From usable design characteristics to usable information security policies: a reconceptualisation

2.1 Organisational Information Security Policies

2.2 Landscape of policies

Besides organisational ISPs, also governments as well as civil organisations issue policies, i.e., ”document(s) regulating human actions regarding information security or expressing the organization’s [or contexts] information security aims”. ¹⁰ Based on this broad definition, we will broaden our view and also reflect on usability as well as compliance of governmental and civil ISPs.

3.1 Usable design characteristics of ISPs

Usable design of ISPs can be considered a facilitating factor, ⁸⁹ although most ISPs are based on compliance-focused content and traditional formulation methods that do not consider such design characteristics. ¹⁰ Despite this disconnect, usable design of ISPs can be studied from different perspectives, ^{15 , 18} such as ISP Content, ISP Presentation, and ISP Management. This research mostly stems from organisational context, however, some research also focused on the broader landscape of policies. Below is a brief overview of these perspectives:

ISP Content: The content of a policy refers to instructions, guidelines, or regulations defined to direct or control specific behaviour. Issue-specific ISPs must also be congruent with the overarching enterprise ISP. ^{28 , 90 , 91} Inconsistencies could lead to insecurities and wrong interpretations of how to comply with the ISP.

The ISP should provide actionable advice ^{28 , 60 , 92 , 93 , 94} to guide employees toward secure use of technologies. This includes managing, saving, and protecting assets in alignment with organisational information security risks ⁹² and goals. ²⁸ Guidance should also be applicable in uncertain scenarios. ⁹⁵

ISPs should consider the work context and be adjusted to match employees’ work routines and procedures. ⁹⁶ This includes considering the organisational risks, and specific risks of employees’ work environments and routines. ^{92 , 97}

Policies and prescribed measures must align with the responsibilities, roles, and the vertical/horizontal hierarchy of the organisation. Clear responsibilities and expectations for the roles involved should be communicated, ^{91 , 98} including sanctions for security incidents and policy breaches. ^{98 , 99}

Research on governmental polices especially supports such design features, as it, e.g., shows the importance of comprehensive categories ^{55 , 100} or well-defined terms or conditions. ¹⁰⁰

ISP Presentation: The presentation of an ISP refers to the style of its communication and visual representation to the intended audience. This includes format, language, structure, and visual elements used to convey the ISP’s content and directives. A clear structure and communicative strategy are needed to avoid information overload. ^{90 , 101 , 102} The user should identify the current version of the ISP, ⁹⁹ relevant chapters for task-specific issues, ^{90 , 99} and the overall scope of the document. ¹⁰³

The writing style must be direct, clear, and understandable. ¹⁰⁴ Terms should be clearly defined, especially those uncommon in the work context, with varying or ambiguous meanings. ^{90 , 105} The challenge lies in reducing the complexity of details, making them user-centred to avoid being ignored. ¹⁰⁶ A well-designed ISP should have a visual appearance relevant to the readers, is easy to understand and read, ^{15 , 28} as well as appropriate in length and tone. ¹⁰⁷ Achieving a balance between aesthetics, transparency, and intuitiveness is crucial to facilitate employees adoption of security measures. ¹⁰⁴

Conceptual frameworks, such as the Consolidated Communication-Human Information Processing (C–HIP), help align the presentation with human mental information processing. ¹⁰⁸ This includes adapting the presentation to the specific language skills, educational levels, and communication practices of the target audience. ^{31 , 60 , 91} Large organisations with diverse groups may need to present the same content in multiple ways. ⁶⁰

Although there is little research on the presentation of ISP content in governmental or civil contexts, ⁷³ adjacent research ¹⁰⁹ allows us to get a glimpse of presentation issues in this context. Previous research supported the importance of comprehensiveness ¹¹⁰ and understandability. ¹¹¹ Moreover, it highlights awareness and findability of information. ^{110 , 111}

Other research highlights the alignment with users’ education and ability. ¹⁰⁹ Usable handling and efficiency should be enabled by security and privacy artefacts. ^{109 , 111} A level of accessibility for non-experts should be granted. ^{109 , 112}

ISP Management: ISP Management refers to the process of developing, maintaining, and updating security policies and procedures. Effective ISP management must provide up-to-date information. Lacking up-to-date information could lead to gaps in addressing risks, ¹⁰⁷ based on changes in technology, work procedures, organisational structure, culture, goals, or legal requirements. ^{90 , 92 , 94 , 113} ISPs must be regularly reviewed and aligned with the organisation’s objectives and overarching documents. ^{91 , 92 , 94 , 95 , 113} A mismatch between documents could lead to conflicts and decrease usability, requiring users to determine which requirements are accurate and relevant for compliance.

Neither organisational ISP methods, nor design methods of governmental regulations ¹¹⁴ consider usable design characteristics within their processes. These are mostly oriented towards formal comprehensiveness and compliance goals. ^{91 , 92 , 94 , 95 , 113} This is why Jakobi et al. ¹⁶ argue that a more usability-oriented process of policy management could improve presentation, e.g., by providing policy evaluations to design more easily consumable legal documents and interactions with those.

3.2 Usable information security policies

To bridge the gap between designing ISPs based on usable design characteristics and the contextual requirements we argue for a stronger integration of usability as a relational property. ^{17 , 25 , 26} The following examples show how traditional approaches to the design of ISPs often fail as their focus is on comprehensive content and presentation, as well as alignment with strategic goals and other documents, instead of deep engagement with the context of application.

1. Organisational ISPs: Lawo and Stevens show ¹⁷ how a policy that demands encryption of mails is not usable, as the work context especially the mail client and the crypto tool provided by the organisation are not well aligned with the policy. For example, the crypto tool is not by default and automatically encrypting mails but requires additional effort and awareness. Thus, users probably do not encrypt, which results in a lack of effectiveness of the policy. This is in line with previous research on the poor usability of tools for email encryption and their lack of integration into communication routines. ¹¹⁵

2. Governmental ISPs: Alhazmi et al. ¹¹⁶ report that it is difficult for developers to understand the principles of the GDPR and implement them accordingly. Of course, developers are legally obliged to implement the law at this point, but due to a lack of understanding of the law, it cannot always be implemented in accordance with the regulation. As a result, GDPR does not achieve its full protective effect. More guiding formulations would support the developers in creating fully compliant implementations.

3. Civil ISPs: In a recommendation for securing the smart home, issued by the German Federal Office for Information Security, ⁷⁴ it states that consumers should set up a separate network for their smart homes devices. Here, we can easily assume that most users do not have the expertise to carry out the necessary configuration of their router. An alternative formulation ‘Only connect your smart home devices to the Guest Wi-Fi’ would probably increase usability as such guest Wi-Fi is usually available by default in most routers. Moreover, the security increasing network separation would be fulfilled no matter if a Guest Wi-Fi is used for device separation or a newly created IoT Wi-Fi.

The examples show that usable design characteristics alone are not enough to make a policy effective. It is crucial that mismatches between the policy and its application context are recognised and continuously addressed. For example, an encryption obligation remains ineffective if the provided tool is not integrated by default and requires additional effort. The GDPR cannot fully develop its protection if developers have difficulties implementing its principles in practice. And a recommendation on network separation in the smart home is useless if it fails due to users’ lack of technical expertise. Thus, usability is and should not be understood as just a question of good policy design, but is a relational property between policy and context of use. ^{25 , 26}

In addition, the inherent complexity of modern digital ecosystems requires flexible and adaptable policies for different contexts. ^{11 , 73} ISPs, although legally sound in structure, often do not take into account the diverse user interactions with technology or other contextual features. This discrepancy can result in policies that are sound in theory but fail in practical application, leading to vulnerabilities and security breaches. ¹⁷ A usable security approach recognises this by prioritising usability and ensuring that policies are not only clear and understandable, but also actionable in real-world scenarios. ^{28 , 60 , 92 , 93 , 94} By incorporating user feedback and iterative design principles, usable security policies can adapt to the changing technological landscape and user needs.

In the following, we will argue for a fundamental change ISP Contextual Alignment as well as subsequent changes in ISP Content and ISP Management to move towards more usable ISPs. Usability and Compliance should be considered as inherent features of the ISPs. These features should not replace the protection goal of the policy, but inform the whole lifecycle of the artefact as well as its managements. For our argument we will not revisit the ISP presentation, as our goal is to move beyond usable design characteristics. Still, the research presented in Section 3.1 remains valid.

UISP Context Alignment: Traditional ISPs primarily focus on compliance, treating socio-technical practices as objects of monitoring and deterrence. However, usability and appropriation research reveal that contextual factors significantly influence the actual use of IT artefacts, often creating a gap between design intentions and real-world application. ^{87 , 117} To address this, we argue that UISPs must be embedded within the socio-technical contexts they aim to regulate, considering the dynamic interactions between users, tasks, and environments.

Current ISP approaches tend to overlook these contextual factors, focusing solely on compliance rather than on addressing real-world practices. This oversight limits the effectiveness of policies, as they fail to account for how users actually interact with technology in their specific environments. While traditional policy-making aims to involve society, ¹¹⁸ it often disregards the nuances of regulatees’ lived experiences and practices.

To improve ISPs, we propose integrating policy with socio-technical practices, emphasising the need for long-term, usability-informed evaluations. These evaluations would help track how artefacts become embedded in evolving practices and contexts, acknowledging the dual relationship between practices and artefacts. ¹¹⁹ For example, the introduction of an ISP may require new competencies from users or lead to changes in the workplace practices themselves, ^{120 , 121} such as the adoption of new tools like encryption software. ¹²²

Given these considerations, we define UISPs as artefacts that are not only designed but also evaluated and managed in the context of users’ practices. These policies should be adaptable, ensuring they align with the socio-technical environment in which they operate. Changes in the policy or context can influence both the artefacts and the users, creating a feedback loop that requires continuous monitoring and adjustment.

Definition: UISPs are embedded in the socio-technical contexts of users and organisations, addressing both security and practical usability concerns. While traditional ISPs often overlook the influence of context on policy effectiveness, UISPs recognise the dynamic relationship between contexts, user practices, and the artefacts in use, ensuring that policies are aligned with real-world tasks and conditions.

UISP Content: Traditionally, ISPs have focused primarily on organisational regulatory compliance, emphasising confidentiality, integrity, and availability of information. ¹⁰ However, these practices often overlook the usability aspect crucial for ensuring that policies are not only adhered to but also effectively utilised in daily work environments. ⁹⁶ We therefore argue that UISPs extend the concept of ISPs content by ensuring policies fit the regulatees practices, tools, and contextual needs. For example, in an organisational context, UISPs consider the tools available as well as the work routines. ^{60 , 90 , 96}

Aligning ISPs and the regulated context is critical to ensure compliance and minimise barriers such as techno-stress, distractions, and interruptions. ^{123 , 124} For example, if work environments are misaligned with the policies, employees are more likely to deviate from security directives. Workplace safety regulations, such as the EU Directive on Workplace Safety and the US OSH Act, already emphasise that protective measures must be compatible with the work conditions to minimise interference and physical or psychological harm. ^{125 , 126 , 127} Thus, it is the responsibility of employers to ensure that work environments and IT systems are designed to facilitate seamless compliance with ISPs. For example, if encrypted email communication is required, employers should provide a tool that is well-integrated into the existing email client, used by default, and easy for employees to use without additional effort.

As digital technologies, such as AI, IoT, and robotics, blur the lines between physical safety and information security, new safety risks ^[2] emerge in these contexts of regulation. ¹²⁸ Governmental regulations are adapting to this shift, as seen with the European AI Act, which combines safety and security considerations. ^{55 , 129} Similarly, manufacturers’ ISPs are expanding to address both operational and information technologies due to their growing interconnection. ^{130 , 131} Numerous examples show safety risks stemming from security risks, such as hacker-induced energy supply failures ¹³² or the takeover of transport systems. ¹³³ A stronger conceptual link between safety and security is necessary. ^{131 , 134}

However, these evolving ISPs often suffer from fragmentation, inconsistent terminology, and disjointed document structures. From a usability perspective the multitude of policies and approaches exacerbates existing problems. making it challenging for regulatees to ensure compliance. ^{134 , 135} UISPs address this by harmonising terminology and integrating security and safety considerations across multiple levels. This enables a more cohesive and actionable approach to risk mitigation that centres around the user of a certain technology and all risks occurring from this, no matter if digital of physical. ^{131 , 134 , 136}

Research highlights the interconnectedness of governments, organisations, and civil society in security and sovereignty issues ^{4 , 5 , 6 , 7} and scholars advocate for an architectural approach to national information security, linking policies across different levels. ^{11 , 73 , 137} As digitalisation intensifies, the regulatory landscape expands, ^{12 , 13} and civil associations are increasing their policy recommendations. However, ISPs often lack an overarching architecture, leading to methodological and content fragmentation among the levels. ¹¹

An integrated architecture^[3] for UISPs, ensures that terminology is consistent and aligned with overarching protection goals, thus improving usability for the regulatee, ^{28 , 90} who is regulated by multiple concurrent policies within the same context. Independent and uncoordinated ISPs covering the same content hinder compliance and shift the burden of understanding to users. ^{11 , 73} Aligned content minimises user confusion, enhances compliance, and supports a unified, coordinated strategy across all levels of policy-making. ^{11 , 73} Without such integration, both governmental and organisational ISPs risk inefficiency, as regulatees might face different recommendations from different policies, which undermines the effectiveness of protective measures. ¹⁰

We propose embedding UISPs – ”document(s) regulating human actions regarding information security or expressing the organization’s [or context’s] information security aims” ¹⁰ – into a multi-level architecture, combining governmental, organisational, and civil guidelines into a cohesive security framework. ¹⁰ This integrated approach will facilitate both compliance and usability, fostering a more effective system of protection against emerging risks in the interconnected digital landscape.

Definition: UISPs extend traditional ISPs by integrating security and safety goals into a unified user-centred framework within a structured architecture. Unlike ISPs, UISPs’ content accounts for the socio-technical contexts in which security practices are applied, ensuring that policies are not only legally compliant but also practically usable, adaptable, and integrated across different organisational and societal levels.

UISP Management: The shift from ISPs to UISPs introduces several methodological challenges. Usability, as an emergent property from interactions among users, tasks, products, and environments, requires iterative and user-centred design approaches. ^{25 , 26} While usability evaluations traditionally rely on qualitative methods such as interviews, observations, and questionnaires, ^{15 , 138 , 139} there is a lack of standardised, transferable methods for large-scale, legal-compliant usability evaluation of ISPs. ¹⁷

A key barrier to improving ISP usability is the lack of established interfaces for stakeholder participation. Traditional policy-making methods, often bureaucratic and one-way, fail to incorporate user feedback during policy creation. ^{10 , 140} However, policy interfaces, crucial for integrating stakeholder knowledge, are well-researched in environmental legislation ^{141 , 142 , 143} and traditional governmental policy-making, ¹⁴⁰ where research advocates for updated communication and participation channels. In contrast, user-centred design emphasises active user participation throughout the design phase, allowing policies to better align with real-world tasks and needs. ¹⁴⁴ However, despite the value of user-centred approaches, these are rarely integrated into ISP design, which typically follows a more rigid, risk-focused process. ¹⁴⁵

Integrating different policy levels already poses significant challenges at the organisational level. ^{91 , 92 , 94 , 95 , 113} The complexity of integrating technical guidelines with overarching policy objectives is compounded by the need to incorporate legal texts, especially as emerging technologies complicate this process. ^{28 , 90 , 91} However, harmonised and user-friendly documents are essential for usability and effective protection. ^{91 , 107} The absence of integration across governmental, organisational, and civil policies undermines their overall effectiveness in achieving security and safety goals.

To address this gap, we propose to integrate participative as well as usability design methods, e.g., user-centred design, into the lifecycle of UISPs. This lifecycle, similar to iterative user-centred design, involves continuous user feedback and evaluation, ¹⁴⁴ integrating both qualitative and quantitative approaches to ensure policies are both usable and enforceable. Such an approach differs significantly from traditional policy-making cycles, ^{10 , 114 , 140} as traditional cycles, while iterative, do not focus on participatory, usability-focused policy creation (see Figure 2). ^{10 , 146}

Figure 2:

Organisational policy-making (see, e.g., ¹⁴⁶ ; the governmental policy-making cycle (see, e.g. ¹⁴⁰ ); and the user-centred design cycle (see, e.g., ¹⁴⁴ ).

Lawo and Stevens’ Information Security Policy Usability Scale (ISPUS) offers a useful model for evaluating organisational policies but lacks similar tools for governmental or private ISPs. ¹⁷ Traditional methods of risk-assessment in policy-making fail to fully capture the nuances of usability, leading to policies that are often ineffective in practice, despite having appropriate technical instruments. To enhance the management of UISPs, we define them as user-centred artefacts, guided by usability-informed methods throughout their lifecycle. These methods promote active user involvement, iterative design, and multidisciplinary collaboration, ensuring that policies remain adaptable and relevant as contexts change. ¹⁴⁷

Definition: UISPs redefine the management of ISPs by adopting iterative, user-centred design principles. In contrast to traditional ISPs, which rely on rigid compliance frameworks, UISPs prioritise continuous user feedback, usability evaluations, and legal validity, fostering an adaptive policy lifecycle that evolves in response to both user needs and regulatory changes.

In summary we define UISPs as: UISPs extend traditional ISPs by integrating usability as a relational property between policies and their socio-technical context with the goal of alignment. Unlike conventional ISPs, UISPs prioritise clarity, accessibility, and adaptability, ensuring that policies are not only legally compliant but also practical, intuitive, and aligned with real-world user practices. This includes a stronger alignment with contextual factors, such as physical security or multi-regulatory environments. By incorporating user-centred design principles, continuous feedback, and iterative improvements, UISPs foster an adaptive policy lifecycle that evolves with organisational, technological, and regulatory changes.

3.3 Challenges & research avenues

In light of this analysis, it becomes evident that a shift in our reconceptualisation of ISPs is imperative. Considering the arguments presented above, it becomes clear that this is not a minor adjustment but a fundamental shift in the conceptualisation of ISPs, their integration within the context, and the processes involved in their creation and use. Consequently, a comprehensive reevaluation of the role of ISPs is necessary, which in turn requires a corresponding transformation in established standards and security cultures. Such change comes with multiple challenges, that cannot be answered by this conceptual research. Thus, in the following, we present these challenges, as anticipated by us. Each challenge ²⁴ is introduced with a discussion of the issues arising from the shift towards usability and a corresponding research agenda in direct response to these issues.

4.1 Theoretical implications

From a theoretical point of view, the new conception of ISPs as UISPs, as presented here, offers a new concept within Usable Security/Safety. This concept lies at the interface between HCI and information security and IT security, the core of this research area. The UISP concept thus addresses the problems identified by scientists such as Malik et al. ¹¹ and Holton et al. ⁷³ They argue in favour of a more coordinated ISP architecture in order to guarantee information security throughout society.

Thereby, scholars are most prominently challenged by the changing role of ISPs. The shift in the function of ISPs from purely legal instruments to tools that promote both compliance and usability has far-reaching implications for the understanding and application of ISPs. For example, the traditional understanding of security hierarchies ¹⁴⁸ is challenged by more non-contractual, non-legal forms on influencing and regulating human behaviour through aligning document and context more strongly. It is necessary to develop models that resolve the contradiction of usability as a relational property and legal requirements beyond applying usable design characteristics.

The proposed reconceptualisation of ISPs content to include government policies and civil programmes broadens the scope of design and research. Policy makers and researchers should broaden their perspective to include interdependencies beyond their organisational boundaries and focus on a whole-of-society approach to information security. ^{149 , 150} This research builds on research in recent years focussing on the intersection of law and HCI, ¹⁶ e.g., the analysis of the AI Act. ⁵⁵

Moreover, the integration of design methods for aligning document and context into the yet longer macro-cycles of policy making ^{10 , 114 , 140 , 146} is a challenging, yet interdisciplinary task. New methods are required and will change the way scholars and partitioners understand and create these artefacts. These methods need to integrate usability experts, designers, security/safety experts, besides legal-experts. Similarly, combining security and safety into one policy requires change across an ecology of methods, standards, and practices. ^{131 , 134}

Lastly, this approach also offers a link for usable security/safety to the recently observed turn-towards-policy in HCI. ^{151 , 152} Here, our own findings on the research and implementation of policies, combined with the wider discourse, can open up future-oriented fields for HCI involvement.

However, in addition to the argumentatively derived idea, many open questions remain. The transfer between state, organisational and civil policies offers initial hypotheses for their design and impact. However, a research programme that addresses these questions has yet to be established. Of course, we would like to point out that the research questions and open issues are certainly not an exhaustive list. Especially in the course of future research, more open points will become apparent.

4.2 Practical implication

Even if many theoretical questions remain unresolved, the outlined approach of UISPs already offers implications for the practice of regulators in its current form. Practitioners should start with aligning their documents more strongly with the context of regulation.

In the UISP approach, we argue on the basis of existing research in favour of changing the function of ISPs. These should no longer be created by practitioners solely as tools for legal compliance, but should already include initial approaches to usability design. This would support the regulatees in their implementation so that security/safety gains can be achieved.

Beyond this overarching perspective, however, the framework shows ways to implement such an increase in usability.

For example, practitioners, particularly in the robotics, optical technology or AI-related industries, should consider the physical risks resulting from a lack of information security. In the first step, the boundaries between artefacts probably still need to be dissolved. However, joint risk management workshops could uncover new risks or a joint glossary could help to harmonise content and presentation.

The focus on compliance, moreover, can sometimes create a checklist mentality where the goal is to meet the minimum requirements set by a standard rather than achieve optimal and usable security. ¹⁰ This can lead to a false sense of security where organisations believe they are protected because they comply with standards, despite potential gaps in actual security practices. Practitioners should shift this focus from mere compliance to true understanding and commitment to security practices. Teaming with UX and Usability Experts from their companies could, e.g., help them improving their policies contextual fit.

Even if there is still a lack of methods for the design and evaluation of ISPs, we already know today which criteria make an ISP usable. Accordingly, practitioners should establish an UISP-interface with the regulatees in their specific context and take the criteria of a usable policy into account in their daily work. On a first glimpse, even user-centred design approaches would loosely fit the policy-making cycle, such that first experiments could be made here. Even without, a perfectly aligned method, they should include experts, from other fields, especially usability-experts to uncover the most-critical usability issues. Even small steps can certainly increase usability here.

Lastly, practitioners, even without changing the whole policy, could provide an accompanying guideline that visualises or explains the most important rules based on practical examples. Here, for example, research on icons could help to find meaningful and supportive visualisations (see, e.g., ^{84 , 86} ).