Information security policy awareness beliefs versus reality in electronic identity systems: a case study of the Ghanaian National Identity System

Electronic Identity Systems (EIS) have become a tool for economic, social, and political development in several countries. However, certain concerns by governments or their citizens have impeded wider adoption. These concerns are about EIS trustworthiness, privacy, and security. An effective Information Security Policy (ISP) can be key in addressing these concerns provided staff are aware and understand it provisions. A lot of work has been done on general ISP awareness in organizations, but little attention has been given to ISP awareness in electronic identity systems. Moreover, people's awareness of these policies in organizations is typically measured with instruments that focus on staff beliefs about their knowledge and understanding of ISP provisions rather than their actual understanding and their ability to translate ISP provision into protective behaviors. Staff belief is generally about how staff ISP awareness is typically measured while real awareness is about the prescribed behaviors of the staff. Using the Ghanaian National Identification Authority (NIA) as a case study, this paper examines the relationship between staff beliefs about ISP awareness and the reality of knowing and understanding the prescribed behaviors. A questionnaire study was conducted with scales from literature, which shows that NIA staff beliefs match the reality, despite the lack of a formal ISP and staff training. The study also indicates that a formal ISP and training can enhance staff understanding and confidence in their knowledge. It also shows that for EIS it is important that their ISP considers the organizational context.