Rewrite

Research Design

This study uses a correlational survey research design. The purpose of a correlational research design is to determine the extent to which two or more variables are statistically related or used in prediction. However, correlational design does not imply causation (Creswell, 2014).

The design is nonexperimental since no variables are manipulated. Likewise, multivariate correlation is used to identify relationships between multiple independent variables and a single dependent variable (Lomax & Li, 2013). George Udny Yule first introduced multivariate correlation in 1897 (Lomax & Li, 2013). Conversely, one disadvantage of multivariate correlation research is that it does not indicate causal inference (Connelly, 2012; Ingham- Broomfield, 2014; Lomax & Li, 2012; Patten, 2014; Swanson & Holton, 2005). The approach was used in this study to investigate the relationships between information security policy awareness, enforcement, and maintenance and information security program effectiveness. To achieve this purpose, the research was guided by the question: what is the relationship between information security policy awareness, enforcement, and maintenance and information security program effectiveness?

Methodological Approach

The study was investigated using a non-experimental approach. Quantitative studies can be accomplished using three primary approaches, including experimental, quasi-experimental, and non-experimental (Delost & Nadder, 2014; Sánchez-Algarra & Anguera, 2012). The best approach depends on the level of control and manipulation the researcher wants to exert on the study variables (Sánchez-Algarra & Anguera, 2012). In other words, a non-experimental approach is used with research that does not include an intervention or the manipulation of variables (Delost & Nadder, 2014; Sánchez-Algarra & Anguera, 2012; Spector & Meier, 2014).

This approach has been used in similar studies by Knapp and Ferrante (2012) and Siponen, Mahmood, and Pahnila (2014). Knapp and Ferrante investigated the relationship between information security awareness, enforcement, maintenance, and program effectiveness using a population of certified information security managers. Moreover, Siponen et al. (2014) researched the relationship between employees’ self-efficacy, response efficacy, and compliance to information security policy. Therefore, the approach is appropriate in addressing the research questions presented in this study.

Methodological Model

This study used multiple linear regression to determine which independent variables are significant predictors of the dependent variable. Multiple regression can establish that the three independent variables explain a proportion of the variance in the dependent variable at a significant level (through a significance test of R2), as well as the relative predictive importance of the dependent variables (by comparing beta  weights) (Field, 2013). The model for a multiple linear regression with n observations is given by the equation y=b0 + b1x1 + b2x2 + bnxn + εi, where y is the dependent variable, b0 is the constant (intercept), b1, b2, and bn are the unstandardized regression coefficients of each independent variable included in the regression model, and εi is the random error term usually described as residual.

Sampling Procedures

Participants for the study were solicited through SurveyMonkey Audience, an online professional panel of volunteers (Lowry et al., 2014). The participants were required to answer a series of questions to ensure that they qualify based on the sample criteria. Utilizing SurveyMonkey ensured that all participants remain anonymous and confidential (Lowry et al., 2014). Additionally, all participants were required to acknowledge having read and understood the study’s informed consent. Participants for the study were randomly selected using the sample frame provided through SurveyMonkey’s professional panel of volunteers (Creswell, 2014).

Definitions

CIA TRIAD :The CIA (Confidentiality, Integrity, and Availability) triad of information security is an information security benchmark model used to evaluate the information security of an organization. The CIA triad of information security implements security using three key areas related to information systems including confidentiality, integrity and availability.
Confidentiality: Ensures that data or an information system is accessed by only an authorized person. User Id’s and passwords, access control lists (ACL) and policy based security are some of the methods through which confidentiality is achieved
Integrity: Integrity assures that the data or information system can be trusted. Ensures that it is edited by only authorized persons and remains in its original state when at rest. Data encryption and hashing algorithms are key processes in providing integrity
Availability: Data and information systems are available when required. Hardware maintenance, software patching/upgrading and network optimization ensures availability
Information System Security: The U.S. National Information Systems Security Glossary defines "Information Systems Security" as the protection of information systems against unauthorized access to or modification of information, whether in storage, processing or transit, and against the denial of service to authorized users or the provision of service to unauthorized users, including those measures necessary to detect, document, and counter such threats.