The results indicate that as perceptions of security importance and external influences increase, SME executives awareness and commitment to information security also increases. In addition, as implementation challenges increase, awareness and commitment to information security decreases. Finally, as security importance and awareness and commitment to information security increases, executives' perception of security preparedness also increases. Research limitations/implications - Executive perceptions of information security were measured and not the actual level of security. Further research that examines the agreement between executive perceptions and the true state of information security within the organization is warranted. Originality/value - Prior information security studies using Roger's (1975, 1983) Protection Motivation Theory have produced mixed results. This paper develops and tests the Information Security Preparedness Model to more fully explain SME executive's perceptions of information security.