If someone is watching, I’ll do what I’m asked: mandatoriness, control, and information security
Protection motivation and deterrence: a framework for security policy compliance in organisations
Behavioral and policy issues in information systems security: the insider threat