In the literature review, the authors do a great job of synthesizing the existing research on how cybersecurity policies are often developed without input from end users. They cite several studies that found policies to be too legalistic, vague or difficult to understand. This helps establish the need for their research into developing user-centered policies.

I was intrigued by their mixed methods approach outlined on page 4, combining a review of existing policies, interviews and focus groups. Getting input from different perspectives seems like a smart way to get well-rounded feedback. The findings discussed on pages 5-7 really resonated with me. It was interesting to learn end users prioritize clarity and flexibility over comprehensive rules. They want to understand the “why” behind policies.

The discussion section on pages 7-8 does a nice job of analyzing how these findings can help create more user-centric policies. I like that the authors acknowledge policies must balance security, usability and organizational needs. Their recommendations around plain language, modular designs and involvement in the process seem very practical.


Overall, this was a thoughtful study that shed important light on an area needing more attention. I think their approach and conclusions could certainly help improve how my own institution develops and communicates cybersecurity policies