A quantification mechanism for assessing adherence to information security governance guidelines

Abstract

Purpose Boards of Directors and other organisational leaders make decisions about the information security governance systems to implement in their companies. The increasing number of cyber-breaches targeting businesses makes this activity inescapable. Recently, researchers have published comprehensive lists of recommended cyber measures, specifically to inform organisational boards. However, the young cybersecurity industry has still to confirm and refine these guidelines. As a starting point, it would be helpful for organisational leaders to know what other organisations are doing in terms of using these guidelines. In an ideal world, bespoke surveys would be developed to gauge adherence to guidelines, but this is not always feasible. What we often do have is data from existing cybersecurity surveys. The authors argue that such data could be repurposed to quantify adherence to existing information security guidelines, and this paper aims to propose, and test, an original methodology to do so. Design/methodology/approach The authors propose a quantification mechanism to measure the degree of adherence to a set of published information security governance recommendations and guidelines targeted at organisational leaders. The authors test their quantification mechanism using a data set collected in a survey of 156 Italian companies on information security and privacy. Findings The evaluation of the proposed mechanism appears to align with findings in the literature, indicating the validity of the present approach. An analysis of how different industries rank in terms of their adherence to the selected set of recommendations and guidelines confirms the usability of our repurposed data set to measure adherence. Originality/value To the best of the authors’ knowledge, a quantification mechanism as the one proposed in this study has never been proposed, and tested, in the literature. It suggests a way to repurpose survey data to determine the extent to which companies are implementing measures recommended by published cybersecurity guidelines. This way, the proposed mechanism responds to increasing calls for the adoption of research practices that minimise waste of resources and enhance research sustainability.

Lost in the middle – a pragmatic approach for ERP managers to prioritize known vulnerabilities by applying classification and regression trees (CART)

“…This is also consistent with IT decision making and communication within overall governance responsibilities (Shaikh and Siponen, 2023; Bongiovanni et al , 2022) and decision-making under time pressure and workload requirements (Chen et al , 2022; Gyllensten et al , 2021; Chowdhury et al , 2019; Chowdhury et al , 2022; Giger and Pochwatko, 2008).…”

“…The ERP Manager faces a conundrum as they manage the upper layers of the technology stack focusing on business processes and applications and the vulnerabilities are typically identified at the lower layers of the technology stack. The outcome of our approach allows the ERP Manager to set priorities for vulnerability remediation by establishing the significance of the threat or vulnerability along with identifying the specific systems that are vulnerable or exposed, adding a pragmatic approach to enhancing the governance process (Bongiovanni et al , 2022).…”

“…The results presented in this paper will help ERP managers anticipate high-risk enterprise system vulnerabilities and develop actionable plans to manage those vulnerabilities, reducing the concerns of time pressure and workload (Giger and Pochwatko, 2008; Chowdhury et al , 2019; Chowdhury et al , 2022; Bongiovanni et al , 2022).…”

“…Specifically, vulnerabilities classified by the NVD for Severity based on multiple variables such as Integrity, Confidentiality and Availability will be used to predict the risk of ERP vulnerabilities based on their impact. Allowing the ERP Manager to identify the relationships between vulnerability factors that need to be monitored closely if the enterprise wishes to identify critical, high-risk vulnerabilities and prioritize those vulnerabilities for remediation, developing a governance approach (Bongiovanni et al , 2022).…”

Digital Security Governance

“…Last, the current ISG literature lacks thorough explanations regarding its effectiveness in digital environments. Studies on ISG effectiveness in general are scarce and lack empirical grounding (Bongiovanni et al 2022). The limited studies that do address ISG effectiveness tend to view it as an isolated, one-sided security perspective, focusing solely on in what manner the governance of security reduces security risks, breaches, and incidents (Liu et al 2020).…”