As a business environment moves to digital business, various security threats have recently appeared and security incidents happened continually. The security incident is hard to prevent perfectly, moreover, a security policy focused on technical control has lots of limitations. The security is regarded as people issue, rather than technical issue. Therefore, the first step to establish security policy focused on people and implement necessary security practice is to understand human psychology and behavior. The purpose of this research is to identify security practices that affect behavior change for voluntary complying with security policy based on theory of planned behavior which is a representative theory of social psychology. The result of this research shows that security practices such as establishment of security policy that does not disrupt business efficiency, reward and disciplinary punishment, monitoring system, continuous security education and awareness program should essentially change behavior.

digital business, security, social psychology, behavior.