01681nas a2200193   4500008004100000245008400041210006900125260000900194300001200203490000700215520112200222653001501344653000801359100001901367700002001386700001801406700002401424856003901448       2019                        eng d00aInfoSec Process Action Model (IPAM): Targeting Insider's Weak Password Behavior0 aInfoSec Process Action Model IPAM Targeting Insiders Weak Passwo  c2019  a201-2250 v333 aThe possibility of noncompliant behavior is a challenge for cybersecurity professionals and their auditors as they try to estimate residual control risk. Building on the recently proposed InfoSec Process Action Model (IPAM), this work explores how nontechnical assessments and interventions can indicate and reduce the likelihood of risky individual behavior. The multi-stage approach seeks to bridge the well-known gap between intent and action. In a strong password creation experiment involving 229 participants, IPAM constructs resulted in a marked increase in R<sup>2</sup> for initiating compliance behavior with control expectations from 47 percent to 60 percent. Importantly, the model constructs offer measurable indications despite practical limitations on organizations' ability to assess problematic individual password behavior. A threefold increase in one measure of strong password behavior suggested the process positively impacted individual cybersecurity behavior. The results suggest that the process-nuanced IPAM approach is promising both for assessing and impacting security compliance behavior.10aAccounting10aBIS1 aCurry, Michael1 aMarshall, Byron1 aCorreia, John1 aCrossler, Robert, E  uhttps://doi.org/10.2308/isys-52381