Effective Cognitive Modes for Compliance with Information Security Policies over Time