Information Security Governance: A model based on the Direct–Control Cycle

Practice-Based Discourse Analysis of InfoSec Policies

“…While information security governance research fail to offers detailed guidance on how to develop information security policies [e.g. 13], there exists practitioner-oriented literature that do [14,15]. However, this literature focuses on design guidelines without reflecting on the end products' usefulness from an employee perspective.…”

Agency Theory: Can it be Used to Strengthen IT Governance?

“…In order to measure, there exists a need to identify and collect the correct information to measure against [7]. Any directive issued by the board which cannot be measured in some particular way is of little value because compliance and adequate control cannot be achieved [7]. The board should extend this strategic directing and controlling responsibility into IT to ensure that it supports the corporate vision and mission.…”

“…These directives need to be translated into organizational policies, standards and procedures, which will enable strategic, tactical and operational alignment with the company's corporate vision and mission. The board also needs to control an organization by ensuring that there is compliance with all directives, policies, standards, procedures and any relevant laws and regulations [7]. Therefore, to properly control (i.e., manage), thus ensuring compliance with directives and policies, there exists a need to measure.…”

“…Therefore, to properly control (i.e., manage), thus ensuring compliance with directives and policies, there exists a need to measure. In order to measure, there exists a need to identify and collect the correct information to measure against [7]. Any directive issued by the board which cannot be measured in some particular way is of little value because compliance and adequate control cannot be achieved [7].…”

“…The strategic direction is usually implemented and maintained through a system of directing and controlling. [7] describe this as the direct-control cycle, claiming it to be central to corporate governance.…”