Human Factors in Information Security: A Capability Framework for Administrative Professionals in the Digital Workplace

materials and timely feedback (Anderson & Agarwal, 2010). Dispositional traits further mediate these processes. Hadlington (2017) demonstrated that impulsivity and Internet-use patterns predict risky cybersecurity behaviors, suggesting that personality variables exert meaningful influence on protective performance. Affective states such as fatigue, stress, and emotional pressure further degrade cognitive vigilance, rendering individuals more susceptible to social-engineering tactics that exploit urgency and authority cues (Pfleeger &Caputo, 2012; Workman, Bommer & Straub, 2008). The behavioral determinants of secure conduct are thus neither purely cognitive nor purely affective but emerge from the dynamic interplay of multiple psychological variables operating within particular organizational contexts. A capability framework that aspires to operational utility must accommodate this complexity, articulating developmental approaches that address recognition, motivation, habit, and disposition in concert rather than in isolation (Reeves, Delfabbro & Calic, 2021). 5. Organizational Culture and Security Climate The behavioral performance of administrative professionals is inextricably embedded within the cultural environment of the organization’s they serve. Information security culture, conceived as the assemblage of shared assumptions, values, and practices that condition protective conduct across organizational members, has been demonstrated to exert substantial influence on individual compliance and on the resilience of protective regimes more broadly (Da Veiga & Eloff, 2010; AlHogail, 2015). Where culture frames safeguarding as a shared and valued contribution, protective behaviour is sustained by social as well as procedural reinforcement; where culture frames it as a peripheral nuisance, even technically competent workers gradually retreat to expedient practices that erode the protective posture. Top-management commitment occupies a particularly important position within this cultural architecture. Hu et al. (2012) demonstrated empirically that the perceived commitment of senior leadership to information protection mediates the influence of policy on employee compliance, shaping both the perceived legitimacy of protective requirements and the credibility of associated sanctions. For administrative professionals, who frequently work in proximity to senior decision- makers, the visible practices of their principals exert outsized symbolic influence: the executive who insists upon multifactor authentication, who declines to forward sensitive material to personal accounts, and who acknowledges the protective work of administrative staff sends a powerful normative signal that no formal policy can replicate (Chen, Ramamurthy & Wen, 2012). Parsons et al. (2015) extended this analysis by demonstrating that organizational information-security culture mediates the relationship between policy and decision-making, with stronger cultures producing more consistent and risk-sensitive judgements among employees. The implication for administrative work is consequential: even well-articulated procedural guidance will yield limited behavioral effect in the absence of cultural reinforcement, and culture itself is constructed through the cumulative micro-practices of daily organisational life rather than through declamatory policy statements (Albrechtsen & Hovden, 2010). Initiatives that integrate dialogue, participation, and collective reflection are accordingly more likely to embed protective values than those that rely solely upon top-down communication. The notion of security climate, distinct from but related to culture, captures the more immediate perceptions that workers hold regarding the seriousness of safeguarding within their proximal environment. Climate is influenced by recent incidents, by the visibility of leadership engagement, by the responsiveness of security functions to reported concerns, and by the consistency with which procedural expectations are reinforced (Goel & Chengalur-Smith, 2010). Administrative personnel, who occupy informational positions that reveal the texture of organizational responses to incidents and queries, are particularly sensitive to climate variations. When their reported concerns are received with attentive engagement, climate strengthens; when they are met with bureaucratic indifference, climate erodes, and the willingness to escalate ambiguous situations declines accordingly. The cultural and climatic conditions that support protective performance are themselves products of deliberate organizational investment. Sakyi et al. (2022) emphasized the importance of accountability frameworks that articulate clear expectations and measurable indicators of organizational performance, while Eboseremen et al. (2022) demonstrated the role of accessible visualization tools in supporting informed policy decisions. For administrative professionals, the integration of protective expectations into the broader performance and accountability architecture — rather than their isolation within a separate compliance silo — signals that safeguarding is constitutive of professional excellence rather than ancillary to it. A capability framework appropriate to this cohort must accordingly attend not only to individual competencies but to the cultural and climatic conditions within which those competencies are exercised, recognizing that capability and context are co- productive rather than independent (Padayachee, 2012; Stanton et al., 2005). 6. Phishing, Social Engineering, and Email-Based Threats Social engineering occupies a position of particular prominence within the threat landscape facing administrative professionals, owing to the structural features of administrative work that render it especially susceptible to manipulation. Mitnick and Simon (2002) articulated early and influentially how the human element constitutes the principal vector through which determined adversaries circumvent technical controls, and subsequent empirical work has substantiated the practical centrality of this insight (Sheng et al., 2010; Hadlington, 2017). Phishing, business email compromise, vishing, and pretexting each exploit cognitive shortcuts, professional norms, and emotional triggers in ways that demand cultivated recognition rather than reflexive vigilance. Phishing campaigns directed at administrative personnel frequently leverage authority cues, urgency framing, and contextual plausibility to elicit cooperative responses (Sheng et al., 2010; Dodge, Carver & Ferguson, 2007). A message ostensibly from a chief executive requesting an urgent wire transfer, a forwarded calendar invitation purportedly from a known counterparty, an attachment described as a board paper requiring immediate review, or a credential-reset confirmation appearing to come from internal information-technology functions are each calibrated to align with administrative routines. The cognitive cost of authenticating such requests is substantial, and the professional norms of responsiveness and discretion that administrative personnel internalize can paradoxically render them more vulnerable to manipulation, not less. Empirical investigations have demonstrated significant variation in phishing susceptibility across demographic and contextual variables (Sheng et al., 2010). Factors that predict susceptibility include limited prior exposure to phishing examples, time pressure, multitasking demands, and the perceived authority of the apparent sender. Importantly, susceptibility is not merely a function of individual deficiency; it reflects the design characteristics of attacker messages, the contextual features of the workplace, and the procedural support available for verification. Anti- phishing interventions accordingly require a multi-layered design that integrates training, technical filtering, and procedural verification (Kumaraguru et al., 2010; Cone et al., 2007). Kumaraguru et al. (2010) demonstrated that embedded training, in which simulated phishing exercises are coupled with immediate instructional feedback, can substantially improve recognition over time, particularly when reinforced through repetition and contextual variation. For administrative personnel, such training is most effective when calibrated to the specific message types they encounter in routine work, rather than when delivered through generic examples drawn from unrelated occupational contexts (Bada, Sasse & Nurse, 2019). Calibration further requires that training address not only the visual cues of suspicious messages but also the procedural responses appropriate to ambiguous cases — specifically, the protocols for verifying instructions through out-of-band channels and for escalating uncertain situations to designated colleagues or information-security functions. Beyond phishing in its classical form, administrative personnel are increasingly exposed to sophisticated business-email-compromise schemes that involve patient reconnaissance, careful linguistic mimicry and the exploitation of contextual cues drawn from public sources and prior breaches (Bukhari et al., 2022). Adversaries may study an organization’s travel patterns, vendor relationships and internal communication styles before deploying messages of considerable verisimilitude. Defending against such adversarial sophistication requires that administrative personnel develop a generalized disposition toward verification rather than reliance upon recognizable signs of fraudulence. The disposition is itself supported by clear procedural authorisation — the explicit normalization of verification calls, the institutional acceptance of slight delays in response and the cultural framing of escalation as professional contribution rather than personal failing (Albrechtsen & Hovden, 2010). The capability framework must therefore address social-engineering recognition as both a cognitive skill and an organizationally supported behavioral disposition, integrating training, procedure and culture in a mutually reinforcing configuration (Furnell & Vasileiou, 2017; Tsohou, Karyda & Kokolakis, 2015). 7. Authentication, Password Management, and Identity Stewardship Credential management constitutes a foundational domain within which administrative professionals exercise consequential protective decisions, both for their own accounts and, frequently, on behalf of the principals they support. The historical evolution of password practice has produced an environment in which users are confronted with proliferating credential demands across a heterogeneous estate of personal and corporate systems, a circumstance that has been associated with predictable behavioral responses including reuse, simplification and informal sharing (Adams & Sasse, 1999). These responses, far from indicating individual delinquency, reflect rational adaptations to systems whose cognitive demands exceed sustainable user accommodation, and effective remediation requires both technical and behavioral intervention (Sasse, Brostoff & Weirich, 2001). Adams and Sasse (1999) demonstrated empirically that user behaviour with respect to passwords is shaped by the perceived burden of credential management, the absence of clear communication regarding the rationale for protective requirements, and the cognitive impracticality of memorizing large numbers of strong, unique passwords. Their seminal observation that users are not the enemy of security regimes has been corroborated repeatedly in subsequent empirical work, which has documented the prevalence of behavioral adaptations including password reuse across personal and professional accounts, the documentation of credentials in physical or digital notes, and the informal sharing of credentials with trusted colleagues to facilitate operational continuity (Anderson & Agarwal, 2010). For administrative personnel, the credential domain extends beyond personal account management. Many administrative roles involve the management or delegated access to principals’ accounts, the coordination of password resets, the administration of shared mailboxes, and the authorization of access permissions for colleagues or external counterparties. Each of these activities introduces protective decisions whose consequences may be substantial, and each is shaped by the prevailing cultural and procedural environment (Bukhari et al., 2022; Padayachee, 2012). The temptation to share credentials informally, to retain credentials in unencrypted notes for convenience, and to bypass multifactor authentication procedures when they introduce delay is heightened by the service-oriented disposition characteristic of administrative work. The behavioral literature suggests that effective credential stewardship is most reliably supported by a combination of technical and procedural measures (Anderson, 2020; Adeniji, 2019). The deployment of enterprise-grade password managers, the universal application of multifactor authentication, the use of single sign-on architectures, and the implementation of privileged-access management systems collectively reduce the cognitive burden of credential management while raising the effective security of accounts. The integration of these technical measures with clearly articulated procedural expectations — specifying when sharing is permissible, how delegated access should be requested and authorised, and how lost or compromised credentials should be reported — supports behavioural performance without imposing unsustainable cognitive demands (NIST, 2018). A capability-oriented approach to credential stewardship extends beyond procedural compliance to encompass a deeper understanding of identity as a protective concept. Administrative personnel benefit from frameworks that help them reason about the principles underlying authentication — the distinction between identification and authentication, the rationale for multifactor approaches, the implications of credential compromise for downstream systems, and the role of session and device hygiene in sustaining the integrity of authenticated sessions (Shittu, Adeniji & Shittu, 2022). Such understanding supports more flexible and judgment-based responses in situations that exceed the scope of explicit procedural rules, and is therefore a critical component of the adaptive resilience that the proposed framework foregrounds. Without it, credential stewardship becomes a mechanical exercise vulnerable to disruption by novel circumstances; with it, administrative personnel are equipped to apply principled judgement to the credential decisions they routinely encounter (Bulgurcu, Cavusoglu & Benbasat, 2010; Bukhari et al., 2022). 8. Data Classification, Privacy Stewardship, and Document Handling The handling of organizational data constitutes a further domain in which administrative professionals exercise protective decisions of substantial consequence. Their work routinely involves the creation, transmission, storage, and disposal of documents whose sensitivity varies along multiple dimensions — commercial confidentiality, personal data, regulatory classification, contractual privilege, and reputational salience (Spears & Barki, 2010; Dhillon, Smith & Dissanayaka, 2021). Effective stewardship of such information requires both the cognitive capacity to recognise sensitivity in its varied forms and the procedural literacy to apply appropriate handling controls across the lifecycle of relevant artefacts. Data classification schemes provide a foundational organisational tool for guiding such stewardship. Yet empirical experience suggests that classification regimes frequently fail in execution, owing variously to the proliferation of categorical distinctions whose practical implications are unclear, to the inconsistent application of classification labels across organisational units, and to the absence of automated tooling that integrates classification with downstream handling decisions (Goel & Chengalur-Smith, 2010). Administrative personnel encounter the consequences of these failures with particular acuity, as the materials they handle often originate from multiple sources with divergent classification practices, and the procedural rules governing their handling may be inconsistently articulated or insufficiently calibrated to administrative workflows (Sakyi et al., 2022). Privacy considerations constitute a particularly demanding aspect of data stewardship. The administration of personal information — staff records, executive travel itineraries, family contact details, medical accommodations, and similar materials — places administrative personnel at the center of organizational privacy practice. Regulatory regimes such as data- protection legislation impose substantive obligations whose practical implementation requires informed judgement at the level of individual handling decisions: whether a particular disclosure is necessary for the purpose at hand, whether a recipient is authorized to receive specific information, whether a retention practice is consistent with stated purpose limitations, and whether requests from data subjects must be honored or escalated (Eboseremen et al., 2022). Schneier (2015) has argued forcefully that data accumulation generates protective obligations that exceed what most organizations are prepared to discharge, a tension to which administrative practice is unusually exposed. Document handling extends beyond classification and privacy to encompass the technical practices through which sensitive materials are transmitted and stored. The use of encrypted email, the selection of authorized file-transfer mechanisms, the avoidance of personal cloud storage for organizational documents, and the disciplined application of retention and disposal protocols collectively constitute the operational substrate of data stewardship (Bukhari et al., 2022; Wall, Lowry & Barlow, 2016). For administrative personnel, these practices intersect with the operational pressures of speed and convenience, and the temptation to default to expedient channels — personal email for after-hours work, consumer cloud storage for ad-hoc sharing, unencrypted mobile devices for travelling principals — is significant. Sustained adherence to disciplined handling practices, therefore, requires both technical scaffolding that renders such practices convenient and cultural reinforcement that valorises their consistent application. The capability framework articulated in this review accordingly treats data stewardship as a multi-dimensional competence that integrates classification literacy, privacy reasoning, technical fluency, and procedural discipline. Developmental approaches must move beyond rote training in classification taxonomies to cultivate the capacity for contextual judgement that real handling decisions require. This necessitates exposure to realistic scenarios, opportunities to discuss ambiguous cases with informed colleagues, accessible reference materials calibrated to administrative workflows, and feedback mechanisms that surface handling errors as learning opportunities rather than disciplinary occasions (Albrechtsen & Hovden, 2010; Filani et al., 2022). Within such a developmental architecture, data stewardship becomes not a constraint upon administrative work but a defining feature of administrative excellence. 9. Remote and Hybrid Work Security Considerations The normalization of remote and hybrid working arrangements has substantially altered the operational geometry within which administrative work is conducted, introducing protective considerations that pre-pandemic frameworks were not always equipped to address (Reeves, Delfabbro & Calic, 2021; Akindemowo et al., 2021). The dispersion of administrative tasks across home networks, personal devices, and consumer-grade collaboration platforms has expanded the organisational attack surface and reduced the visibility through which traditional security functions can monitor and respond to anomalous events. For administrative personnel, the implications are immediate and consequential, encompassing both the technical configuration of remote working environments and the behavioural disciplines required to sustain protective performance outside the physical environment of the workplace. Technical considerations in remote configurations begin with the integrity of the network infrastructure through which administrative work is conducted. Home networks vary widely in their protective posture, with implications for the susceptibility of connected devices to interception, lateral movement by compromised endpoints, and exploitation through unpatched router firmware (Anderson, 2020). Virtual private network deployments, when properly implemented and maintained, can substantially mitigate these exposures, although their effectiveness depends upon both technical configuration and consistent user adoption. Endpoint protection, encrypted storage, and patch- management discipline further support the security of remote administrative work, although their efficacy is conditional upon the degree to which administrative personnel possess the capability to manage them appropriately on their distributed devices (Bukhari et al., 2022; NIST, 2018). Behavioural considerations in remote and hybrid contexts encompass a distinct set of challenges. The boundary between professional and personal digital practice becomes porous, with implications for the cognitive and procedural separation through which administrative personnel maintain distinct protective standards across domains. The use of personal accounts for professional purposes, the storage of professional documents in personal cloud services, and the use of personal devices for sensitive administrative tasks each create exposure pathways that may be invisible to organizational monitoring (Anderson & Agarwal, 2010; Wall, Lowry, and Barlow, 2016). Reeves, Delfabbro & Calic (2021) further documented the phenomenon of cyber fatigue, observing that sustained engagement with protective demands during pandemic-era remote work generated measurable disengagement and degraded compliance. The social dimensions of remote work also bear upon administrative protective performance. The physical co-location of office settings supported informal verification practices — a quick conversational confirmation with a principal regarding an unusual request, a glance at a colleague’s screen to check the appearance of a suspicious message, a hallway exchange with information-technology colleagues to confirm the legitimacy of an unfamiliar communication. In distributed configurations, these informal verification channels require explicit replication through digital means, and their effectiveness depends upon the accessibility of colleagues, the responsiveness of designated support functions, and the cultural normalization of verification requests as appropriate professional conduct (Albrechtsen & Hovden, 2010; Furnell & Vasileiou, 2017). A capability framework appropriate to remote and hybrid administrative work must accordingly address both the technical and behavioral dimensions of distributed practice. Technical competencies include device hygiene, secure connection establishment, recognition of unusual network conditions, and disciplined use of authorized collaboration platforms. Behavioural competencies include the maintenance of cognitive separation between personal and professional digital practice, the deliberate cultivation of remote verification habits, and the recognition of fatigue-induced degradations in protective vigilance. Organizational scaffolding must support these competencies through the provision of appropriate equipment, accessible technical support, clear procedural guidance for distributed work, and supervisory practices that recognize the protective dimensions of remote performance (Ezeh et al., 2022; Akindemowo et al., 2022). The translation of pre-pandemic protective frameworks into post-pandemic distributed practice remains incomplete in many organizations, and the administrative cohort is among those whose protective capability requires the most deliberate developmental attention as workplace configurations continue to evolve (Moyo et al., 2021). 10. Security Awareness Training and Capability Development Security awareness training has long constituted the principal mechanism through which organization’s attempt to cultivate protective capability among non-specialist personnel, yet the empirical record regarding the efficacy of conventional training models is decidedly mixed (Puhakainen & Siponen, 2010; Bada, Sasse & Nurse, 2019). The prevailing pattern in many organization’s — annual generic e-learning modules supplemented by occasional bulletin reminders — has been shown to generate limited and short-lived behavioral change, and the persistence of awareness-related vulnerabilities even in organization’s with substantial training investments suggests that conventional models are insufficient to meet contemporary protective requirements (Furnell & Vasileiou, 2017; Karjalainen & Siponen, 2011). A substantial body of pedagogical research suggests that effective awareness development requires methodological characteristics that generic e-learning rarely embodies. Puhakainen and Siponen (2010) demonstrated through action research that compliance with security policies is most reliably improved through training that addresses workers’ specific operational contexts, engages them in active reflection upon their own practice, and integrates training with ongoing organisational processes rather than treating it as an episodic compliance exercise. Albrechtsen and Hovden (2010) similarly demonstrated that participatory approaches incorporating dialogue and collective reflection generate more sustained behavioural change than didactic instructional delivery. For administrative personnel, the implication is that training must be calibrated to the specific contexts of administrative work — the message types they routinely encounter, the systems they operate, the decisions they typically make, and the protective procedures available to them. Generic phishing examples drawn from unrelated occupational contexts offer limited preparation for the calibrated business email compromise attempts that target administrative cohorts, and abstract discussions of data classification provide insufficient guidance for the concrete handling decisions that administrative workflows require (Kumaraguru et al., 2010; Cone et al., 2007). Calibration extends beyond content selection to pedagogical method: scenario-based exercises, simulated phishing campaigns with embedded feedback, peer- discussion formats, and supervised reflection on actual workplace decisions each offer mechanisms through which capability may be developed in operationally relevant ways (Frempong, Ifenatuora & Ofori, 2020). Repetition and reinforcement constitute further methodological imperatives. Behavioural change requires that protective conduct be sustained across temporal horizons that extend beyond initial training, and the integration of brief, frequent reinforcement opportunities into ongoing operational practice has been shown to outperform concentrated training events with long inter-training intervals (Karjalainen & Siponen, 2011; Reeves, Delfabbro & Calic, 2021). The cognitive science underlying spaced repetition provides theoretical support for this approach, while the practical experience of training designers confirms its operational viability when integrated with existing workflow management systems. Assessment of training effectiveness must move beyond completion metrics to encompass behavioural outcomes. Kruger and Kearney (2006) articulated an early framework for assessing awareness across knowledge, attitudinal, and behavioural dimensions, and Parsons et al. (2014) developed the Human Aspects of Information Security Questionnaire as a more comprehensive instrument for evaluating awareness in operational contexts. For administrative personnel, the relevant outcome measures include not only knowledge of policies and procedures but observable behavioral indicators — phishing-simulation response rates, reporting frequencies for suspicious communications, compliance with credential and handling procedures, and the speed and quality of incident escalation. The cultivation of such outcomes requires that assessment be embedded within ongoing operational practice rather than restricted to discrete training episodes, and that the data generated be used formatively to refine subsequent developmental activities rather than punitively to discipline individual workers (Bulgurcu, Cavusoglu & Benbasat, 2010; Bada, Sasse & Nurse, 2019). A mature awareness function therefore operates as a continuous developmental process integrated with the broader human-resources, operational, and risk- management architecture of the organization, recognizing that capability is cultivated through sustained organizational investment rather than through episodic compliance exercises (Sakyi et al., 2022). 11. Capability Maturity and Competency Assessment The articulation of a capability framework presupposes a coherent approach to the measurement and evaluation of competence at multiple levels of granularity. Capability maturity models, originally developed in the context of software-process improvement and subsequently extended to a wide variety of organizational domains, provide a useful conceptual vocabulary through which the developmental trajectories of administrative protective competence may be specified. Such models articulate ordered levels of capability — typically progressing from initial or ad hoc through defined, managed, and optimizing states — and supply diagnostic criteria through which an organization’s current position may be assessed and developmental priorities identified (Da Veiga & Eloff, 2010; Sakyi et al., 2022). For administrative personnel, capability maturity may be conceptualised along multiple dimensions. Awareness maturity concerns the breadth and depth of relevant threat recognition and procedural knowledge; procedural maturity concerns the consistency and accuracy with which prescribed protective practices are enacted in routine work; judgement maturity concerns the capacity to navigate ambiguous or novel situations through principled reasoning; and adaptive maturity concerns the capacity to respond constructively to changing threat conditions, technological environments and organisational contexts (Parsons et al., 2014; Kruger & Kearney, 2006). These dimensions are conceptually distinct but operationally interdependent, and a mature capability profile exhibits coherent development across all of them rather than concentration in any single domain. Competency assessment instruments provide the practical mechanisms through which capability may be evaluated. Parsons et al. (2014) developed the Human Aspects of Information Security Questionnaire as a structured instrument for evaluating awareness across multiple domains, including password management, email use, social media, and information handling, and the instrument has been validated across a range of organisational contexts. For administrative personnel, the instrument may be supplemented by role-specific assessments that address the particular threat types, system operations, and procedural responsibilities characteristic of administrative work (Eboseremen et al., 2022). Behavioural indicators complement self-report instruments by providing observable evidence of protective performance. Phishing-simulation response rates, reporting frequencies for suspicious communications, compliance with credential management procedures, and the speed and quality of incident reporting each constitute measurable behavioral outcomes whose tracking provides longitudinal evidence of capability development (Kumaraguru et al., 2010; Bukhari et al., 2022). The integration of self-report and behavioral data yields a richer assessment than either source provides in isolation, and supports the formative use of assessment data to refine developmental activities and identify capability gaps requiring targeted intervention. The implementation of capability assessment requires careful attention to the cultural and motivational implications of measurement. Workers may experience assessment as a punitive or surveillance-oriented activity, and the resulting defensive responses can degrade the very behaviors that assessment seeks to measure (Vance, Siponen & Pahnila, 2012). Effective assessment regimes therefore emphasize formative rather than summative orientations, communicate the developmental purposes of measurement transparently, protect individual workers from punitive consequences except in cases of egregious or repeated violation, and use aggregated data to drive systemic improvements rather than individual sanctioning (Ifinedo, 2012; Sakyi et al., 2022). The cultural reception of assessment is itself a function of the broader security culture within which it is deployed, and assessment initiatives that violate the norms of supportive professionalism are likely to generate resistance even when their formal design is sound. The capability framework articulated in this review accordingly treats assessment as an integrated component of a broader developmental architecture rather than as an isolated measurement activity, recognizing that the cultivation of capability and its evaluation are mutually constitutive processes that succeed or fail in concert (Filani et al., 2022; Da Veiga & Eloff, 2010). 12. Governance, Policy, and Accountability Structures The protective performance of administrative personnel is embedded within an organizational architecture of policy, governance, and accountability whose configuration substantially shapes the conditions under which capability is exercised. Information security policy, in its formal documentary form, articulates the expectations to which workers are held and the procedural rules they are expected to follow (Goel & Chengalur-Smith, 2010). Yet policy in its formal sense represents only a fraction of the practical governance regime; equally important are the informal norms, supervisory practices, and accountability flows that translate policy into operational behavior (Hu et al., 2012; Bulgurcu, Cavusoglu & Benbasat, 2010). Effective policy formulation for administrative protective work requires attention to multiple characteristics that the empirical literature has identified as predictive of compliance. Policies are more likely to be followed when their rationale is clearly communicated, when their requirements are operationally achievable within the time and resources available to workers, when they are calibrated to the specific contexts in which workers operate, and when they are integrated with the broader performance expectations to which workers are held (Hu et al., 2012; Padayachee, 2012). Policies that fail these criteria — those whose requirements are abstract, operationally impracticable, contextually misaligned, or perceived as disconnected from broader professional expectations — tend to elicit the neutralization responses documented by Siponen and Vance (2010), in which workers rationalize non-compliance through appeals to higher loyalties, contextual necessity, or operational pragmatism. Accountability structures provide the architecture through which policy expectations are reinforced and through which deviations are addressed. For administrative personnel, accountability for protective performance has historically been weak, both because administrative roles have been treated as peripheral to formal security responsibility and because the specific decisions that administrative personnel make have not been clearly mapped to accountability flows (Spears & Barki, 2010; Sakyi et al., 2022). The integration of protective expectations into administrative role descriptions, performance reviews, and professional development frameworks repositions safeguarding as a constitutive element of administrative excellence rather than as an exogenous compliance burden. Governance considerations extend beyond the relationship between individual workers and organizational policies to encompass the broader institutional architecture within which protective decisions are made. Clear delineation of authority over administrative protective decisions — specifying which decisions may be made unilaterally, which require principal authorization, which require information-security consultation, and which require formal escalation—supports both individual confidence and organizational coherence (Anderson, 2020; Whitman & Mattord, 2018). Such delineation is particularly important in administrative contexts, where the routine exercise of delegated authority frequently exceeds the explicit boundaries of role definitions and creates ambiguity that adversaries exploit. Reporting and escalation channels constitute a further critical dimension of the governance architecture. The willingness of administrative personnel to report suspicious communications, ambiguous handling situations, and observed policy deviations is conditioned by the perceived accessibility of reporting mechanisms, the responsiveness of recipient functions, and the cultural framing of reporting as a professional contribution rather than personal liability (Albrechtsen & Hovden, 2010; Bukhari et al., 2022). Where reporting is met with attentive engagement and timely feedback, escalation frequencies rise, and the organizational visibility into emerging threats improves; where reporting is met with bureaucratic indifference or disciplinary response, escalation frequencies decline, and threats accumulate beneath the organizational radar (Reeves, Delfabbro & Calic, 2021). The capability framework articulated in this review, therefore, treats governance not as a separate institutional layer but as an integral component of the developmental architecture within which administrative protective capability is cultivated and exercised, recognizing that policy, accountability, and culture co-produce the conditions under which capability becomes operationally meaningful (Sakyi et al., 2022; Eboseremen et al., 2022). 13. Emerging Threat Vectors and Technological Frontiers The protective environment within which administrative personnel operate is continuously reshaped by technological evolution, adversarial innovation, and shifting organizational configurations. A capability framework whose conceptual architecture is anchored exclusively in contemporary threats will become progressively obsolete as the empirical landscape changes; adaptive resilience must therefore constitute an explicit dimension of the proposed framework, equipping administrative personnel to navigate threats that have not yet matured into recognizable forms (Crossler et al., 2013; Greitzer & Hohimer, 2011). The contours of emerging threat vectors merit specific examination as a means of grounding this adaptive orientation in the discernible trajectories of recent development. The convergence of generative artificial intelligence with social-engineering practice has substantially elevated the verisimilitude of fraudulent communications, with implications that bear directly upon administrative work. The historical reliability of linguistic anomaly as a phishing-detection cue has been substantially attenuated by the capacity of machine-generated text to produce contextually appropriate, grammatically polished, and stylistically calibrated content (Bukhari et al., 2022; Adebayo, 2022). For administrative personnel accustomed to relying upon discordant phrasing or syntactic awkwardness as indicators of fraudulence, the displacement of these cues by generative output requires the cultivation of alternative verification strategies grounded in procedural rather than linguistic recognition. Voice cloning and synthetic-media technologies similarly threaten established verification practices. The historical reliance upon voice familiarity as a verification mechanism for telephone-initiated requests is increasingly insufficient in environments in which adversaries may deploy convincingly synthesised audio of recognised principals (Schneier, 2015). Administrative personnel who routinely receive telephone requests from principals or counterparties must accordingly develop verification routines that do not rely solely upon voice recognition, instead incorporating callback procedures, codeword conventions, or out-of-band confirmation through alternative channels (Mitnick & Simon, 2002). The proliferation of cloud-hosted collaboration platforms introduces a further dimension of emerging exposure. Each new platform within an organisational ecosystem expands the surface across which administrative personnel must understand authentication procedures, sharing controls, and data-handling implications, and the rapid pace of feature introduction within established platforms means that even familiar tools require ongoing capability maintenance (Akindemowo et al., 2022). The shift toward integrated workflow automation, in which actions in one system trigger consequences in others, further complicates the cognitive accounting through which administrative personnel must reason about the implications of their decisions, and the rise of low-code and citizen-developer practices places administrative personnel in the position of configuring small-scale automations whose protective implications they may not fully appreciate (Eboseremen et al., 2022). Insider-threat considerations constitute a parallel evolutionary frontier. Greitzer and Hohimer (2011) articulated frameworks for modelling the behavioral precursors of insider attacks, and the substantial body of subsequent work has emphasized both the deliberate and the inadvertent dimensions of insider risk. For administrative personnel, the relevant considerations include both their own conduct and the patterns they may observe in colleagues, principals, or contractors whose access privileges expose the organization to potential abuse (Posey et al., 2015; Wall, Lowry & Barlow, 2016). The capacity to recognize behavioral anomalies, to navigate the ethical and procedural complexities of reporting such observations, and to do so within a supportive cultural environment constitutes an emerging competency whose importance is likely to increase as organizational complexity grows. The framework articulated in this review, therefore, foregrounds adaptive resilience as a defining capability dimension, equipping administrative personnel to navigate emergent threats through generalized principles and supported judgement rather than through reliance upon static rule- based responses calibrated to historical conditions (Hadlington, 2017; Bukhari et al., 2022; Pfleeger & Caputo, 2012). 14. A Proposed Capability Framework for Administrative Professionals The integration of the foregoing analytical strands yields a capability framework whose architecture is organized around four developmental tiers, each articulating distinct but interdependent competencies, and whose operation depends upon the organizational scaffolding within which individual capability is exercised. The framework is offered as a conceptual instrument through which organization’s may diagnose the current capability profile of their administrative cohort, identify developmental priorities, and structure the investments through which capability is cultivated over time. The foundational tier addresses elementary awareness and procedural knowledge: the capacity to recognise common threat types, to articulate the rationale for principal protective procedures, and to enact basic safeguarding routines, including credential hygiene, secure communication, and elementary data handling. Capability at this tier is the minimum condition for safe administrative work in contemporary digital environments and is reasonably attainable through structured induction, supplemented by routine reinforcement (Kruger & Kearney, 2006; Parsons et al., 2014). The procedural tier extends foundational awareness into more sophisticated operational practice. Capabilities at this level encompass disciplined application of organizational policies across the range of administrative tasks, accurate execution of more complex procedural routines including data classification, retention management, and access provisioning, and consistent participation in reporting and escalation channels. Development at this tier requires not only instructional input but supervised practice, opportunities for guided reflection upon real workplace decisions, and access to colleagues whose expertise can inform borderline cases (Puhakainen & Siponen, 2010; Albrechtsen & Hovden, 2010). The judgment tier addresses the capacity to navigate ambiguous, novel, or contested situations through principled reasoning rather than through reliance upon explicit procedural rules. Capabilities at this tier include the application of underlying protective principles to circumstances that exceed established procedural coverage, the integration of contextual cues into protective decisions, the constructive challenge of apparently authoritative requests when contextual indicators warrant scepticism, and the articulation of professional concerns through accessible escalation channels (Bulgurcu, Cavusoglu & Benbasat, 2010; Ifinedo, 2012). Development at this tier presupposes a sufficient base in the foundational and procedural tiers, and proceeds through scenario-based exercises, peer-discussion formats, and mentoring relationships with experienced colleagues (Karjalainen & Siponen, 2011). The adaptive tier addresses the capacity to respond constructively to evolving threat conditions, technological environments, and organizational contexts. Capabilities at this tier include the recognition of emerging threat patterns, the assimilation of new procedural requirements as organizational practice evolves, the capacity to support colleagues whose capability development is at earlier tiers, and the contribution of practical experience to the ongoing refinement of organizational protective practice (Crossler et al., 2013; Bukhari et al., 2022). Capability at this tier represents the developmental aspiration of mature administrative protective practice and is sustained through continuous engagement with organizational learning processes, professional development opportunities, and the broader community of administrative practice. The framework’s tiers do not represent discrete categorical stages so much as overlapping developmental trajectories along which administrative personnel progress through deliberate cultivation. Their operationalization requires organizational scaffolding that comprises four complementary components. First, technical scaffolding provides the tooling — password managers, multifactor authentication, encrypted collaboration platforms, data-loss-prevention systems — through which protective intentions are translated into reliable practice (Anderson, 2020; NIST, 2018). Second, procedural scaffolding articulates the explicit guidance through which administrative personnel may navigate routine and ambiguous decisions, calibrated to the operational realities of administrative work. Third, cultural scaffolding sustains the normative environment within which capability is recognized, supported and developed, including the visible engagement of senior leadership and the consistency of organizational responses to protective concerns (Hu et al., 2012; Da Veiga &Eloff, 2010). Fourth, developmental scaffolding provides the training, assessment, and progression mechanisms through which capability is cultivated over time, integrated with broader human-resources and learning-and-development functions (Sakyi et al., 2022; Filani et al., 2022). The proposed framework thus integrates individual capability with the organizational conditions necessary for its sustained exercise, situating administrative protective practice within an ecological model whose coherence and operational tractability render it suitable both for organizational application and for further scholarly elaboration. Conclusion The protective performance of organization’s in an environment of escalating digital risk depends upon dimensions of workforce capability that have been insufficiently theorized in mainstream security-strategy discourse. The administrative cohort, whose structural position within contemporary digital workflows confers both elevated access and elevated exposure, constitutes a population whose deliberate developmental cultivation is essential to enterprise resilience. The framework articulated in this review consolidates fragmented insights from behavioral science, organizational scholarship, and security-culture research into a developmental architecture organized around foundational awareness, procedural fluency, contextual judgement, and adaptive resilience, situating individual capability within the technical, procedural, cultural, and developmental scaffolding through which it is sustained. Several implications follow from the analysis. For practitioners, the framework supplies a diagnostic vocabulary through which organization’s may assess the current capability of their administrative cohort, identify developmental priorities, and structure the investments through which capability is cultivated over time. For policymakers, the analysis highlights the granularity required to translate abstract regulatory mandates regarding workforce capability into operationally meaningful guidance, suggesting that role-specific calibration of training and assessment requirements should constitute an explicit dimension of regulatory design. For scholars, the review identifies methodological and conceptual avenues for future inquiry, including the longitudinal assessment of capability development, the measurement of behavioral outcomes in operationally meaningful units, and the cross-cultural variability of administrative risk perception and protective practice. The limitations of the review are acknowledged. As a conceptual synthesis rather than an empirical investigation, the framework requires validation through application across diverse organizational contexts. The heterogeneity of the administrative cohort itself necessitates contextual specification in implementation, and the rapid evolution of digital workplace technologies ensures that ongoing refinement will be required. Notwithstanding these