An empirical study of information security policy on information security elevation in Taiwan

Abstract

Purpose -With the popularity of e-commerce, information security is vital to most organizations. For managers, building and implementing an information security policy (ISP) has long been assumed to be an effective managerial measure to elevate an organization's security level. This paper attempts to investigate the dominant factors for an organization to build an ISP, and whether an ISP may elevate an organization's security level? Design/methodology/approach -A survey was designed and the data were collected from 165 chief information officers in Taiwan. Findings -The empirical results show that some organizational characteristics (business type and MIS/IS department size) might be good predictors for the ISP adoption and that the functions, contents, implementation and procedures of an ISP may significantly contribute to managers' perceived elevation of information security. Practical implications -Building or adopting an ISP is examined empirically to be an effective managerial measure to elevate its security level in Taiwan, and that the building of an information security should focus on the comprehensiveness of its contents, procedures and implementation items, rather than on the documents only. Originality/value -Few empirical studies have been conducted so far to examine the effectiveness of an ISP, thus the value of this paper is high.

Review of Information Security Policy based on Content Coverage and Online Presentation in Higher Education

“…One of the most significant roles of information security policy is to precisely specify user's rights and responsibilities and to successfully communicate it to all users, to ensure there is a mutual and coherent understanding of information security that is embraced by the organization [11]. This eliminates excuses for employees who fail to follow and execute security practices aligned with the organization's policy [23].…”

The information security policy unpacked: A critical study of the content of university policies

“…One increasingly important mechanism for protecting corporate information, and in so doing helping to safeguard organizational knowledge assets, is through the formulation and application of a formal information security policy [Hinde, 2002;von Solms & von Solms, 2004]. The broad consensus within the literature is that the information security is a high level document, which defines the organizations' goals, intentions and priorities, with respect to the management of information security, as well as highlighting the roles, rights and responsibilities of individual members of staff, with respect to the attainment of the security objectives [Hong et al, 2006;Hone & Eloff 2002a]. Given their perceived importance, it is not surprising that there is already an established literature, with respect to the importance and role of the policy, as well as approaches to its formulation and dissemination.…”

A Framework for Evaluating the Tension between Sharing and Protecting Health Information

“…Research has considered the role [18], importance [35], structure [4], and content [12] of the information security policy, but none have directly addressed the essential tension between the need to both share and protect information that is fundamental to organizations like an HIE. Our theoretical model addresses that tension and we apply the model to an HIE to understand how the tension is managed through the information security policy development process in such an organization.…”