Title: A cybersecurity compliance assessment and remedy framework

Authors: Rashid Manzar; Rajat Mishra

Addresses: Verizon, Atlanta, Alpharetta, GA 30022, USA ' Stephen F. Austin State University, Nacogdoches, TX, 75962, USA

Abstract: Compliance is a recurring theme in cybersecurity research as it continues to be a challenge for organisations to manage best practices and regulatory requirements for managing IT systems. Most empirical models related to cybersecurity compliance use fear appeal as a theoretical basis for studying compliance. 'Fear appeal' is any persuasive messaging to an employee that elicits fear by informing them of the consequences of non-compliant behaviours or actions. In this paper, we argue that a comprehensive assessment is essential for the generalisability of compliance frameworks that is not just limited to employees' personal devices but that, instead, spans across all cyber assets. Consequently, we examine the reasons behind non-compliance to better understand the phenomenon of compliance. We have outlined the challenges with the fear appeal, and draw upon the theory of organisational climate to propose a remediation framework that offers a roadmap for continuity of compliance that has not yet been studied.

Keywords: fear appeal model; FAM; cybersecurity compliance; ISC2; NIST special publication; code of conduct; protection motivation theory; PMT; security education, training and awareness; SETA; logging and monitoring.

DOI: 10.1504/IJBSR.2026.152911

International Journal of Business and Systems Research, 2026 Vol.20 No.2, pp.184 - 207

Received: 20 Oct 2024
Accepted: 07 Oct 2025
Published online: 14 Apr 2026 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article