Factors That Predict Behavioral Intentions to Adopt Cyber Incident Response Plans in Medium- and Large-Sized U.S. Businesses

Cyber incident response plans (CIRPs) benefit organizations by providing clear guidance for managing and mitigating cyber threats, attacks, and incidents. However, despite the increasing prevalence and impact of cyber incidents among medium- and large-sized U.S. businesses, the development and integration of structured incident response capabilities remain inconsistent. This quantitative predictive correlational study aimed to identify factors that predict cybersecurity professionals' behavioral intentions to adopt CIRPs in medium- and large-sized U.S. businesses, focusing on cyber incident responders. This study used the unified theory of acceptance and use of technology 2 (UTAUT2) as a theoretical framework to investigate seven research questions examining the relationships between the predictor variables of performance expectancy, effort expectancy, social influence, facilitating conditions, hedonic motivation, price value, and habit, and the outcome variable of behavioral intention to adopt CIRPs. Data were collected from N = 188 eligible cyber incident responders recruited via an online survey facilitated by a third-party survey company. Partial least squares structural equation modeling (PLS-SEM) was used to analyze the data. The findings indicated that performance expectancy and facilitating conditions were the only significant predictors of cyber incident responders' behavioral intentions to adopt CIRPs. The findings suggest that cyber incident responders are more likely to adopt CIRPs when performance benefits are evident and organizational support is available. Personal motivation, social expectations, and cost-benefit perceptions were not meaningful predictors of CIRP adoption. Future research should seek to identify theoretical frameworks that better explain the adoption of incident response plans.